T1055.009 — Proc Memory

Tactics: Stealth, Privilege Escalation · Platforms: Linux

Adversaries may inject malicious code into processes via the /proc filesystem in order to evade process-based defenses as well as possibly elevate privileges. Proc memory injection is a method of executing arbitrary code in the address space of a separate live process. Proc memory injection…

Sub-technique of Process Injection (T1055).

Sigma detection rules (1)

T1055.009 Process Injection: Proc Memory

title: "T1055.009 Process Injection: Proc Memory"
id: acdc6b71-d154-4d00-8f77-dcb11f2f03c7
description: 'Detection Strategy for /proc Memory Injection on Linux. (Retargeted to the process_access auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TargetProcNameRegex, TimeWindowBetweenMapAccessAndMemWrite, InvokerBinaryAllowlist, FileWriteThreshold.'
references:
  - https://attack.mitre.org/techniques/T1055/009
author: Shahrukh Khan
date: 2026-03-30
license: MIT
tags:
  - attack.stealth
  - attack.privilege-escalation
  - attack.t1055.009

logsource:
  category: process_access
  product: linux

detection:
  selection:
    type: PATH
    name|contains: '/proc/'
    name|endswith: '/mem'
  condition: selection

falsepositives:
  - Legitimate debuggers and monitoring tools (gdb, criu checkpoint/restore) also open and write to /proc/[pid]/mem for benign purposes.

level: high

Related sub-techniques

Explore