T1055.008 Ptrace System Calls

Technique: T1055.008
Tactics: Defense Evasion, Privilege Escalation
Research, 90 days: 1
KEV CVEs mapped: 0
SigmaHQ rules: 0
Elastic, Splunk: 4
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1055/008

MITRE description

Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges. Ptrace system call injection is a method of executing arbitrary code in the address space of a separate live process. Ptrace system call injection involves attaching to and modifying a running process. The ptrace system call enables a debugging process to observe and control another process (and each individual thread), including changing memory and register values.(Citation: PTRACE man) Ptrace system call injection is commonly performed by writing arbitrary code into a running process (ex: <code>malloc</code>) then invoking that memory with <code>PTRACE_SETREGS</code> to set the register containing the next instruction to execute. Ptrace system call injection can also be done with <code>PTRACE_POKETEXT</code>/<code>PTRACE_POKEDATA</code>, which copy data to a specific address in the target processes’ memory (ex: the current address of the next instruction).(Citation: PTRACE man)(Citation: Medium Ptrace JUL 2018) Ptrace system call injection may not be possible targeting processes that are non-child processes and/or have higher-privileges.(Citation: BH Linux Inject) Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via ptrace system call injection may also evade detection from security products since the execution is masked under a legitimate process.

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-10-28 Cisco Talos: Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN

Detection coverage

Elastic and Splunk rules

Linux Process Hooking via GDB (elastic)
Privilege Escalation via GDB CAP_SYS_PTRACE (elastic)
Root Network Connection via GDB CAP_SYS_PTRACE (elastic)
Potential Sudo Token Manipulation via Process Injection (elastic)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.