Shared object opened from /tmp, or ptrace called by a network service

Siemphony@siemphonylowT1055.014unverified

AN1241 groups four things under one "OS API Execution" logsource: ptrace, mmap, mprotect, open and dlopen. Three of those five names are dead ends on their own and are deliberately not gated on here. `dlopen` is not a syscall at all — it is a glibc wrapper that resolves to `openat`, so `syscall: 'dlopen'` would never fire; the open half of this rule matches the syscall that actually appears instead. Bare `mmap` is called continually by every process doing ordinary memory allocation, so including it would make a selection effectively always-true, the same reasoning this corpus's T1055.008 rule already applied to the identical syscall. And bare `ptrace` by any process is exactly what T1055.008 already covers on this same logsource; repeating that selector here under a different technique id would double-count one signal rather than add coverage, which is the same trap this corpus's T1036.004 rule named when it declined to re-author a sibling's PATH selector. What is left, and what this rule matches instead, is the two pieces AN1241 names that T1055.008 does not touch. First, a PATH record naming a `.so` file opened from a location no legitimate dynamic linker resolves from — /tmp, /dev/shm or /var/tmp — which is the concrete form of "open and map a malicious shared object" the analytic's own text asks for. Second, `ptrace` called by a process whose own binary is one that should never legitimately attach to another process — nginx, apache2 and sshd, MITRE's own three examples for the AnomalousParentProcessList knob — which is a materially narrower claim than T1055.008's bare "ptrace happened" and is aimed at exactly this technique's privilege-escalation framing: a compromised network-facing service escalating by hijacking a peer's VDSO rather than a developer or debugger attaching from a shell. Three of AN1241's pieces cannot be honestly expressed. The memprotect leg — "change from PROT_READ|PROT_WRITE to PROT_EXEC" — has no field to bind to: raw auditd's mprotect SYSCALL record carries the requested protection as an unresolved hex bitmask in its argument fields, and lib/sigma has no bitwise-AND construct to test it even if the field were named. The TimeWindow_PtraceToMmap knob is a join between the ptrace-attach record and a later mmap/open record from the same target process; PATH and SYSCALL are separate auditd records with no correlation construct connecting them here. And the osquery leg, {product: linux, service: osquery}, has no standardised Sigma field vocabulary anywhere in this corpus. Prerequisite: none of `ptrace`, `open` or `openat` are audited on any distribution out of the box. This rule returns zero rows — meaning blind, not quiet — until rules such as `-a always,exit -F arch=b64 -S ptrace -S openat -k vdso_hijack` are loaded. The `syscall` field also depends on name resolution: raw, unresolved auditd output records the architecture-specific syscall number rather than the string `ptrace`, so this selector needs `ausearch -i`, laurel or an equivalent interpreting layer in front of it, the same caveat already recorded against T1055.008. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0448, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Splunk · SPL

Run this as a search.

index=* ((type="PATH" AND (name="*/tmp/*" OR name="*/dev/shm/*" OR name="*/var/tmp/*") AND name="*.so") OR (type="SYSCALL" AND syscall="ptrace" AND (exe="*/nginx" OR exe="*/apache2" OR exe="*/sshd")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(type) == "path" AND (TO_LOWER(name) LIKE "*/tmp/*" OR TO_LOWER(name) LIKE "*/dev/shm/*" OR TO_LOWER(name) LIKE "*/var/tmp/*") AND TO_LOWER(name) LIKE "*.so") OR (TO_LOWER(type) == "syscall" AND TO_LOWER(syscall) == "ptrace" AND (TO_LOWER(exe) LIKE "*/nginx" OR TO_LOWER(exe) LIKE "*/apache2" OR TO_LOWER(exe) LIKE "*/sshd")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="type" type="pcre2">(?i)^PATH$</field>    <field name="name" type="pcre2">(?i)(/tmp/|/dev/shm/|/var/tmp/)</field>    <field name="name" type="pcre2">(?i)\.so$</field>    <description>Shared object opened from /tmp, or ptrace called by a network service (1/2)</description>    <mitre>      <id>T1055.014</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="type" type="pcre2">(?i)^SYSCALL$</field>    <field name="syscall" type="pcre2">(?i)^ptrace$</field>    <field name="exe" type="pcre2">(?i)(/nginx$|/apache2$|/sshd$)</field>    <description>Shared object opened from /tmp, or ptrace called by a network service (2/2)</description>    <mitre>      <id>T1055.014</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. No Sentinel table is modelled for this logsource ({"product":"linux","service":"auditd"}), so there is nothing honest to query. Pick a logsource this translator maps, or write the KQL by hand. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: auditd / linux
Level: low
Category: process_injection
Sigma status: experimental
Backends: 3 of 4 rendered
Updated: 30 Aug 2026
Rule ID: c9692f69-e4aa-4680-a4c3-e50aba1a408d

ATT&CKT1055.014

T1055.014VDSO Hijacking

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonprocess injection

process injectionAI draft — unreviewed

01 · What this rule detects

Two unrelated events ORed together (1 of selection*): a .so file opened from a location no legitimate dynamic linker resolves from, or ptrace called by nginx, apache2 or sshd. AN1241 groups ptrace, mmap, mprotect, open and dlopen under one "OS API Execution" logsource; this rule keeps the two pieces that survive as real fields on auditd.

