Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1055.008_ptrace-system-calls
Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges.
Passed 20 of 22 test cases with the skill, and 16 of 22 without it.
and 2 more in the full report
4 fixed16 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.
A red team operator wants to run automated test scripts from Atomic Red Team specifically for T1055.008 to test ptrace detection rules on a target host. What is the status of Atomic Red Team automated tests for T1055.008?
| Checked | Without skill | With skill |
|---|---|---|
| States that no Atomic Red Team tests are currently available for T1055.008. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1055
Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges. Ptrace system call injection is a method of executing arbitrary code in the address space of a separate live process.
Ptrace system call injection involves attaching to and modifying a running process. The ptrace system call enables a debugging process to observe and control another process (and each individual thread), including changing memory and register values. Ptrace system call injection is commonly performed by writing arbitrary code into a running process (ex: malloc) then invoking that memory with PTRACE_SETREGS to set the register containing the next instruction to execute. Ptrace system call injection can also be done with PTRACE_POKETEXT/PTRACE_POKEDATA, which copy data to a specific address in the target processes’ memory (ex: the current address of the next instruction).
Ptrace system call injection may not be possible targeting processes that are non-child processes and/or have higher-privileges.
Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via ptrace system call injection may also evade detection from security products since the execution is masked under a legitimate process.
Platforms: Linux
Identify Attack Surface: Determine if the target environment is susceptible to Ptrace System Calls by examining the target platforms (Linux).
Assess Existing Defenses: Review whether mitigations for T1055.008 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 16 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.