ASLR Disabled Via Sysctl or Direct Syscall - Linux

SigmaHQ Detections@sigmaHQ

•updated Oct 29, 2025•6•1•41

Detects actions that disable Address Space Layout Randomization (ASLR) in Linux. This includes using the `personality` syscall with the ADDR_NO_RANDOMIZE flag, modifying the `/proc/sys/kernel/randomize_va_space` file, or executing the `sysctl` command to set `kernel.randomize_va_space=0`. Disabling ASLR can be used by attackers to bypass memory protection mechanisms and make memory corruption attacks more reliable, often during exploit development.