From 2d6a57bcc24a792675c736cfdf50b4f91cea49ee Mon Sep 17 00:00:00 2001 From: vahidmalekk <46035912+vahidmalekk@users.noreply.github.com> Date: Mon, 26 Oct 2026 21:55:04 +0330 Subject: [PATCH 1/3] Add linux auditd cross-process ptrace (PTRACE_SEIZE) dataset (T1055.008) Real auditd SYSCALL/OBJ_PID/PROCTITLE records captured from a host where a tracer (strace) attaches to a running process via ptrace. Keyed as tracing. Supports the Linux Auditd Cross-Process Ptrace Activity detection. --- .../linux_auditd_ptrace/linux_auditd_ptrace.log | 12 ++++++++++++ .../linux_auditd_ptrace/linux_auditd_ptrace.yml | 13 +++++++++++++ 2 files changed, 25 insertions(+) create mode 100644 datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.log create mode 100644 datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.yml diff --git a/datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.log b/datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.log new file mode 100644 index 00000000..4019993c --- /dev/null +++ b/datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.log @@ -0,0 +1,12 @@ +type=SYSCALL msg=audit(1793036923.965:1122): arch=c000003e syscall=101 success=yes exit=0 a0=4206 a1=ad6 a2=0 a3=0 items=0 ppid=2772 pid=2773 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=3 comm="strace" exe="/usr/bin/strace" subj=unconfined key="tracing" ARCH=x86_64 SYSCALL=ptrace AUID="root" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root" +type=OBJ_PID msg=audit(1793036923.965:1122): opid=2774 oauid=0 ouid=0 oses=3 obj=unconfined ocomm="strace" OAUID="root" OUID="root" +type=PROCTITLE msg=audit(1793036923.965:1122): proctitle=737472616365002D700032373638 +type=SYSCALL msg=audit(1793036923.967:1137): arch=c000003e syscall=101 success=yes exit=0 a0=4206 a1=ad0 a2=0 a3=51 items=0 ppid=2772 pid=2773 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=3 comm="strace" exe="/usr/bin/strace" subj=unconfined key="tracing" ARCH=x86_64 SYSCALL=ptrace AUID="root" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root" +type=OBJ_PID msg=audit(1793036923.967:1137): opid=2768 oauid=0 ouid=0 oses=3 obj=unconfined ocomm="sleep" OAUID="root" OUID="root" +type=PROCTITLE msg=audit(1793036923.967:1137): proctitle=737472616365002D700032373638 +type=SYSCALL msg=audit(1793037457.572:1202): arch=c000003e syscall=101 success=yes exit=0 a0=4206 a1=e8d a2=0 a3=0 items=0 ppid=3723 pid=3724 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=3 comm="strace" exe="/usr/bin/strace" subj=unconfined key="tracing" ARCH=x86_64 SYSCALL=ptrace AUID="root" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root" +type=OBJ_PID msg=audit(1793037457.572:1202): opid=3725 oauid=0 ouid=0 oses=3 obj=unconfined ocomm="strace" OAUID="root" OUID="root" +type=PROCTITLE msg=audit(1793037457.572:1202): proctitle=737472616365002D700033373231002D6F002F6465762F6E756C6C +type=SYSCALL msg=audit(1793037457.574:1217): arch=c000003e syscall=101 success=yes exit=0 a0=4206 a1=e89 a2=0 a3=51 items=0 ppid=3723 pid=3724 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=3 comm="strace" exe="/usr/bin/strace" subj=unconfined key="tracing" ARCH=x86_64 SYSCALL=ptrace AUID="root" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root" +type=OBJ_PID msg=audit(1793037457.574:1217): opid=3721 oauid=0 ouid=0 oses=3 obj=unconfined ocomm="sleep" OAUID="root" OUID="root" +type=PROCTITLE msg=audit(1793037457.574:1217): proctitle=737472616365002D700033373231002D6F002F6465762F6E756C6C diff --git a/datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.yml b/datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.yml new file mode 100644 index 00000000..cc301428 --- /dev/null +++ b/datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.yml @@ -0,0 +1,13 @@ +author: vahid malekmohammadi +id: 7d709b3d-ed24-4b8d-ac67-6233b2c3adfa +date: '2026-10-26' +description: Generated dataset for linux auditd cross-process ptrace (PTRACE_SEIZE) in attack range. A tracer (strace) attaches to a running process via ptrace, producing SYSCALL (syscall=ptrace), OBJ_PID and PROCTITLE records keyed as tracing. +environment: attack_range +directory: linux_auditd_ptrace +mitre_technique: +- T1055.008 +datasets: +- name: linux_auditd_ptrace + path: /datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.log + sourcetype: auditd + source: auditd From f2b49b9265a3c2bd8a6eaa51dfd573d440afaf9e Mon Sep 17 00:00:00 2001 From: vahidmalekk <46035912+vahidmalekk@users.noreply.github.com> Date: