Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1631.001_ptrace-system-calls
Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges.
Passed 17 of 22 test cases with the skill, and 11 of 22 without it.
and 5 more in the full report
6 fixed11 passed either way5 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
We are evaluating threat T1631.001 across our infrastructure. Provide a target platform compatibility assessment table indicating whether Windows Server, macOS Desktop, Android, and iOS are listed as applicable target platforms.
| Checked | Without skill | With skill |
|---|---|---|
| Identifies Android as an applicable target platform for T1631.001. | Missed | Passed |
| Identifies iOS as an applicable target platform for T1631.001. | Missed | Passed |
| Excludes Windows Server from the target platforms for T1631.001. | Passed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1631
Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges. Ptrace system call injection is a method of executing arbitrary code in the address space of a separate live process.
Ptrace system call injection involves attaching to and modifying a running process. The ptrace system call enables a debugging process to observe and control another process (and each individual thread), including changing memory and register values. Ptrace system call injection is commonly performed by writing arbitrary code into a running process (e.g., by using malloc) then invoking that memory with PTRACE_SETREGS to set the register containing the next instruction to execute. Ptrace system call injection can also be done with PTRACE_POKETEXT/PTRACE_POKEDATA, which copy data to a specific address in the target process's memory (e.g., the current address of the next instruction).
Ptrace system call injection may not be possible when targeting processes with high-privileges, and on some systems those that are non-child processes.
Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via ptrace system call injection may also evade detection from security products since the execution is masked under a legitimate process.
Platforms: Android, iOS
Determine if the target mobile environment is susceptible to Ptrace System Calls by examining the target platforms (Android, iOS).
Review whether mitigations for T1631.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
test cases passed, vs 11 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.