Linux: Alert on /tmp/rootlog creation associated with TripleCross eBPF rootkit state check

Detects creation of /tmp/rootlog on Linux, a marker used by the TripleCross rootkit to track backdoor state.

FreeUnreviewedSigmahighv1

linux-alert-on-tmp-rootlog-creation-associated-with-triplecross-ebpf-rootkit-sta-c0239255

title: "Linux: Alert on /tmp/rootlog creation associated with TripleCross eBPF rootkit state check"
id: bdd20e3d-82df-4ee3-8d45-c58be8c1980b
status: test
description: This rule flags creation of the file /tmp/rootlog on Linux, which is used as a lock/check by the TripleCross eBPF rootkit to determine whether its backdoor is already running. Attackers rely on this marker to avoid duplicate execution and to control persistence behavior. The detection relies on file creation telemetry for the specific target path.
references:
  - https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/src/helpers/execve_hijack.c#L33
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/file_event/file_event_lnx_triple_cross_rootkit_lock_file.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-05
modified: 2022-12-31
tags:
  - attack.stealth
logsource:
  product: linux
  category: file_event
detection:
  selection:
    TargetFilename: /tmp/rootlog
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: c0239255-822c-4630-b7f1-35362bcb8f44
    type: derived

What it detects

This rule flags creation of the file /tmp/rootlog on Linux, which is used as a lock/check by the TripleCross eBPF rootkit to determine whether its backdoor is already running. Attackers rely on this marker to avoid duplicate execution and to control persistence behavior. The detection relies on file creation telemetry for the specific target path.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.