huntrule

Linux Triple Cross eBPF rootkit install commands via sudo tc on enp0s3

Flags sudo tc commands using qdisc/filter syntax and enp0s3 consistent with eBPF rootkit installer behavior.

FreeReviewedSigma · High · v2
Product
linux
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-07-05
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies Linux process executions of sudo commands that include tc configuration keywords and specifically reference the enp0s3 interface while setting up qdisc and filter components. Such traffic control manipulations can be used to install or stage stealthy eBPF-based functionality, so correlating these command-line patterns helps flag suspicious rootkit deployment activity. The detection relies on process creation telemetry, including the executing image path and full command line contents.

Reporting behind it

Related detections9 linkedT1014 — drag to rearrange
Malicious ValleyRAT KernelQuick Rootkit Service and Shellcode Store Registry Keys
Malicious Koske Userland Rootkit Installation via ld.so.preload (via file_event)
Malicious TeamTNT prochider Rootkit Deployment as Shared Object (via file_event)
Malicious perfctl Rootkit Library Drop via ld.so.preload (via file_event)
Malicious Userland Rootkit Persistence via ld.so.preload on Linux
Malicious VoidLink Rootkit Dropper Artifacts via Filesystem (via file_event)
Suspicious LD_PRELOAD Library Injection via PUMAKIT Userland Rootkit
Malicious VoidLink Pinned eBPF Map in BPF Filesystem (via file_event)
Malicious ShadowGuard eBPF Rootkit Control via Magic Kill Signal (via process_creation)
Linux Triple Cross eBPF rootkit install commands via sudo tc on enp0s3
Pivot detection · T1014 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.