Linux eBPF Backdoor File Persistence via cron.d and sudoers.d (ebpfbackdoor)

Detects Linux creation of "ebpfbackdoor" files in cron.d/sudoers.d, indicating likely persistence via an eBPF backdoor.

FreeReviewedSigma · High · v3

Product: linux
Category: file_event
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-07-05
Updated: 2026-07-31

ATT&CK techniques

Execution → Priv Esc

Recon
Resource Dev
Initial Access
Execution
- T1053.003Cron
Persistence
- T1053.003Cron
Priv Esc
- T1053.003Cron
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Linux file creation events where the target filename ends with "ebpfbackdoor" in the default persistence locations under cron.d and sudoers.d. Attackers can use these directories for persistence, including mechanisms intended to survive reboots or regain execution. The detection relies on file event telemetry that records the created/targeted filename in those directories.

Reporting behind it

Related detections9 linkedT1053.003 — drag to rearrange

Suspicious Cron Job Downloading and Executing Payload via GlobalProtect Exploitation

Suspicious Remote Script Download Piped to Shell via 8220 Gang Hadooken

Suspicious Linux Crontab Reboot Persistence to Hidden Sys Cache Binary (via process_creation)

Suspicious Cron Persistence Installing a Downloader via Command Line

Suspicious Cron Persistence File Creation in System Cron Directories (via file_event)

Suspicious Cron Persistence via etc cron.d tsar (via file_event)

Suspicious Cron Job Executing Binary From var tmp via Process Creation

Suspicious Cron Job Persistence Creation on Linux (via process_creation)

Suspicious Cron Persistence File Created in System Cron Directories

Linux eBPF Backdoor File Persistence via cron.d and sudoers.d (ebpfbackdoor)

Pivot detection · T1053.003 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-ebpf-backdoor-file-creation-in-cron-d-and-sudoers-d-for-persistence-1a2ea919

title: Linux eBPF Backdoor File Persistence via cron.d and sudoers.d (ebpfbackdoor)
id: be179e1a-36c4-46a8-89dc-7ac7bc3fae6b
status: test
description: This rule flags Linux file creation events where the target filename ends with "ebpfbackdoor" in the default persistence locations under cron.d and sudoers.d. Attackers can use these directories for persistence, including mechanisms intended to survive reboots or regain execution. The detection relies on file event telemetry that records the created/targeted filename in those directories.
references:
  - https://github.com/h3xduck/TripleCross/blob/12629558b8b0a27a5488a0b98f1ea7042e76f8ab/apps/deployer.sh
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/file_event/file_event_lnx_triple_cross_rootkit_persistence.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-05
modified: 2022-12-31
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1053.003
logsource:
  product: linux
  category: file_event
detection:
  selection:
    TargetFilename|endswith: ebpfbackdoor
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 1a2ea919-d11d-4d1e-8535-06cda13be20f
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL