Comment by Retr0id

I'm not familiar with the state-of-the-art in Linux EDRs but I assumed checking LD_PRELOAD was table stakes.