PTRACE attached to process

rule: PTRACE attached to process
desc: 'Detect an attempt to inject potentially malicious code into a process using
  PTRACE in order to evade process-based defenses or elevate privileges. Common anti-patterns
  are debuggers. Additionally, profiling your environment via the known_ptrace_procs
  template macro can reduce noise. A successful ptrace syscall generates multiple
  logs at once.

  '
condition: 'ptrace_attach_or_injection and proc_name_exists and not known_ptrace_procs

  '
output: Detected ptrace PTRACE_ATTACH attempt | proc_pcmdline=%proc.pcmdline evt_type=%evt.type
  user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name
  proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
priority: WARNING
tags:
- maturity_stable
- host
- container
- process
- mitre_privilege_escalation
- T1055.008