{"id":"T1055.009","name":"Proc Memory","url":"https://attack.mitre.org/techniques/T1055/009","tactics":["stealth","privilege-escalation"],"platforms":["Linux"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0541","stix_id":"x-mitre-detection-strategy--452c12a6-e74d-4244-a298-e9adaaf23794","name":"Detection Strategy for /proc Memory Injection on Linux","url":"https://attack.mitre.org/detectionstrategies/DET0541","analytics":[{"id":"AN1494","stix_id":"x-mitre-analytic--3a57e109-235d-497a-9c90-952ab8b749b6","name":"Analytic 1494","description":"Detects adversary behavior where a process enumerates and modifies another process's memory using /proc/[pid]/maps and /proc/[pid]/mem files. This includes identifying gadgets via memory mappings and overwriting process memory via low-level file modification or dd usage.","url":"https://attack.mitre.org/detectionstrategies/DET0541#AN1494","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"open/write to /proc/*/mem or /proc/*/maps","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"execve of dd or sed targeting /proc/*/mem","data_component":"DC0021","data_component_name":"OS API Execution","log_source_slug":"auditd-syscall"},{"name":"linux:osquery","channel":"/proc/*/maps access","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"linux-osquery"}],"mutable_elements":[{"field":"TargetProcNameRegex","description":"Regex list of high-value processes attackers may inject into, such as `sshd`, `nginx`, or `sleep`"},{"field":"TimeWindowBetweenMapAccessAndMemWrite","description":"Time span (e.g., <15s) between map read and memory write that may indicate enumeration-to-injection"},{"field":"InvokerBinaryAllowlist","description":"Allowlist of processes allowed to access /proc/[pid]/mem (e.g., gdb, strace)"},{"field":"FileWriteThreshold","description":"Alert if written bytes to /proc/[pid]/mem exceed a suspicious threshold (e.g., >4096 bytes)"}],"live":true,"detection_strategies":["DET0541"],"techniques":["T1055.009"]}],"live":true,"version":"1.0","techniques":["T1055.009"]}],"sigma_rules":[{"id":"4cad6c64-d6df-42d6-8dae-eb78defdc415","title":"Potential Linux Process Code Injection Via DD Utility","author":"Joseph Kamau","status":"test","level":"medium","date":"2023-12-01","modified":null,"description":"Detects the injection of code by overwriting the memory map of a Linux process using the \"dd\" Linux command.","references":["https://www.aon.com/cyber-solutions/aon_cyber_labs/linux-based-inter-process-code-injection-without-ptrace2/","https://github.com/AonCyberLabs/Cexigua/blob/34d338620afae4c6335ba8d8d499e1d7d3d5d7b5/overwrite.sh"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055.009"],"path":"rules/linux/process_creation/proc_creation_lnx_dd_process_injection.yml","techniques":["T1055.009"],"cves":[]},{"id":"e497a24e-9345-4a62-9803-b06d7d7cb132","title":"ASLR Disabled Via Sysctl or Direct Syscall - Linux","author":"Milad Cheraghi","status":"experimental","level":"high","date":"2025-05-26","modified":"2025-12-05","description":"Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including:\n  - Use of the `personality` syscall with the ADDR_NO_RANDOMIZE flag (0x0040000)\n  - Modification of the /proc/sys/kernel/randomize_va_space file\n  - Execution of the `sysctl` command to set `kernel.randomize_va_space=0`\nDisabling ASLR is often used by attackers during exploit development or to bypass memory protection mechanisms.\nA successful use of these methods can reduce the effectiveness of ASLR and make memory corruption attacks more reliable.\n","references":["https://github.com/CheraghiMilad/bypass-Neo23x0-auditd-config/blob/f1c478a37911a5447d5ffcd580f22b167bf3df14/personality-syscall/README.md","https://man7.org/linux/man-pages/man2/personality.2.html","https://manual.cs50.io/2/personality","https://linux-audit.com/linux-aslr-and-kernelrandomize_va_space-setting/"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.privilege-escalation","attack.stealth","attack.defense-impairment","attack.t1685","attack.t1055.009"],"path":"rules/linux/auditd/lnx_auditd_disable_aslr_protection.yml","techniques":["T1685","T1055.009"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}