Linux Process Creation: Enabling BPF Kprobes Tracing via Debugfs and Probe Enable Paths

Flags Linux commands that enable BPF kprobes tracing through debugfs and probe enable endpoints in the command line.

FreeUnreviewedSigmamediumv1

linux-process-creation-enabling-bpf-kprobes-tracing-via-debugfs-and-probe-enable-7692f583

title: "Linux Process Creation: Enabling BPF Kprobes Tracing via Debugfs and Probe Enable Paths"
id: 894fb7af-52d4-40f4-9c77-610f6cb4801e
status: test
description: This rule identifies Linux process executions whose command line includes writes to the debugfs kprobes enable interface and references probe enable paths such as /myprobe/enable and /myretprobe/enable. Enabling kprobes tracing can be used to observe or instrument kernel behavior, which attackers may leverage for stealthy insight into system activity. The detection relies on process creation telemetry and matches specific command-line substrings indicative of enabling kprobe tracing.
references:
  - https://embracethered.com/blog/posts/2021/offensive-bpf-bpftrace/
  - https://bpftrace.org/
  - https://www.kernel.org/doc/html/v5.0/trace/kprobetrace.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_bpf_kprob_tracing_enabled.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-25
tags:
  - attack.execution
  - attack.stealth
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains|all:
      - echo 1 >
      - /sys/kernel/debug/tracing/events/kprobes/
    CommandLine|contains:
      - /myprobe/enable
      - /myretprobe/enable
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 7692f583-bd30-4008-8615-75dab3f08a99
    type: derived

What it detects

This rule identifies Linux process executions whose command line includes writes to the debugfs kprobes enable interface and references probe enable paths such as /myprobe/enable and /myretprobe/enable. Enabling kprobes tracing can be used to observe or instrument kernel behavior, which attackers may leverage for stealthy insight into system activity. The detection relies on process creation telemetry and matches specific command-line substrings indicative of enabling kprobe tracing.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.