Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges. Ptrace system call injection is a method of executing arbitrary code in the address space of a separate live process. Ptrace…
Sub-technique of Process Injection (T1055).
T1055.008 Process Injection: Ptrace System Calls
title: "T1055.008 Process Injection: Ptrace System Calls"
id: 6c8ffbeb-d27d-4561-8fe4-ecce335b7437
description: 'Detection Strategy for Ptrace-Based Process Injection on Linux, now scoped to the specific ptrace request codes used for memory-injection primitives (PTRACE_POKETEXT=4, PTRACE_POKEDATA=5, PTRACE_SETREGS=13/0xd, PTRACE_SETREGSET=0x4205) instead of matching every ptrace call, and excluding known debugger tooling. (Retargeted to the process_access auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TargetProcessNameFilter, TimeWindowBetweenPtraceAndMemoryWrite, UserContextMismatch, ProcessRelationshipConstraint.'
references:
- https://attack.mitre.org/techniques/T1055/008
author: Shahrukh Khan
date: 2026-03-11
license: MIT
tags:
- attack.stealth
- attack.privilege-escalation
- attack.t1055.008
logsource:
category: process_access
product: linux
detection:
selection:
type: SYSCALL
syscall: ptrace
a0:
- '4'
- '5'
- 'd'
- '4205'
filter_debuggers:
type: SYSCALL
syscall: ptrace
exe|endswith:
- '/gdb'
- '/strace'
- '/ltrace'
condition: selection and not filter_debuggers
falsepositives:
- Legitimate debugging tools (gdb, strace, ltrace) invoke PTRACE_POKETEXT/POKEDATA/SETREGS constantly during normal development/troubleshooting when the debugger itself is the calling process (excluded above); a debugger invoked through a wrapper script or renamed binary would bypass the exe exclusion. auditd's SYSCALL record identifies only the calling process, not the target process, so distinguishing credential-process-targeted injection from benign debugging still requires external target-PID correlation not available in a single record.
level: medium