| elastic |
Shared Object Created by Previously Unknown Process |
production |
2026-10-05 |
| elastic |
Unusual LD_PRELOAD/LD_LIBRARY_PATH Command Line Arguments |
production |
2026-09-18 |
| elastic |
Suspicious Dynamic Linker Discovery via od |
production |
2026-09-18 |
| elastic |
Pod or Container Creation with Suspicious Command-Line |
production |
2026-09-18 |
| elastic |
Dynamic Linker Copy |
production |
2026-09-18 |
| elastic |
Potential Suspicious File Edit |
production |
2026-09-18 |
| elastic |
Potential CVE-2025-32463 Nsswitch File Creation |
production |
2026-09-18 |
| elastic |
Modification of Dynamic Linker Preload Shared Object |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via PKEXEC |
production |
2026-09-18 |
| elastic |
Dylib Injection via Process Environment Variables |
production |
2026-09-18 |
| elastic |
Modification of Environment Variable via Unsigned or Untrusted Parent |
production |
2026-09-18 |
| elastic |
Dynamic Linker Modification Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Suspicious Echo or Printf Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Potential Persistence via File Modification |
production |
2026-09-18 |
| elastic |
Dynamic Linker Creation |
production |
2026-09-18 |
| elastic |
Dynamic Linker (ld.so) Creation |
production |
2026-09-18 |
| elastic |
Unusual Preload Environment Variable Process Execution |
production |
2026-09-18 |
| splunk |
Shai-Hulud Workflow File Creation or Modification |
production |
2026-05-13 |
| splunk |
GitHub Workflow File Creation or Modification |
production |
2026-05-13 |
| splunk |
Linux Auditd Preload Hijack Library Calls |
production |
2026-05-13 |
| splunk |
Linux Auditd Preload Hijack Via Preload File |
production |
2026-05-13 |
| splunk |
Linux Preload Hijack Library Calls |
production |
2026-05-13 |
| elastic |
Deprecated - Suspicious File Creation in /etc for Persistence |
deprecated |
2025-06-26 |
| elastic |
Deprecated - Potential Process Injection via LD_PRELOAD Environment Variable |
deprecated |
2023-09-25 |
| sigma |
Code Injection by ld.so Preload |
test |
2022-10-09 |
| sigma |
Modification of ld.so.preload |
test |
2021-11-27 |