{"id":"e497a24e-9345-4a62-9803-b06d7d7cb132","title":"ASLR Disabled Via Sysctl or Direct Syscall - Linux","description":"Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including:\n  - Use of the `personality` syscall with the ADDR_NO_RANDOMIZE flag (0x0040000)\n  - Modification of the /proc/sys/kernel/randomize_va_space file\n  - Execution of the `sysctl` command to set `kernel.randomize_va_space=0`\nDisabling ASLR is often used by attackers during exploit development or to bypass memory protection mechanisms.\nA successful use of these methods can reduce the effectiveness of ASLR and make memory corruption attacks more reliable.\n","author":"Milad Cheraghi","status":"experimental","level":"high","date":"2025-05-26","modified":"2025-12-05","tags":["attack.privilege-escalation","attack.stealth","attack.defense-impairment","attack.t1685","attack.t1055.009"],"technique_ids":["T1055.009","T1685"],"logsource":{"product":"linux","service":"auditd"},"falsepositives":["Debugging or legitimate software testing"],"references":["https://github.com/CheraghiMilad/bypass-Neo23x0-auditd-config/blob/f1c478a37911a5447d5ffcd580f22b167bf3df14/personality-syscall/README.md","https://man7.org/linux/man-pages/man2/personality.2.html","https://manual.cs50.io/2/personality","https://linux-audit.com/linux-aslr-and-kernelrandomize_va_space-setting/"],"source_path":"rules/linux/auditd/lnx_auditd_disable_aslr_protection.yml","source_sha256":"8cb6126e08ec525a251233123bd6eda62e160dbf14490c0834a53d4bfcf0d8ee","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/lnx_auditd_disable_aslr_protection.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: ASLR Disabled Via Sysctl or Direct Syscall - Linux\nid: e497a24e-9345-4a62-9803-b06d7d7cb132\nstatus: experimental\ndescription: |\n    Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including:\n      - Use of the `personality` syscall with the ADDR_NO_RANDOMIZE flag (0x0040000)\n      - Modification of the /proc/sys/kernel/randomize_va_space file\n      - Execution of the `sysctl` command to set `kernel.randomize_va_space=0`\n    Disabling ASLR is often used by attackers during exploit development or to bypass memory protection mechanisms.\n    A successful use of these methods can reduce the effectiveness of ASLR and make memory corruption attacks more reliable.\nreferences:\n    - https://github.com/CheraghiMilad/bypass-Neo23x0-auditd-config/blob/f1c478a37911a5447d5ffcd580f22b167bf3df14/personality-syscall/README.md\n    - https://man7.org/linux/man-pages/man2/personality.2.html\n    - https://manual.cs50.io/2/personality\n    - https://linux-audit.com/linux-aslr-and-kernelrandomize_va_space-setting/\nauthor: Milad Cheraghi\ndate: 2025-05-26\nmodified: 2025-12-05\ntags:\n    - attack.privilege-escalation\n    - attack.stealth\n    - attack.defense-impairment\n    - attack.t1685\n    - attack.t1055.009\nlogsource:\n    product: linux\n    service: auditd\ndetection:\n    selection_syscall:\n        type: 'SYSCALL'\n        SYSCALL: 'personality'\n        a0: 40000\n    selection_sysctl:\n        type: 'EXECVE'\n        a0: 'sysctl'\n        a1: '-w'\n        a2: 'kernel.randomize_va_space=0' # 0 = disable\n    condition: 1 of selection_*\nfalsepositives:\n    - Debugging or legitimate software testing\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1055.009","id":"T1055.009","name":"Proc Memory","page":"techniques/enterprise/T1055.009/"},{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/e497a24e-9345-4a62-9803-b06d7d7cb132.json","kind":"sigma"}