PTRACE anti-debug attempt

Description

Detect usage of the PTRACE system call with the PTRACE_TRACEME argument, indicating a program actively attempting to avoid debuggers attaching to the process. This behavior is typically indicative of malware activity. Read more about PTRACE in the "PTRACE attached to process" rule.

Query · falco

evt.type=ptrace and evt.arg.request contains PTRACE_TRACEME and proc_name_exists

Rule dependencies

Depends on

  • composes · Falco macro proc_name_exists
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Detected potential PTRACE_TRACEME anti-debug attempt | proc_pcmdline=%proc.pcmdline evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source PTRACE anti-debug attempt · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: PTRACE anti-debug attempt
desc: 'Detect usage of the PTRACE system call with the PTRACE_TRACEME argument, indicating
  a program actively attempting to avoid debuggers attaching to the process. This
  behavior is typically indicative of malware activity. Read more about PTRACE in
  the "PTRACE attached to process" rule.

  '
condition: 'evt.type=ptrace and evt.arg.request contains PTRACE_TRACEME and proc_name_exists

  '
output: Detected potential PTRACE_TRACEME anti-debug attempt | proc_pcmdline=%proc.pcmdline
  evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid
  process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline
  terminal=%proc.tty
priority: NOTICE
tags:
- maturity_stable
- host
- container
- process
- mitre_defense_evasion
- T1622

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.