T1055.009 Proc Memory
Adversaries may inject malicious code into processes via the /proc filesystem in order to evade process-based defenses as well as possibly elevate privileges. Proc memory injection is a method of executing arbitrary code in the address space of a separate live process.
Proc memory injection involves enumerating the memory of a process via the /proc filesystem (/proc/[pid]
) then crafting a return-oriented programming (ROP) payload with available gadgets/instructions. Each running process has its own directory, which includes memory mappings. Proc memory injection is commonly performed by overwriting the target processes’ stack using memory mappings provided by the /proc filesystem. This information can be used to enumerate offsets (including the stack) and gadgets (or instructions within the program that can be used to build a malicious payload) otherwise hidden by process memory protections such as address space layout randomization (ASLR). Once enumerated, the target processes’ memory map within /proc/[pid]/maps
can be overwritten using dd.123
Other techniques such as Dynamic Linker Hijacking may be used to populate a target process with more available gadgets. Similar to Process Hollowing, proc memory injection may target child processes (such as a backgrounded copy of sleep).2
Running code in the context of another process may allow access to the process’s memory, system/network resources, and possibly elevated privileges. Execution via proc memory injection may also evade detection from security products since the execution is masked under a legitimate process.
Item | Value |
---|---|
ID | T1055.009 |
Sub-techniques | T1055.001, T1055.002, T1055.003, T1055.004, T1055.005, T1055.008, T1055.009, T1055.011, T1055.012, T1055.013, T1055.014, T1055.015 |
Tactics | TA0005, TA0004 |
Platforms | Linux |
Version | 1.0 |
Created | 14 January 2020 |
Last Modified | 20 June 2020 |
Mitigations
ID | Mitigation | Description |
---|---|---|
M1040 | Behavior Prevention on Endpoint | Some endpoint security solutions can be configured to block some types of process injection based on common sequences of behavior that occur during the injection process. |
M1022 | Restrict File and Directory Permissions | Restrict the permissions on sensitive files such as /proc/[pid]/maps or /proc/[pid]/mem . |
Detection
ID | Data Source | Data Component |
---|---|---|
DS0022 | File | File Modification |
References
-
skape. (2003, January 19). Linux x86 run-time process manipulation. Retrieved December 20, 2017. ↩
-
McNamara, R. (2017, September 5). Linux Based Inter-Process Code Injection Without Ptrace(2). Retrieved February 21, 2020. ↩↩
-
Kerrisk, M. (2020, February 2). DD(1) User Commands. Retrieved February 21, 2020. ↩