==================================================

CREATED: NIX-LD-PRELOAD-MODIFICATION (#1909)

Description

This detector identifies the modification of /etc/ld.so.preload. Adversaries use this technique to inject libraries into the execution of unrelated processes.

ATT&CK Technique T1055

Did this answer your question?