> But is there a hard rule that says a loaded library has to be named .so, or show up as .so for lsof? No, yes(-ish) Filenames are just a convention and not n

> But is there a hard rule that says a loaded library has to be named .so, or show up as .so for lsof? No, yes(-ish) Filenames are just a convention and not necessarily enforced. lsof will really list every file the kernel thinks has a handle held by an active process, but depending on your threat model I think you could get around this. For example you could copy the malicious code into memory and close the file, or use your preload to modify the behaviour of lsof itself (or debsums). Anyway debsums is a great tool. I'd have used a command similar to yours, though maybe run debsums first, use `file` to filter dynamic libraries and then check which of those have been recently accessed from disk.