This rule detects the use of process environment variables LD_PRELOAD to inject a shared library into a binary at or prior to execution. A threat actor may do this to load a malicious shared library ...

On many Linux distributions, the kernel is configured by default to prevent any process from calling ptrace() on another process that it did not create (e.g. via fork()). This is a security feature ...

Shared object files streamline programs by providing information applications need to do their jobs, but that don’t have to be part of the application itself. To find out which of these files a Linux ...

Abstract: Fileless malware and in-memory-only malicious payloads have become a trend of cyberthreat. To perform a stealthy and traceless infiltration, threat actors and security researchers have ...