Detects the ld.so preload persistence file. See man ld.so for more information.

Identifies modification of ld.so.preload for shared object injection. This technique is used by attackers to load arbitrary code into processes.