Linux eBPF backdoor file creation in cron.d and sudoers.d for persistence

title: Linux eBPF backdoor file creation in cron.d and sudoers.d for persistence
id: be179e1a-36c4-46a8-89dc-7ac7bc3fae6b
status: test
description: 'This rule flags the creation of a file ending with "ebpfbackdoor" on Linux, targeting locations commonly used for persistence: cron.d and sudoers.d. Attackers may use an eBPF-based backdoor to establish persistence or elevate execution without standard malware drop paths. The detection relies on file creation and path-based telemetry that records the target filename and directory.'
references:
  - https://github.com/h3xduck/TripleCross/blob/12629558b8b0a27a5488a0b98f1ea7042e76f8ab/apps/deployer.sh
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/file_event/file_event_lnx_triple_cross_rootkit_persistence.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-05
modified: 2022-12-31
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1053.003
logsource:
  product: linux
  category: file_event
detection:
  selection:
    TargetFilename|endswith: ebpfbackdoor
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 1a2ea919-d11d-4d1e-8535-06cda13be20f
    type: derived