02 · Telemetry you need

linux/auditd, PATH and SYSCALL record types. None of ptrace, open or openat is audited on any distribution out of the box — this rule returns zero rows until watches such as -a always,exit -F arch=b64 -S ptrace -S openat -k vdso_hijack are loaded. Raw auditd also logs the syscall as a numeric, architecture-specific code rather than the string ptrace, so an interpreting layer — ausearch -i, laurel, or equivalent — has to sit in front of this selector, the same caveat already recorded against this corpus's T1055.008 rule.

03 · How the logic works

selection_so_from_tmp requires type: PATH, name|contains one of /tmp/, /dev/shm/, /var/tmp/, and name|endswith: '.so' — the concrete form of "open and map a malicious shared object" AN1241's text asks for. selection_anomalous_ptrace requires type: SYSCALL, syscall: 'ptrace', and exe|endswith one of /nginx, /apache2, /sshd — MITRE's own three examples for the AnomalousParentProcessList knob. Three of AN1241's five pieces are deliberately left out. dlopen is not a syscall — it resolves to openat in glibc, so gating on the literal string would never fire. Bare mmap is called continuously by ordinary memory allocation and would make a selection effectively always-true, the same reasoning this corpus's T1055.008 rule already applied to that syscall. And bare ptrace by any process is exactly what T1055.008 already covers on this same logsource — repeating it here would double-count one signal under a second technique id rather than add coverage. The memprotect leg — PROT_READ|PROT_WRITE moving to PROT_EXEC — has no field to bind to: raw auditd's mprotect record carries the protection as an unresolved hex bitmask, and lib/sigma has no bitwise-AND construct even if the field were named. TimeWindow_PtraceToMmap, a join between the ptrace-attach record and a later mmap/open from the same target process, has no correlation construct here either — PATH and SYSCALL are separate records.

04 · Common false positives

The reviewer's core finding: this rule cannot structurally distinguish VDSO hijacking from classic ptrace-based injection (T1055.008) — both begin with the same ptrace-attach from a compromised network service, and the VDSO-specific step is exactly the memprotect leg this rule cannot express. A genuine T1055.008 hit against nginx will also satisfy this rule; triage a match as "ptrace-based injection of some kind," not confirmed VDSO hijacking.
Beyond that: deployment tooling and CI steps that stage .so files under /tmp before an install script relocates them; containerised workloads that mount their writable layer under /dev/shm or /var/tmp and load application-bundled .so plugins from there by design; and APM, RASP or crash-collection agents (systemd-coredump and commercial equivalents) that legitimately ptrace-attach to nginx, apache2 or sshd continuously on any host running one.

05 · Detection maturity

tier_1: . UNVERIFIED — derived from DET0448 and never executed against real auditd output. level: low is set accordingly; treat any hit as a starting point for manual triage, not a confirmed VDSO-specific finding.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Correlate the two selectors' outputs manually against known APM/RASP agent process names before triaging a ptrace match as suspicious. For the .so selector, exclude known package-manager and CI staging paths under /tmp. Because a match cannot be told apart from T1055.008 by this rule alone, pair it with process-tree context (what attached, and what it did next) before escalating.

Declared by the author

Application deployment that stages a shared object under /tmp before an install script moves or dlopen's it in place — several language package managers and CI build steps unpack .so files into a temporary directory as a normal intermediate step, matching the path selector with nothing malicious involved.
Sandboxed and containerised workloads that mount their writable layer under /dev/shm or /var/tmp and load application-bundled .so plugins from there by design, common for headless browser, GPU and audio libraries in container images.
APM, security or profiling agents that inject themselves into nginx, apache2 or sshd worker processes via ptrace to attach a profiler or enforce policy — several commercial RASP and observability agents work exactly this way and would trigger the anomalous-ptrace selector continuously on any host running one.
Crash and coredump handling: systemd-coredump or an equivalent collector attaching via ptrace to a crashing nginx, apache2 or sshd worker to capture its state before it exits, which fires on every crash of one of those services.

Noise check0 of 5 fired

Fires on none of the 5 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 5 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1055.014, evaluated against their — events.

Share this rule

/u/siemphony/c9692f69-e4aa-4680-a4c3-e50aba1a408d

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Shared object opened from /tmp, or ptrace called by a network service

The detection

detection.yml

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Sentinel · KQL

Community

Verdicts from engineers who deployed it