Modification of Dynamic Linker Preload Shared Object

host.os.type:linux and event.category:file and event.action:(file_rename_event or rename or renamed or updated) and
not event.type:deletion and file.path:/etc/ld.so.preload and
process.name:(* and not (oneagentinstallaction or passwd or wine))