Techniques › T1055.009 › AN1494
AN1494 Analytic 1494
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects adversary behavior where a process enumerates and modifies another process's memory using /proc/[pid]/maps and /proc/[pid]/mem files. This includes identifying gadgets via memory mappings and overwriting process memory via low-level file modification or dd usage.</p>
- Detects
- T1055.009 Proc Memory
- Part of
- DET0541 Detection Strategy for /proc Memory Injection on Linux
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | open/write to /proc/*/mem or /proc/*/maps | DC0061 File Modification |
| auditd:SYSCALL | execve of dd or sed targeting /proc/*/mem | DC0021 OS API Execution |
| linux:osquery | /proc/*/maps access | DC0055 File Access |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TargetProcNameRegex | Regex list of high-value processes attackers may inject into, such as `sshd`, `nginx`, or `sleep` |
TimeWindowBetweenMapAccessAndMemWrite | Time span (e.g., <15s) between map read and memory write that may indicate enumeration-to-injection |
InvokerBinaryAllowlist | Allowlist of processes allowed to access /proc/[pid]/mem (e.g., gdb, strace) |
FileWriteThreshold | Alert if written bytes to /proc/[pid]/mem exceed a suspicious threshold (e.g., >4096 bytes) |