Ptrace Process Injection via Remote SSH Session

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•6

This rule detects attempts to perform process injection using the 'ptrace' system call, specifically looking for 'ptrace' and 'PTRACE_ATTACH' within TCP traffic destined for SSH (port 22). This activity is indicative of an attacker trying to attach to a running process, often for debugging, modifying its memory, or injecting malicious code, potentially after gaining remote access via SSH.