Linux ASLR Disabled via personality Syscall, sysctl, or /proc randomize_va_space

title: Linux ASLR Disabled via personality Syscall, sysctl, or /proc randomize_va_space
id: 4925c4b1-180f-4fe5-9536-d9719b642f7d
status: experimental
description: This rule identifies attempts to disable Linux Address Space Layout Randomization (ASLR) by watching for a personality syscall that sets the ADDR_NO_RANDOMIZE flag, or by executing sysctl to set kernel.randomize_va_space=0. Disabling ASLR weakens memory protection and can make memory corruption exploits more reliable. It relies on auditd events that capture the personality syscall and execve activity for sysctl with the specified parameters.
references:
  - https://github.com/CheraghiMilad/bypass-Neo23x0-auditd-config/blob/f1c478a37911a5447d5ffcd580f22b167bf3df14/personality-syscall/README.md
  - https://man7.org/linux/man-pages/man2/personality.2.html
  - https://manual.cs50.io/2/personality
  - https://linux-audit.com/linux-aslr-and-kernelrandomize_va_space-setting/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/lnx_auditd_disable_aslr_protection.yml
author: Milad Cheraghi, Huntrule Team
date: 2025-05-26
modified: 2025-12-05
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.defense-impairment
  - attack.t1685
  - attack.t1055.009
logsource:
  product: linux
  service: auditd
detection:
  selection_syscall:
    type: SYSCALL
    SYSCALL: personality
    a0: 40000
  selection_sysctl:
    type: EXECVE
    a0: sysctl
    a1: -w
    a2: kernel.randomize_va_space=0
  condition: 1 of selection_*
falsepositives:
  - Debugging or legitimate software testing
level: high
license: DRL-1.1
related:
  - id: e497a24e-9345-4a62-9803-b06d7d7cb132
    type: derived