tfMITRE ATT&CK sub-technique

VDSO Hijacking T1055.014

sub-technique of T1055 Process Injection

Tactics: Privilege Escalation, Stealth
Platform: Linux
Version: 2.0
Created: 14 January 2020
Last modified: 12 May 2026

Adversaries may inject malicious code into processes via VDSO hijacking in order to evade process-based defenses as well as possibly elevate privileges. Virtual dynamic shared object (vdso) hijacking is a method of executing arbitrary code in the address space of a separate live process.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Offense vs defense T1055.014

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

VDSO Hijacking detection strategy DET0448

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for VDSO Hijacking on Linux

Enterprise

1 platform

AN1241 · Linux

Detects the redirection of syscall execution flow via modification of VDSO code stubs or GOT entries to load and execute a malicious shared object through mmap and ptrace.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	auditd:file-events	open of suspicious .so from non-standard paths
Process ModificationDC0020	auditd:memprotect	change from PROT_READ\|PROT_WRITE to PROT_EXEC
OS API ExecutionDC0021	auditd:SYSCALL	ptrace, mmap, mprotect, open, dlopen
Process CreationDC0032	linux:osquery	child process invoking dynamic linker post-ptrace

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SuspiciousSharedObjectPathRegex	Regex to filter dynamic library paths outside of `/lib`, `/usr/lib`, etc. (e.g., `/tmp`, `/dev/shm`)
TimeWindow_PtraceToMmap	Max delay allowed between ptrace attach and mmap/mprotect execution in target process
ExecMemoryProtectionThreshold	Flag when executable memory mappings deviate from normal runtime behavior
AnomalousParentProcessList	Parent processes unlikely to legitimately call ptrace (e.g., nginx, apache2, sshd)

VDSO Hijacking detections T1055.014

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs