huntrule

Linux eBPF Warning Indicators: bpf_probe_write_user Helper Messages

Alerts on Linux log messages referencing the bpf_probe_write_user helper warning string, indicating potential suspicious eBPF usage.

FreeUnreviewedSigmahighv1
title: "Linux eBPF Warning Indicators: bpf_probe_write_user Helper Messages"
id: d727e436-9869-4e2f-b646-d4a5be6b4f8f
status: test
description: This rule flags Linux system log output containing the BPF helper-generated string "bpf_probe_write_user". Attackers may trigger or leave behind these warnings when using eBPF programs to interact with userspace or perform behavior that defenders can surface via helper diagnostics. It relies on telemetry where such BPF helper messages are recorded in Linux logs.
references:
  - https://redcanary.com/blog/ebpf-malware/
  - https://man7.org/linux/man-pages/man7/bpf-helpers.7.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/lnx_potential_susp_ebpf_activity.yml
author: Red Canary (idea), Nasreddine Bencherchali, Huntrule Team
date: 2023-01-25
tags:
  - attack.persistence
  - attack.stealth
logsource:
  product: linux
detection:
  selection:
    - bpf_probe_write_user
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 0fadd880-6af3-4610-b1e5-008dc3a11b8a
    type: derived

What it detects

This rule flags Linux system log output containing the BPF helper-generated string "bpf_probe_write_user". Attackers may trigger or leave behind these warnings when using eBPF programs to interact with userspace or perform behavior that defenders can surface via helper diagnostics. It relies on telemetry where such BPF helper messages are recorded in Linux logs.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.