Linux bpftrace CommandLine Use of --unsafe Option

Alerts when bpftrace is executed with the --unsafe option on Linux.

FreeUnreviewedSigmamediumv1

linux-bpftrace-commandline-use-of-unsafe-option-f8341cb2

title: Linux bpftrace CommandLine Use of --unsafe Option
id: 46363c82-b859-430d-a723-a75366823783
status: test
description: This rule flags process executions where the command line for a program ending with bpftrace contains the --unsafe option. Using unsafe options can enable functionality that may bypass safety checks and allow behavior that is more likely to impact the system beyond normal tracing. It relies on Linux process creation telemetry that includes the process image name and command-line arguments.
references:
  - https://embracethered.com/blog/posts/2021/offensive-bpf-bpftrace/
  - https://bpftrace.org/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_bpftrace_unsafe_option_usage.yml
author: Andreas Hunkeler (@Karneades), Huntrule Team
date: 2022-02-11
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: bpftrace
    CommandLine|contains: --unsafe
  condition: selection
falsepositives:
  - Legitimate usage of the unsafe option
level: medium
license: DRL-1.1
related:
  - id: f8341cb2-ee25-43fa-a975-d8a5a9714b39
    type: derived

What it detects

This rule flags process executions where the command line for a program ending with bpftrace contains the --unsafe option. Using unsafe options can enable functionality that may bypass safety checks and allow behavior that is more likely to impact the system beyond normal tracing. It relies on Linux process creation telemetry that includes the process image name and command-line arguments.

Known false positives

Legitimate usage of the unsafe option

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.