Linux process: enabling BPF kprobes tracing via /sys/kernel/debug/tracing/events/kprobes
Flags Linux commands that enable BPF kprobes tracing through debugfs and probe enable endpoints in the command line.
- Product
- linux
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-01-25
- Updated
- 2026-07-31
What it detects
This rule identifies Linux process command lines that attempt to enable kprobes tracing by writing to /sys/kernel/debug/tracing/events/kprobes. It also matches common enable operations for user-defined probe and return probe controls (e.g., /myprobe/enable and /myretprobe/enable). Such behavior matters because attackers and analysts can use kernel tracing to observe execution paths and instrument activity; detecting it relies on process creation telemetry and the exact command-line strings used.
Reporting behind it
- embracethered.comhttps://embracethered.com/blog/posts/2021/offensive-bpf-bpftrace/
- bpftrace.orghttps://bpftrace.org/
- kernel.orghttps://www.kernel.org/doc/html/v5.0/trace/kprobetrace.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_bpf_kprob_tracing_enabled.yml
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Linux process: enabling BPF kprobes tracing via /sys/kernel/debug/tracing/events/kprobes"
id: 894fb7af-52d4-40f4-9c77-610f6cb4801e
status: test
description: This rule identifies Linux process command lines that attempt to enable kprobes tracing by writing to /sys/kernel/debug/tracing/events/kprobes. It also matches common enable operations for user-defined probe and return probe controls (e.g., /myprobe/enable and /myretprobe/enable). Such behavior matters because attackers and analysts can use kernel tracing to observe execution paths and instrument activity; detecting it relies on process creation telemetry and the exact command-line strings used.
references:
- https://embracethered.com/blog/posts/2021/offensive-bpf-bpftrace/
- https://bpftrace.org/
- https://www.kernel.org/doc/html/v5.0/trace/kprobetrace.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_bpf_kprob_tracing_enabled.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-25
tags:
- attack.execution
- attack.stealth
logsource:
category: process_creation
product: linux
detection:
selection:
CommandLine|contains|all:
- echo 1 >
- /sys/kernel/debug/tracing/events/kprobes/
CommandLine|contains:
- /myprobe/enable
- /myretprobe/enable
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 7692f583-bd30-4008-8615-75dab3f08a99
type: derived