Techniques › T1055.014 › AN1241
AN1241 Analytic 1241
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects the redirection of syscall execution flow via modification of VDSO code stubs or GOT entries to load and execute a malicious shared object through mmap and ptrace.</p>
- Detects
- T1055.014 VDSO Hijacking
- Part of
- DET0448 Detection Strategy for VDSO Hijacking on Linux
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | ptrace, mmap, mprotect, open, dlopen | DC0021 OS API Execution |
| auditd:memprotect | change from PROT_READ|PROT_WRITE to PROT_EXEC | DC0020 Process Modification |
| auditd:file-events | open of suspicious .so from non-standard paths | DC0016 Module Load |
| linux:osquery | child process invoking dynamic linker post-ptrace | DC0032 Process Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
SuspiciousSharedObjectPathRegex | Regex to filter dynamic library paths outside of `/lib`, `/usr/lib`, etc. (e.g., `/tmp`, `/dev/shm`) |
TimeWindow_PtraceToMmap | Max delay allowed between ptrace attach and mmap/mprotect execution in target process |
ExecMemoryProtectionThreshold | Flag when executable memory mappings deviate from normal runtime behavior |
AnomalousParentProcessList | Parent processes unlikely to legitimately call ptrace (e.g., nginx, apache2, sshd) |