Cross-source coverage
T1055.008 / ATT&CK
Process Injection: Ptrace System Calls
6 rules across 2 sources.
Showing deprecated rules · back to the default
From MITRE ATT&CK 19.2
Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges. Ptrace system call injection is a method of executing arbitrary code in the address space of a separate live process.
Ptrace system call injection involves attaching to and modifying a running process. The ptrace system call enables a debugging process to observe and control another process (and each individual thread), including changing memory and register values. Ptrace system call injection is commonly performed by writing arbitrary code into a running process (ex: malloc) then invoking that memory with PTRACE_SETREGS to set the register containing the next instruction to execute. Ptrace system call injection can also be done with PTRACE_POKETEXT/PTRACE_POKEDATA, which copy data to a specific address in the target processes’ memory (ex: the current address of the next instruction).
Ptrace system call injection may not be possible targeting processes that are non-child processes and/or have higher-privileges.
Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via ptrace system call injection may also evade detection from security products since the execution is masked under a legitimate process.
- Tactics
- Stealth · Privilege Escalation
- Platforms
- Linux
- Telemetry
-
auditd:SYSCALLlinux:osquery
How MITRE says to detect it DET0203
Detection Strategy for Ptrace-Based Process Injection on Linux
Linux Analytic 0579
Detects ptrace-based process injection by correlating audit logs of ptrace syscalls, memory modifications (e.g., poketext, pokedata), and suspicious register manipulation on a target process not normally debugged by the originator. Alerts on processes attempting to ptrace non-child or privileged processes, especially those followed by abnormal memory or execution behavior.
auditd:SYSCALLmmap, ptrace, process_vm_writev or direct memory opsauditd:SYSCALLexecvelinux:osquerystate=attached/debugged
elastic/detection-rules
5 rules| Detection | Severity | Format |
|---|---|---|
| Potential Sudo Token Manipulation via Process Injection | Medium | Elastic TOML |
| Privilege Escalation via GDB CAP_SYS_PTRACE | Medium | Elastic TOML |
| Root Network Connection via GDB CAP_SYS_PTRACE | Medium | Elastic TOML |
| Deprecated - Network Connection via Sudo Binary | Low | Elastic TOML |
| Linux Process Hooking via GDB | Low | Elastic TOML |
falcosecurity/rules
1 rule| Detection | Severity | Format |
|---|---|---|
| PTRACE attached to process | Medium | Falco YAML |