PACEMAKERS1109 ↗
Can use PTRACE to attach to a targeted process to read process memory.1
- Tactics
- Privilege Escalation, Stealth
- Platform
- Linux
- Version
- 2.0
- Created
- 14 January 2020
- Last modified
- 12 May 2026
Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges. Ptrace system call injection is a method of executing arbitrary code in the address space of a separate live process.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Ptrace System Calls MITRE reference T1055.008
44th pctamong all ATT&CK techniques for number of tools
1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
All 1 software entries for this technique
Offense vs defense T1055.008
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Ptrace System Calls detection strategy DET0203
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Ptrace-Based Process Injection on Linux
1 platform
AN0579 · Linux
Detects ptrace-based process injection by correlating audit logs of ptrace syscalls, memory modifications (e.g., poketext, pokedata), and suspicious register manipulation on a target process not normally debugged by the originator. Alerts on processes attempting to ptrace non-child or privileged processes, especially those followed by abnormal memory or execution behavior.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| OS API ExecutionDC0021 | auditd:SYSCALL | mmap, ptrace, process_vm_writev or direct memory ops |
| Process CreationDC0032 | auditd:SYSCALL | execve |
| Process MetadataDC0034 | linux:osquery | state=attached/debugged |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TargetProcessNameFilter | List of sensitive or rarely-debugged processes (e.g., sshd, systemd, container daemons) to alert on if ptraced |
| TimeWindowBetweenPtraceAndMemoryWrite | Threshold time (e.g., <10 seconds) between ptrace attach and pokedata syscall |
| UserContextMismatch | Flag when UID of tracer differs from UID of target process (e.g., privilege escalation or container breakout) |
| ProcessRelationshipConstraint | Allowlist relationships (e.g., parent-child) under which ptrace is considered benign |
Some endpoint security solutions can be configured to block some types of process injection based on common sequences of behavior that occur during the injection process.
Utilize Yama (ex: /proc/sys/kernel/yama/ptrace_scope) to mitigate ptrace based process injection by restricting the use of ptrace to privileged users only. Other mitigation controls involve the deployment of security kernel modules that provide advanced access control and process restrictions such as SELinux, grsecurity, and AppArmor.