ATT&CK technique
View on MITRE ATT&CK →
T1055.009
Proc Memory
StealthPrivilege Escalation
3 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Potential Fileless Execution via Unusual memfd Create Call | production | 2026-09-08 |
| sigma | ASLR Disabled Via Sysctl or Direct Syscall - Linux | experimental | 2025-12-05 |
| sigma | Potential Linux Process Code Injection Via DD Utility | test | 2023-12-01 |