detection rulehost

LD_PRELOAD rootkit hook in the agent systemd unit

HostLD_PRELOAD rootkit hook in the agent systemd unit

sudo grep -rs 'Environment=LD_PRELOAD=/var/cache/systemd-network/' /etc/systemd/system/ 2>/dev/null

Posts using this rule

highSelf-Blocking Docker API Abuse Delivers the VoidLink DDoS-for-Hire Botnet
Host
VoidLink injects its PID-hiding rootkit through an `Environment=LD_PRELOAD=/var/cache/systemd-network/.libhide.so` line in `systemd-network-monitor.service` (and an `export LD_PRELOAD=` in its `@reboot` crontab entry), not through `/etc/ld.so.preload` (that path appears only in the agent's rival-cleanup routine). Any `Environment=LD_PRELOAD=` pointing at a library under `/var/cache/systemd-network/` is the hook.
2026-06-10