Linux: Alert on bpf_probe_write_user BPF helper warning strings
Alerts on Linux log messages referencing the bpf_probe_write_user helper warning string, indicating potential suspicious eBPF usage.
FreeReviewedSigma · High · v3
- Product
- linux
- Author
- Red Canary (idea), Nasreddine Bencherchali (SigmaHQ), DRL 1.1
- Published
- 2023-01-25
- Updated
- 2026-07-31
What it detects
This rule matches log or console output containing the string bpf_probe_write_user, indicating BPF helper-generated warning messages. Such warnings can reflect attempts to load or interact with eBPF programs in ways that may be suspicious or error-prone. It relies on Linux telemetry that captures these helper warning strings in text logs or standard output.
Reporting behind it
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
linux-ebpf-warning-indicators-bpf-probe-write-user-helper-messages-0fadd880
title: "Linux: Alert on bpf_probe_write_user BPF helper warning strings"
id: d727e436-9869-4e2f-b646-d4a5be6b4f8f
status: test
description: This rule matches log or console output containing the string bpf_probe_write_user, indicating BPF helper-generated warning messages. Such warnings can reflect attempts to load or interact with eBPF programs in ways that may be suspicious or error-prone. It relies on Linux telemetry that captures these helper warning strings in text logs or standard output.
references:
- https://redcanary.com/blog/ebpf-malware/
- https://man7.org/linux/man-pages/man7/bpf-helpers.7.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/lnx_potential_susp_ebpf_activity.yml
author: Red Canary (idea), Nasreddine Bencherchali, Huntrule Team
date: 2023-01-25
tags:
- attack.persistence
- attack.stealth
logsource:
product: linux
detection:
selection:
- bpf_probe_write_user
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 0fadd880-6af3-4610-b1e5-008dc3a11b8a
type: derived