attack.t1055.009 | Detection.FYI

ASLR Disabled Via Sysctl or Direct Syscall - Linux

Oct 29, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1562.001 attack.t1055.009 ·
Share on:
Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including:
- Use of the personality syscall with the ADDR_NO_RANDOMIZE flag (0x0040000)
- Modification of the /proc/sys/kernel/randomize_va_space file
- Execution of the sysctl command to set kernel.randomize_va_space=0 Disabling ASLR is often used by attackers during exploit development or to bypass memory protection mechanisms. A successful use of these methods can reduce the effectiveness of ASLR and make memory corruption attacks more reliable.
Read More
Potential Linux Process Code Injection Via DD Utility

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1055.009 ·
Share on:

Detects the injection of code by overwriting the memory map of a Linux process using the "dd" Linux command.

Read More