Sigma rule: ASLR Disabled Via Sysctl or Direct Syscall - Linux

Rule

Title

ASLR Disabled Via Sysctl or Direct Syscall - Linux

Status

experimental

Level

high

Author

Milad Cheraghi

Date

2025-05-26

Modified

2025-12-05

File

rules/linux/auditd/lnx_auditd_disable_aslr_protection.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including:
- Use of the `personality` syscall with the ADDR_NO_RANDOMIZE flag (0x0040000)
- Modification of the /proc/sys/kernel/randomize_va_space file
- Execution of the `sysctl` command to set `kernel.randomize_va_space=0`
Disabling ASLR is often used by attackers during exploit development or to bypass memory protection mechanisms.
A successful use of these methods can reduce the effectiveness of ASLR and make memory corruption attacks more reliable.

Log source

product

linux

service

auditd

Detection

selection_syscall:
    type: 'SYSCALL'
    SYSCALL: 'personality'
    a0: 40000
selection_sysctl:
    type: 'EXECVE'
    a0: 'sysctl'
    a1: '-w'
    a2: 'kernel.randomize_va_space=0' # 0 = disable
condition: 1 of selection_*

False positives (as the rule lists them)

• Debugging or legitimate software testing

Tags

• attack.privilege-escalation
• attack.stealth
• attack.defense-impairment
• attack.t1685
• attack.t1055.009

MITRE ATT&CK ids this rule names

• T1055.009
• T1685

References

• https://github.com/CheraghiMilad/bypass-Neo23x0-auditd-config/blob/f1c478a37911a5447d5ffcd580f22b167bf3df14/personality-syscall/README.md
• https://man7.org/linux/man-pages/man2/personality.2.html
• https://manual.cs50.io/2/personality
• https://linux-audit.com/linux-aslr-and-kernelrandomize_va_space-setting/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/auditd/lnx_auditd_disable_aslr_protection.yml