LD_PRELOAD Hijacking.

Linux persistence and library-hijacking technique that uses the LD_PRELOAD environment variable or /etc/ld.so.preload to inject attacker code into dynamically linked processes. It belongs to the Attacks & Threats category of cybersecurity.

Linux persistence and library-hijacking technique that uses the LD_PRELOAD environment variable or /etc/ld.so.preload to inject attacker code into dynamically linked processes.

LD_PRELOAD hijacking (MITRE ATT&CK T1574.006) abuses the GNU dynamic linker on Linux and most Unix-like systems. By setting LD_PRELOAD (for a single process or a user shell) or by writing a path to /etc/ld.so.preload (system-wide), an attacker forces ld.so to load a chosen shared object before all other libraries. The malicious .so can hook libc symbols such as readdir, open, accept, or write to hide files and processes, capture credentials, or maintain a userland rootkit. The technique works against non-setuid binaries and is widely used by Linux malware families like HiddenWasp and Symbiote. Defenses: monitor /etc/ld.so.preload for changes (AIDE, auditd), restrict it to root, watch for unexpected LD_PRELOAD usage, and verify libc behavior with statically linked tools.

Defences for LD_PRELOAD Hijacking typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: ld.so.preload abuse, Shared library hijack.