Skip to content
.ca
sign in
detection rulehost

LD_PRELOAD rootkit hook in the agent systemd unit

First seen
2026-06-16
Last seen
2026-06-16
Used in
1 post
HostLD_PRELOAD rootkit hook in the agent systemd unit
sudo grep -rs 'Environment=LD_PRELOAD=/var/cache/systemd-network/' /etc/systemd/system/ 2>/dev/null

Posts using this rule

  • highSelf-Blocking Docker API Abuse Delivers the VoidLink DDoS-for-Hire Botnet

    Host

    VoidLink injects its PID-hiding rootkit through an `Environment=LD_PRELOAD=/var/cache/systemd-network/.libhide.so` line in `systemd-network-monitor.service` (and an `export LD_PRELOAD=` in its `@reboot` crontab entry), not through `/etc/ld.so.preload` (that path appears only in the agent's rival-cleanup routine). Any `Environment=LD_PRELOAD=` pointing at a library under `/var/cache/systemd-network/` is the hook.