Adversaries may inject malicious code into processes via VDSO hijacking in order to evade process-based defenses as well as possibly elevate privileges. Virtual dynamic shared object (vdso) hijacking is a method of executing arbitrary code in the address space of a separate live process. VDSO…
Sub-technique of Process Injection (T1055).
T1055.014 Process Injection: VDSO Hijacking
title: "T1055.014 Process Injection: VDSO Hijacking"
id: 7b91fc34-efc2-49c3-a05e-b56d8419822e
description: 'VDSO hijacking is only reliably distinguished from normal execution by correlating a ptrace memory-write/register-modification call against a target process with a subsequent mmap of an unusual shared object into that same process - a multi-event, cross-process correlation that a single raw auditd SYSCALL record (which exposes only syscall name/success/exit, not decoded ptrace request codes or cross-process linkage) cannot express. The prior "1 of ptrace or mmap" logic was tautological, since both syscalls are extremely common during ordinary dynamic linking. As the closest single-event auditd proxy, this rule instead flags successful ptrace calls made by processes that are not recognized debugging/tracing tools, which meaningfully narrows the previous logic without requiring event correlation, though it still cannot confirm actual VDSO manipulation. Tune using: SuspiciousSharedObjectPathRegex, TimeWindow_PtraceToMmap, ExecMemoryProtectionThreshold, AnomalousParentProcessList.'
references:
- https://attack.mitre.org/techniques/T1055/014
author: Shahrukh Khan
date: 2026-03-10
license: MIT
tags:
- attack.stealth
- attack.privilege-escalation
- attack.t1055.014
logsource:
category: process_access
product: linux
service: auditd
detection:
selection:
type: SYSCALL
syscall: ptrace
success: 'yes'
filter_known_debug_tools:
exe|endswith:
- '/gdb'
- '/gdbserver'
- '/strace'
- '/ltrace'
- '/valgrind'
- '/perf'
condition: selection and not filter_known_debug_tools
falsepositives:
- Legitimate debugging, tracing, profiling, and sandboxing tools (beyond the excluded list) call ptrace routinely; container runtimes and some application-level sandboxes (e.g. Chromium's) also use ptrace for legitimate isolation, so this requires environment-specific allow-list tuning.
level: medium