[Cthulhu_]

Wouldn't this malware be able to infect each of these steps and the shell itself to filter itself out of the results?

[prvit]

LD_PRELOAD rootkits are super common, you’re doing it wrong if you’re using dynamically linked binaries to look for malware on Linux.