AN1241
Analytic 1241
Linux
Detects the redirection of syscall execution flow via modification of VDSO code stubs or GOT entries to load and execute a malicious shared object through mmap and ptrace.
auditd:SYSCALL
ptrace, mmap, mprotect, open, dlopen
auditd:memprotect
change from PROT_READ|PROT_WRITE to PROT_EXEC
auditd:file-events
open of suspicious .so from non-standard paths
linux:osquery
child process invoking dynamic linker post-ptrace
[SuspiciousSharedObjectPathRegex]
Regex to filter dynamic library paths outside of `/lib`, `/usr/lib`, etc. (e.g., `/tmp`, `/dev/shm`)
[TimeWindow_PtraceToMmap]
Max delay allowed between ptrace attach and mmap/mprotect execution in target process
[ExecMemoryProtectionThreshold]
Flag when executable memory mappings deviate from normal runtime behavior
[AnomalousParentProcessList]
Parent processes unlikely to legitimately call ptrace (e.g., nginx, apache2, sshd)