Potential Linux Process Code Injection Via DD Utility

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•3•1•33

Detects the injection of code by overwriting the memory map of a Linux process using the "dd" Linux command. This technique leverages the /proc filesystem to modify a running process's memory, which can be used for privilege escalation or defense evasion.