High 2026-02-04

Environment Variable Manipulation

This rule flags attempts to manipulate environment variables that control how programs find code to run or where secrets are stored. Attackers abuse this to make a system silently run malicious code instead of the intended program, or to expose stored credentials and tokens.

How the attack works

An attacker (or malicious script) modifies the PATH variable so that a fake, malicious binary is found and executed before the legitimate one. Alternatively, they set LD_PRELOAD to force the dynamic linker to load an attacker-controlled shared library into every new process, giving them code execution inside trusted programs. Separately, an attacker may read or export environment variables that hold API keys, passwords, or session tokens, harvesting credentials without touching disk-based secret stores. These techniques are often used after initial access to establish persistence or move laterally.

Netzilo detection

Netzilo can block this behaviour when it is observed.

Signature ID: 94e5f1ad-d61b-5266-8bf3-5fb91c0d4970
Severity: High

Classification

AML.T0055 · Unsecured Credentials AML.T0050 · Command and Scripting Interpreter ASI02 · Tool Misuse and Exploitation

Why it matters

An organization can lose control over what code actually runs on affected systems, and credentials stored in environment variables can be stolen and reused elsewhere, leading to further compromise.

What you can do

→Restrict who can modify PATH, LD_PRELOAD, and LD_LIBRARY_PATH on production systems, and review these values as part of routine audits.
→Avoid storing long-lived credentials or tokens in environment variables; use a secrets manager or short-lived tokens instead.
→Set expected baseline values for PATH and preload variables on critical hosts and alert on deviations.
→When investigating alerts, check whether the change came from a known admin or CI/CD process before treating it as suspicious, since legitimate setup scripts commonly touch these variables.