Shared object opened from /tmp, or ptrace called by a network service

1title: Shared object opened from /tmp, or ptrace called by a network service2id: c9692f69-e4aa-4680-a4c3-e50aba1a408d3status: experimental4description: |5  AN1241 groups four things under one "OS API Execution" logsource: ptrace,6  mmap, mprotect, open and dlopen. Three of those five names are dead ends on7  their own and are deliberately not gated on here. `dlopen` is not a syscall8  at all — it is a glibc wrapper that resolves to `openat`, so `syscall:9  'dlopen'` would never fire; the open half of this rule matches the syscall10  that actually appears instead. Bare `mmap` is called continually by every11  process doing ordinary memory allocation, so including it would make a12  selection effectively always-true, the same reasoning this corpus's13  T1055.008 rule already applied to the identical syscall. And bare `ptrace`14  by any process is exactly what T1055.008 already covers on this same15  logsource; repeating that selector here under a different technique id16  would double-count one signal rather than add coverage, which is the same17  trap this corpus's T1036.004 rule named when it declined to re-author a18  sibling's PATH selector. What is left, and what this rule matches instead,19  is the two pieces AN1241 names that T1055.008 does not touch. First, a PATH20  record naming a `.so` file opened from a location no legitimate dynamic21  linker resolves from — /tmp, /dev/shm or /var/tmp — which is the concrete22  form of "open and map a malicious shared object" the analytic's own text23  asks for. Second, `ptrace` called by a process whose own binary is one that24  should never legitimately attach to another process — nginx, apache2 and25  sshd, MITRE's own three examples for the AnomalousParentProcessList knob —26  which is a materially narrower claim than T1055.008's bare "ptrace happened"27  and is aimed at exactly this technique's privilege-escalation framing: a28  compromised network-facing service escalating by hijacking a peer's VDSO29  rather than a developer or debugger attaching from a shell.30  Three of AN1241's pieces cannot be honestly expressed. The memprotect leg —31  "change from PROT_READ|PROT_WRITE to PROT_EXEC" — has no field to bind to:32  raw auditd's mprotect SYSCALL record carries the requested protection as an33  unresolved hex bitmask in its argument fields, and lib/sigma has no34  bitwise-AND construct to test it even if the field were named. The35  TimeWindow_PtraceToMmap knob is a join between the ptrace-attach record and36  a later mmap/open record from the same target process; PATH and SYSCALL are37  separate auditd records with no correlation construct connecting them38  here. And the osquery leg, {product: linux, service: osquery}, has no39  standardised Sigma field vocabulary anywhere in this corpus.40  Prerequisite: none of `ptrace`, `open` or `openat` are audited on any41  distribution out of the box. This rule returns zero rows — meaning blind,42  not quiet — until rules such as `-a always,exit -F arch=b64 -S ptrace -S43  openat -k vdso_hijack` are loaded. The `syscall` field also depends on name44  resolution: raw, unresolved auditd output records the architecture-specific45  syscall number rather than the string `ptrace`, so this selector needs46  `ausearch -i`, laurel or an equivalent interpreting layer in front of it,47  the same caveat already recorded against T1055.008.48  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0448, not hand-written and not tested by its author. Any lab result is on this rule's own page.49references:50  - https://attack.mitre.org/techniques/T1055/01451  - https://attack.mitre.org/detectionstrategies/DET044852author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)53date: 2026-08-1854tags:55  - attack.defense-evasion56  - attack.privilege-escalation57  - attack.t1055.01458logsource:59  product: linux60  service: auditd61detection:62  selection_so_from_tmp:63    type: 'PATH'64    name|contains:65      - '/tmp/'66      - '/dev/shm/'67      - '/var/tmp/'68    name|endswith: '.so'69  selection_anomalous_ptrace:70    type: 'SYSCALL'71    syscall: 'ptrace'72    exe|endswith:73      - '/nginx'74      - '/apache2'75      - '/sshd'76  condition: 1 of selection*77falsepositives:78  - "Application deployment that stages a shared object under /tmp before an install script moves or dlopen's it in place — several language package managers and CI build steps unpack .so files into a temporary directory as a normal intermediate step, matching the path selector with nothing malicious involved."79  - "Sandboxed and containerised workloads that mount their writable layer under /dev/shm or /var/tmp and load application-bundled .so plugins from there by design, common for headless browser, GPU and audio libraries in container images."80  - "APM, security or profiling agents that inject themselves into nginx, apache2 or sshd worker processes via ptrace to attach a profiler or enforce policy — several commercial RASP and observability agents work exactly this way and would trigger the anomalous-ptrace selector continuously on any host running one."81  - "Crash and coredump handling: systemd-coredump or an equivalent collector attaching via ptrace to a crashing nginx, apache2 or sshd worker to capture its state before it exits, which fires on every crash of one of those services."82level: low