Linux dd Process Memory Overwrite for Code Injection via /proc/<pid>/mem

title: Linux dd Process Memory Overwrite for Code Injection via /proc/<pid>/mem
id: d594c012-82ef-4cee-bf57-00f3a076fac2
status: test
description: This rule flags Linux process creation where the command line includes dd writing to a target process memory path in /proc/<pid>/mem (with of=). Overwriting a process memory map is a stealthy way to inject or alter code without using common tracing interfaces. It relies on process creation telemetry that captures the dd image path and the full command line arguments.
references:
  - https://www.aon.com/cyber-solutions/aon_cyber_labs/linux-based-inter-process-code-injection-without-ptrace2/
  - https://github.com/AonCyberLabs/Cexigua/blob/34d338620afae4c6335ba8d8d499e1d7d3d5d7b5/overwrite.sh
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_dd_process_injection.yml
author: Joseph Kamau, Huntrule Team
date: 2023-12-01
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055.009
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith: /dd
    CommandLine|contains|all:
      - of=
      - /proc/
      - /mem
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 4cad6c64-d6df-42d6-8dae-eb78defdc415
    type: derived