Which SIEM platforms have a T1055.008 detection rule?

df00tech provides T1055.008 (Ptrace System Calls) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Ptrace System Calls (T1055.008)?

Detecting Ptrace System Calls requires the following data sources: Process: OS API Execution, Process: Process Access, Linux auditd, Syslog.

What severity and confidence is the T1055.008 detection?

The T1055.008 detection is rated high severity with medium confidence.

What are common false positives for T1055.008?

Common false positives for T1055.008 include: Software developers using gdb, strace, or ltrace for legitimate debugging; Container runtime tools (Docker, containerd) using ptrace for process namespace management; System administration tools performing ptrace for diagnostic purposes.

T1055.008 IBM QRadar · QRadar

Detect Ptrace System Calls in IBM QRadar

Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges. Ptrace system call injection involves attaching to and modifying a running process. The ptrace system call enables a debugging process to observe and control another process (and each individual thread), including changing memory and register values. Ptrace system call injection is commonly performed by writing arbitrary code into a running process (ex: malloc) then invoking that memory with PTRACE_SETREGS to set the register containing the next instruction to execute. Ptrace system call injection can also be done with PTRACE_POKETEXT/PTRACE_POKEDATA, which copy data to a specific address in the target processes' memory.

MITRE ATT&CK

Tactic: Defense Evasion Privilege Escalation
Technique: T1055 Process Injection
Sub-technique: T1055.008 Ptrace System Calls
Canonical reference: https://attack.mitre.org/techniques/T1055/008/

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
  DATEFORMAT(devicetime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  sourceip AS SourceIP,
  "hostname" AS Hostname,
  username AS AuditUser,
  CASE
    WHEN UTF8(payload) LIKE '%a0=4 %'  THEN 'PTRACE_POKETEXT'
    WHEN UTF8(payload) LIKE '%a0=5 %'  THEN 'PTRACE_POKEDATA'
    WHEN UTF8(payload) LIKE '%a0=d %'
      OR UTF8(payload) LIKE '%a0=13 %' THEN 'PTRACE_SETREGS'
    WHEN UTF8(payload) LIKE '%a0=10 %'
      OR UTF8(payload) LIKE '%a0=16 %' THEN 'PTRACE_ATTACH'
    WHEN UTF8(payload) LIKE '%a0=19 %'
      OR UTF8(payload) LIKE '%a0=25 %' THEN 'PTRACE_SEIZE'
    ELSE 'PTRACE_OTHER'
  END AS PtraceOperation,
  CASE
    WHEN UTF8(payload) LIKE '%a0=4 %'
      OR UTF8(payload) LIKE '%a0=5 %'
      OR UTF8(payload) LIKE '%a0=d %'
      OR UTF8(payload) LIKE '%a0=10 %'
      OR UTF8(payload) LIKE '%a0=13 %'
      OR UTF8(payload) LIKE '%a0=16 %'
      OR UTF8(payload) LIKE '%a0=19 %'
      OR UTF8(payload) LIKE '%a0=25 %'
    THEN 'High - Write/Modify Capability'
    ELSE 'Low - Read-only'
  END AS InjectionRisk,
  UTF8(payload) AS RawLog
FROM events
WHERE LOGSOURCETYPEID IN (12, 296)
  AND (
    UTF8(payload) ILIKE '%syscall=101%'
    OR (UTF8(payload) ILIKE '%type=SYSCALL%' AND UTF8(payload) ILIKE '%ptrace%')
  )
  AND (
    UTF8(payload) LIKE '%a0=4 %'
    OR UTF8(payload) LIKE '%a0=5 %'
    OR UTF8(payload) LIKE '%a0=d %'
    OR UTF8(payload) LIKE '%a0=10 %'
    OR UTF8(payload) LIKE '%a0=13 %'
    OR UTF8(payload) LIKE '%a0=16 %'
    OR UTF8(payload) LIKE '%a0=19 %'
    OR UTF8(payload) LIKE '%a0=25 %'
  )
  AND UTF8(payload) NOT ILIKE '%exe="/usr/bin/gdb"%'
  AND UTF8(payload) NOT ILIKE '%exe="/usr/bin/strace"%'
  AND UTF8(payload) NOT ILIKE '%exe="/usr/bin/ltrace"%'
  AND UTF8(payload) NOT ILIKE '%exe="/usr/bin/valgrind"%'
  AND UTF8(payload) NOT ILIKE '%exe="/usr/bin/perf"%'
  AND UTF8(payload) NOT ILIKE '%exe="/usr/sbin/dockerd"%'
  AND UTF8(payload) NOT ILIKE '%exe="/usr/sbin/runc"%'
  LAST 24 HOURS
ORDER BY devicetime DESC

high severity medium confidence

Detects ptrace syscall (kernel syscall number 101 on x86_64) with injection-capable request types from Linux auditd events in QRadar. Operates against LOGSOURCETYPEID 12 (Linux OS DSM) and 296 (Linux AUDIT DSM). Parses the raw payload to identify the ptrace request type from the a0 argument field (hex-encoded) and classifies injection risk. Excludes known legitimate debugger executables by matching their full exe path in the audit record.

Data Sources

QRadar Linux OS DSM (LOGSOURCETYPEID 12) via syslog from auditdQRadar Linux AUDIT DSM (LOGSOURCETYPEID 296) via auditd audisp-remoteQRadar Universal DSM receiving Linux auditd SYSCALL records

Required Tables

events

False Positives & Tuning

Legitimate debuggers installed to non-standard paths (e.g., /opt/devtools/bin/gdb) whose exe path does not match the hardcoded exclusions
CI/CD pipeline runner agents that spawn test harnesses using ptrace for coverage instrumentation (e.g., kcov, gcov)
Container orchestration tooling such as nsenter or criu (checkpoint/restore) that uses ptrace-like mechanisms for namespace entry or process migration

Download portable Sigma rule (.yml)

Other platforms for T1055.008

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Ptrace Attachment via strace
Expected signal: auditd: SYSCALL type with syscall=101, a0=16 (PTRACE_ATTACH), a1=<target_pid>, exe=/usr/bin/strace. /proc/<target_pid>/status will show TracerPid=<strace_pid> while attached.
Test 2Ptrace Memory Read via /proc/pid/mem
Expected signal: auditd: open() syscall on /proc/<pid>/maps. If ptrace is used: SYSCALL with syscall=101. The /proc/pid/maps read itself may be logged by auditd file access rules.
Test 3Check ptrace_scope Kernel Setting
Expected signal: No security telemetry — this is a configuration check. The output shows the current ptrace restriction level.

Last updated: 2026-04-16 Research depth: deep

References (5)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1055.008 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect Ptrace System Calls in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1055.008

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1055.008

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

Get new detections in your inbox