Thu, 29 Oct 2026 15:51:43 +0330 Subject: [PATCH 2/3] Update linux_auditd_ptrace.log wConvert ptrace dataset log to Git LFS (1/2)ith new audit entries --- .../T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.log | 1 + 1 file changed, 1 insertion(+) diff --git a/datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.log b/datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.log index 4019993c..0a9f7709 100644 --- a/datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.log +++ b/datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.log @@ -10,3 +10,4 @@ type=PROCTITLE msg=audit(1793037457.572:1202): proctitle=737472616365002D7000333 type=SYSCALL msg=audit(1793037457.574:1217): arch=c000003e syscall=101 success=yes exit=0 a0=4206 a1=e89 a2=0 a3=51 items=0 ppid=3723 pid=3724 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=3 comm="strace" exe="/usr/bin/strace" subj=unconfined key="tracing" ARCH=x86_64 SYSCALL=ptrace AUID="root" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root" type=OBJ_PID msg=audit(1793037457.574:1217): opid=3721 oauid=0 ouid=0 oses=3 obj=unconfined ocomm="sleep" OAUID="root" OUID="root" type=PROCTITLE msg=audit(1793037457.574:1217): proctitle=737472616365002D700033373231002D6F002F6465762F6E756C6C + From 891d6a0bba85b47c84024c81835d9a41ef72b2ef Mon Sep 17 00:00:00 2001 From: vahid malekmohammadi <46035912+vahidmalekk@users.noreply.github.com> Date: Sat, 31 Oct 2026 12:20:26 +0330 Subject: [PATCH 3/3] Store ptrace dataset log as Git LFS object --- .../linux_auditd_ptrace/linux_auditd_ptrace.log | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-) diff --git a/datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.log b/datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.log index 0a9f7709..cfb47b95 100644 --- a/datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.log +++ b/datasets/attack_techniques/T1055.008/linux_auditd_ptrace/linux_auditd_ptrace.log @@ -1,13 +1,3 @@ -type=SYSCALL msg=audit(1793036923.965:1122): arch=c000003e syscall=101 success=yes exit=0 a0=4206 a1=ad6 a2=0 a3=0 items=0 ppid=2772 pid=2773 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=3 comm="strace" exe="/usr/bin/strace" subj=unconfined key="tracing" ARCH=x86_64 SYSCALL=ptrace AUID="root" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root" -type=OBJ_PID msg=audit(1793036923.965:1122): opid=2774 oauid=0 ouid=0 oses=3 obj=unconfined ocomm="strace" OAUID="root" OUID="root" -type=PROCTITLE msg=audit(1793036923.965:1122): proctitle=737472616365002D700032373638 -type=SYSCALL msg=audit(1793036923.967:1137): arch=c000003e syscall=101 success=yes exit=0 a0=4206 a1=ad0 a2=0 a3=51 items=0 ppid=2772 pid=2773 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=3 comm="strace" exe="/usr/bin/strace" subj=unconfined key="tracing" ARCH=x86_64 SYSCALL=ptrace AUID="root" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root" -type=OBJ_PID msg=audit(1793036923.967:1137): opid=2768 oauid=0 ouid=0 oses=3 obj=unconfined ocomm="sleep" OAUID="root" OUID="root" -type=PROCTITLE msg=audit(1793036923.967:1137): proctitle=737472616365002D700032373638 -type=SYSCALL msg=audit(1793037457.572:1202): arch=c000003e syscall=101 success=yes exit=0 a0=4206 a1=e8d a2=0 a3=0 items=0 ppid=3723 pid=3724 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=3 comm="strace" exe="/usr/bin/strace" subj=unconfined key="tracing" ARCH=x86_64 SYSCALL=ptrace AUID="root" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root" -type=OBJ_PID msg=audit(1793037457.572:1202): opid=3725 oauid=0 ouid=0 oses=3 obj=unconfined ocomm="strace" OAUID="root" OUID="root" -type=PROCTITLE msg=audit(1793037457.572:1202): proctitle=737472616365002D700033373231002D6F002F6465762F6E756C6C -type=SYSCALL msg=audit(1793037457.574:1217): arch=c000003e syscall=101 success=yes exit=0 a0=4206 a1=e89 a2=0 a3=51 items=0 ppid=3723 pid=3724 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=3 comm="strace" exe="/usr/bin/strace" subj=unconfined key="tracing" ARCH=x86_64 SYSCALL=ptrace AUID="root" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root" -type=OBJ_PID msg=audit(1793037457.574:1217): opid=3721 oauid=0 ouid=0 oses=3 obj=unconfined ocomm="sleep" OAUID="root" OUID="root" -type=PROCTITLE msg=audit(1793037457.574:1217): proctitle=737472616365002D700033373231002D6F002F6465762F6E756C6C - +version https://git-lfs.github.com/spec/v1 +oid sha256:6a34a838e00a382bb6212fffb73244232a2006013e1422c4541f5298271e9f62 +size 2616