Process Injection: Ptrace System Calls `T1055.008`

Tactics: Stealth, Privilege Escalation

Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges. Ptrace system call injection is a method of executing arbitrary code in the address space of a separate live process.

Authoring guide

These 4 rules share fields, values, and exclusions.

Fields filtered most (10 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	4	`eq` 3, `in` 1	`exec`, `ProcessRollup2`, `connection_attempted`, `exec_event`, `uid_change`
`event.type`	4	`eq` 4	`start`, `change`
`host.os.type`	4	`eq` 4
`process_name`	4	`eq` 4, `is_not_null` 2	`gdb`, `sudo`
`process.thread.capabilities.effective`	2	`eq` 2	`cap_sys_ptrace`
`process.thread.capabilities.permitted`	2	`eq` 2	`cap_sys_ptrace`
`user.id`	2	`eq` 2, `ne` 2	`0`
`process.args`	1	`in` 1, `ne` 1	`--pid`, `-p`, `1`
`process.group.id`	1	`eq` 1, `ne` 1	`0`
`process.user.id`	1	`eq` 1, `ne` 1	`0`

Top indicator values (24 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.type`	`eq`	`start` elasticLinux Process Hooking via GDB elasticPotential Sudo Token Manipulation via Process Injection elasticPrivilege Escalation via GDB CAP_SYS_PTRACE elasticRoot Network Connection via GDB CAP_SYS_PTRACE	4	1087
`event.type`	`eq`	`change` elasticPotential Sudo Token Manipulation via Process Injection	1	95
`process_name`	`eq`	`gdb` elasticLinux Process Hooking via GDB elasticPotential Sudo Token Manipulation via Process Injection elasticPrivilege Escalation via GDB CAP_SYS_PTRACE elasticRoot Network Connection via GDB CAP_SYS_PTRACE	4	6
`process_name`	`eq`	`sudo` elasticPotential Sudo Token Manipulation via Process Injection	1	15
`EventType`	`eq`	`exec` elasticPotential Sudo Token Manipulation via Process Injection elasticPrivilege Escalation via GDB CAP_SYS_PTRACE elasticRoot Network Connection via GDB CAP_SYS_PTRACE	3	579
`EventType`	`eq`	`connection_attempted` elasticRoot Network Connection via GDB CAP_SYS_PTRACE	1	75
`EventType`	`eq`	`uid_change` elasticPotential Sudo Token Manipulation via Process Injection	1	19
`process.thread.capabilities.effective`	`eq`	`cap_sys_ptrace` elasticPrivilege Escalation via GDB CAP_SYS_PTRACE elasticRoot Network Connection via GDB CAP_SYS_PTRACE	2	2
`process.thread.capabilities.permitted`	`eq`	`cap_sys_ptrace` elasticPrivilege Escalation via GDB CAP_SYS_PTRACE elasticRoot Network Connection via GDB CAP_SYS_PTRACE	2	2
`user.id`	`eq`	`0` elasticPrivilege Escalation via GDB CAP_SYS_PTRACE elasticRoot Network Connection via GDB CAP_SYS_PTRACE	2	28
`user.id`	`ne`	`0` elasticPrivilege Escalation via GDB CAP_SYS_PTRACE elasticRoot Network Connection via GDB CAP_SYS_PTRACE	2	28
`EventType`	`in`	`ProcessRollup2` elasticLinux Process Hooking via GDB	1	118
`EventType`	`in`	`exec` elasticLinux Process Hooking via GDB	1	206
`EventType`	`in`	`exec_event` elasticLinux Process Hooking via GDB	1	150
`EventType`	`in`	`executed` elasticLinux Process Hooking via GDB	1	98
`EventType`	`in`	`process_started` elasticLinux Process Hooking via GDB	1	83
`EventType`	`in`	`start` elasticLinux Process Hooking via GDB	1	168
`process.args`	`in`	`--pid` elasticLinux Process Hooking via GDB	1	3
`process.args`	`in`	`-p` elasticLinux Process Hooking via GDB	1	4
`process.args`	`ne`	`1` elasticLinux Process Hooking via GDB	1
`process.group.id`	`eq`	`0` elasticPotential Sudo Token Manipulation via Process Injection	1	10
`process.group.id`	`ne`	`0` elasticPotential Sudo Token Manipulation via Process Injection	1
`process.user.id`	`eq`	`0` elasticPotential Sudo Token Manipulation via Process Injection	1	10
`process.user.id`	`ne`	`0` elasticPotential Sudo Token Manipulation via Process Injection	1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: Linux

Domain: Endpoint

Process Injection: Ptrace System Calls T1055.008

Authoring guide

Fields filtered most (10 distinct)

Top indicator values (24 distinct)

Rules under this technique

Elastic 4 rules

Process Injection: Ptrace System Calls `T1055.008`