t1055-008-ptrace-system-calls

name	T1055.008_ptrace-system-calls
description	Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1055.008","defense-evasion","privilege-escalation","linux","sub-technique"]
technique_id	T1055.008
tactic	defense-evasion
all_tactics	["defense-evasion","privilege-escalation"]
platforms	["Linux"]
mitre_url	https://attack.mitre.org/techniques/T1055/008
tech_stack	["linux"]
cwe_ids	["CWE-693"]
chains_with	["T1055","T1055.001","T1055.002","T1055.003","T1055.004","T1055.005","T1055.009","T1055.011","T1055.012","T1055.013","T1055.014","T1055.015"]
prerequisites	["T1055"]
severity_boost	{"T1055":"Chain with T1055 for deeper attack path","T1055.001":"Chain with T1055.001 for deeper attack path","T1055.002":"Chain with T1055.002 for deeper attack path"}

T1055.008 Ptrace System Calls

Sub-technique of: T1055

High-Level Description

Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges. Ptrace system call injection is a method of executing arbitrary code in the address space of a separate live process.

Ptrace system call injection involves attaching to and modifying a running process. The ptrace system call enables a debugging process to observe and control another process (and each individual thread), including changing memory and register values. Ptrace system call injection is commonly performed by writing arbitrary code into a running process (ex: malloc) then invoking that memory with PTRACE_SETREGS to set the register containing the next instruction to execute. Ptrace system call injection can also be done with PTRACE_POKETEXT/PTRACE_POKEDATA, which copy data to a specific address in the target processes’ memory (ex: the current address of the next instruction).

Ptrace system call injection may not be possible targeting processes that are non-child processes and/or have higher-privileges.

Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via ptrace system call injection may also evade detection from security products since the execution is masked under a legitimate process.

Kill Chain Phase

• Defense Evasion (TA0005)
• Privilege Escalation (TA0004)

Platforms: Linux

What to Check

• Identify if Ptrace System Calls technique is applicable to target environment
• Check Linux systems for indicators of Ptrace System Calls
• Verify mitigations are bypassed or absent (2 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

1. Identify Attack Surface: Determine if the target environment is susceptible to Ptrace System Calls by examining the target platforms (Linux).

2. Assess Existing Defenses: Review whether mitigations for T1055.008 are in place. If defenses are absent or misconfigured, this technique may be exploitable.