Linux: Disable ASLR via personality syscall or sysctl/randomize_va_space changes
Flags Linux events where ASLR is disabled using the personality syscall or sysctl setting kernel.randomize_va_space=0.
- Product
- linux
- Service
- auditd
- Author
- Milad Cheraghi (SigmaHQ), DRL 1.1
- Published
- 2025-05-26
- Updated
- 2026-07-31
ATT&CK techniques
Priv Esc → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Linux activity that disables Address Space Layout Randomization (ASLR) by using the personality syscall with the ADDR_NO_RANDOMIZE flag, modifying /proc/sys/kernel/randomize_va_space, or executing sysctl to set kernel.randomize_va_space=0. Reducing ASLR effectiveness can make memory corruption exploits more reliable and is a common defense-impairment step during adversary tradecraft. It relies on auditd telemetry capturing syscall events for personality and process execution events for sysctl with specific arguments and values.
Reporting behind it
- github.comhttps://github.com/CheraghiMilad/bypass-Neo23x0-auditd-config/blob/f1c478a37911a5447d5ffcd580f22b167bf3df14/personality-syscall/README.md
- man7.orghttps://man7.org/linux/man-pages/man2/personality.2.html
- manual.cs50.iohttps://manual.cs50.io/2/personality
- linux-audit.comhttps://linux-audit.com/linux-aslr-and-kernelrandomize_va_space-setting/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/lnx_auditd_disable_aslr_protection.yml
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Linux: Disable ASLR via personality syscall or sysctl/randomize_va_space changes"
id: 4925c4b1-180f-4fe5-9536-d9719b642f7d
status: experimental
description: This rule identifies Linux activity that disables Address Space Layout Randomization (ASLR) by using the personality syscall with the ADDR_NO_RANDOMIZE flag, modifying /proc/sys/kernel/randomize_va_space, or executing sysctl to set kernel.randomize_va_space=0. Reducing ASLR effectiveness can make memory corruption exploits more reliable and is a common defense-impairment step during adversary tradecraft. It relies on auditd telemetry capturing syscall events for personality and process execution events for sysctl with specific arguments and values.
references:
- https://github.com/CheraghiMilad/bypass-Neo23x0-auditd-config/blob/f1c478a37911a5447d5ffcd580f22b167bf3df14/personality-syscall/README.md
- https://man7.org/linux/man-pages/man2/personality.2.html
- https://manual.cs50.io/2/personality
- https://linux-audit.com/linux-aslr-and-kernelrandomize_va_space-setting/
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/lnx_auditd_disable_aslr_protection.yml
author: Milad Cheraghi, Huntrule Team
date: 2025-05-26
modified: 2025-12-05
tags:
- attack.privilege-escalation
- attack.stealth
- attack.defense-impairment
- attack.t1685
- attack.t1055.009
logsource:
product: linux
service: auditd
detection:
selection_syscall:
type: SYSCALL
SYSCALL: personality
a0: 40000
selection_sysctl:
type: EXECVE
a0: sysctl
a1: -w
a2: kernel.randomize_va_space=0
condition: 1 of selection_*
falsepositives:
- Debugging or legitimate software testing
level: high
license: DRL-1.1
related:
- id: e497a24e-9345-4a62-9803-b06d7d7cb132
type: derived