Linux Process Execution of bpftrace with the --unsafe Option

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1059.004Unix Shell
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process executions where the command line for bpftrace includes the --unsafe option. The unsafe flag enables behavior that can increase risk and may be used by an attacker to bypass safeguards when running bpftrace. It relies on process creation telemetry capturing the executed image path ending with bpftrace and the command-line arguments.

Reporting behind it

Related detections9 linkedT1059.004 — drag to rearrange

Suspicious Reverse Shell via Dev TCP or Netcat

Suspicious Base64 Decoded Payload Piped to Shell

Suspicious Shell Spawned by ActiveMQ Java Process

Suspicious Bad Apples Reverse Shell via socat pty

Suspicious Axios NPM macOS Persistence Masquerading as Apple Service

Malicious Shell Payload Piped from curl to zsh

Possible Bitbucket Pre-Auth RCE via git archive exec Null-Byte Injection (CVE-2022-36804) (via webserver)

Malicious TeamTNT Docker Gatling Gun Initialization Script (via process_creation)

Suspicious Shell Spawned by PostgreSQL Server Process (via process_creation)

Linux Process Execution of bpftrace with the --unsafe Option

Pivot detection · T1059.004 · 9 related

Changelog

v3

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-bpftrace-commandline-use-of-unsafe-option-f8341cb2

title: Linux Process Execution of bpftrace with the --unsafe Option
id: 46363c82-b859-430d-a723-a75366823783
status: test
description: This rule flags process executions where the command line for bpftrace includes the --unsafe option. The unsafe flag enables behavior that can increase risk and may be used by an attacker to bypass safeguards when running bpftrace. It relies on process creation telemetry capturing the executed image path ending with bpftrace and the command-line arguments.
references:
  - https://embracethered.com/blog/posts/2021/offensive-bpf-bpftrace/
  - https://bpftrace.org/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_bpftrace_unsafe_option_usage.yml
author: Andreas Hunkeler (@Karneades), Huntrule Team
date: 2022-02-11
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: bpftrace
    CommandLine|contains: --unsafe
  condition: selection
falsepositives:
  - Legitimate usage of the unsafe option
level: medium
license: DRL-1.1
related:
  - id: f8341cb2-ee25-43fa-a975-d8a5a9714b39
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL