Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges. Ptrace system call injection is a method of executing arbitrary code in the address space of a separate live process.
Ptrace system call injection involves attaching to and modifying a running process. The ptrace system call enables a debugging process to observe and control another process (and each individual thread), including changing memory and register values.(Citation: PTRACE man) Ptrace system call injection is commonly performed by writing arbitrary code into a running process (ex: <code>malloc</code>) then invoking that memory with <code>PTRACE_SETREGS</code> to set the register containing the next instruction to execute. Ptrace system call injection can also be done with <code>PTRACE_POKETEXT</code>/<code>PTRACE_POKEDATA</code>, which copy data to a specific address in the target processes’ memory (ex: the current address of the next instruction). (Citation: PTRACE man)(Citation: Medium Ptrace JUL 2018)
Ptrace system call injection may not be possible targeting processes with high-privileges, and on some system those that are non-child processes.(Citation: BH Linux Inject)
Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via ptrace system call injection may also evade detection from security products since the execution is masked under a legitimate process.
View in MITRE ATT&CK®Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name |
---|---|---|---|---|
AC-2 | Account Management | Protects | T1055.008 | Ptrace System Calls |
AC-3 | Access Enforcement | Protects | T1055.008 | Ptrace System Calls |
AC-5 | Separation of Duties | Protects | T1055.008 | Ptrace System Calls |
AC-6 | Least Privilege | Protects | T1055.008 | Ptrace System Calls |
CM-5 | Access Restrictions for Change | Protects | T1055.008 | Ptrace System Calls |
CM-6 | Configuration Settings | Protects | T1055.008 | Ptrace System Calls |
IA-2 | Identification and Authentication (organizational Users) | Protects | T1055.008 | Ptrace System Calls |
SC-18 | Mobile Code | Protects | T1055.008 | Ptrace System Calls |
SC-7 | Boundary Protection | Protects | T1055.008 | Ptrace System Calls |
SI-2 | Flaw Remediation | Protects | T1055.008 | Ptrace System Calls |
SI-3 | Malicious Code Protection | Protects | T1055.008 | Ptrace System Calls |
SI-4 | System Monitoring | Protects | T1055.008 | Ptrace System Calls |
azure_defender_for_app_service | Azure Defender for App Service | technique_scores | T1055.008 | Ptrace System Calls |