t1055-009-proc-memory

name	T1055.009_proc-memory
description	Adversaries may inject malicious code into processes via the /proc filesystem in order to evade process-based defenses as well as possibly elevate privileges.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1055.009","defense-evasion","privilege-escalation","linux","sub-technique"]
technique_id	T1055.009
tactic	defense-evasion
all_tactics	["defense-evasion","privilege-escalation"]
platforms	["Linux"]
mitre_url	https://attack.mitre.org/techniques/T1055/009
tech_stack	["linux"]
cwe_ids	["CWE-693"]
chains_with	["T1055","T1055.001","T1055.002","T1055.003","T1055.004","T1055.005","T1055.008","T1055.011","T1055.012","T1055.013","T1055.014","T1055.015"]
prerequisites	["T1055"]
severity_boost	{"T1055":"Chain with T1055 for deeper attack path","T1055.001":"Chain with T1055.001 for deeper attack path","T1055.002":"Chain with T1055.002 for deeper attack path"}

T1055.009 Proc Memory

Sub-technique of: T1055

High-Level Description

Adversaries may inject malicious code into processes via the /proc filesystem in order to evade process-based defenses as well as possibly elevate privileges. Proc memory injection is a method of executing arbitrary code in the address space of a separate live process.

Proc memory injection involves enumerating the memory of a process via the /proc filesystem (/proc/[pid]) then crafting a return-oriented programming (ROP) payload with available gadgets/instructions. Each running process has its own directory, which includes memory mappings. Proc memory injection is commonly performed by overwriting the target processes’ stack using memory mappings provided by the /proc filesystem. This information can be used to enumerate offsets (including the stack) and gadgets (or instructions within the program that can be used to build a malicious payload) otherwise hidden by process memory protections such as address space layout randomization (ASLR). Once enumerated, the target processes’ memory map within /proc/[pid]/maps can be overwritten using dd.

Other techniques such as Dynamic Linker Hijacking may be used to populate a target process with more available gadgets. Similar to Process Hollowing, proc memory injection may target child processes (such as a backgrounded copy of sleep).

Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via proc memory injection may also evade detection from security products since the execution is masked under a legitimate process.

Kill Chain Phase

• Defense Evasion (TA0005)
• Privilege Escalation (TA0004)

Platforms: Linux

What to Check

• Identify if Proc Memory technique is applicable to target environment
• Check Linux systems for indicators of Proc Memory
• Verify mitigations are bypassed or absent (2 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

1. Identify Attack Surface: Determine if the target environment is susceptible to Proc Memory by examining the target platforms (Linux).

2. Assess Existing Defenses: Review whether mitigations for T1055.009 are in place. If defenses are absent or misconfigured, this technique may be exploitable.