HAProxy process self-access to /proc/mem for counter tampering

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•0

Detects the 'ted' backdoor or similar malicious activity attempting to manipulate HAProxy's internal connection counters by accessing or writing to the HAProxy process memory (/proc/[pid]/mem or /proc/self/mem). This behavior is characteristic of an attempt to evade backend logging and statistics tracking by directly modifying process memory structures.