Linux LD_PRELOAD Injection via HTTP Payload T1574.006

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

This rule detects suspicious HTTP request bodies containing the 'LD_PRELOAD' environment variable assignment, targeting common temporary or writable directories. This behavior is indicative of an attempt to perform dynamic linker hijacking on a Linux system to inject malicious shared libraries into target processes.