Linux Ptrace Injection Tool Delivered via HTTP

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•7

This rule detects the delivery of a Linux ptrace injection tool via HTTP. It specifically looks for the string "ptrace(PTRACE_ATTACH" within HTTP response data, indicating that a file containing this specific ptrace function call is being sent to a client. This technique is often used for process injection and privilege escalation on Linux systems.