attack.t1055.009 | Detection.FYI

ASLR Disabled Via Sysctl or Direct Syscall - Linux

Apr 28, 2026 · attack.privilege-escalation attack.stealth attack.defense-impairment attack.t1685 attack.t1055.009 ·
Share on:
Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including:
- Use of the personality syscall with the ADDR_NO_RANDOMIZE flag (0x0040000)
- Modification of the /proc/sys/kernel/randomize_va_space file
- Execution of the sysctl command to set kernel.randomize_va_space=0 Disabling ASLR is often used by attackers during exploit development or to bypass memory protection mechanisms. A successful use of these methods can reduce the effectiveness of ASLR and make memory corruption attacks more reliable.
Read More
Potential Linux Process Code Injection Via DD Utility

Apr 28, 2026 · attack.privilege-escalation attack.stealth attack.t1055.009 ·
Share on:

Detects the injection of code by overwriting the memory map of a Linux process using the "dd" Linux command.

Read More