Linux eBPF Rootkit Activity: File Creation of /tmp/rootlog
Detects creation of /tmp/rootlog on Linux, a marker used by the TripleCross rootkit to track backdoor state.
FreeReviewedSigma · High · v3
- Product
- linux
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-07-05
- Updated
- 2026-07-31
What it detects
This rule detects creation of the file /tmp/rootlog, which the TripleCross rootkit uses as a lock/check to determine whether the backdoor is already running. Attackers may use such artifacts to coordinate persistence and avoid spawning duplicate instances. The detection relies on Linux file event telemetry that records target file paths for write/create operations.
Reporting behind it
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
linux-alert-on-tmp-rootlog-creation-associated-with-triplecross-ebpf-rootkit-sta-c0239255
title: "Linux eBPF Rootkit Activity: File Creation of /tmp/rootlog"
id: bdd20e3d-82df-4ee3-8d45-c58be8c1980b
status: test
description: This rule detects creation of the file /tmp/rootlog, which the TripleCross rootkit uses as a lock/check to determine whether the backdoor is already running. Attackers may use such artifacts to coordinate persistence and avoid spawning duplicate instances. The detection relies on Linux file event telemetry that records target file paths for write/create operations.
references:
- https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/src/helpers/execve_hijack.c#L33
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/file_event/file_event_lnx_triple_cross_rootkit_lock_file.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-05
modified: 2022-12-31
tags:
- attack.stealth
logsource:
product: linux
category: file_event
detection:
selection:
TargetFilename: /tmp/rootlog
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: c0239255-822c-4630-b7f1-35362bcb8f44
type: derived