Linux Process Execution of Triple Cross eBPF Rootkit Install Commands via sudo tc

Flags sudo tc commands using qdisc/filter syntax and enp0s3 consistent with eBPF rootkit installer behavior.

FreeUnreviewedSigmahighv1

linux-process-execution-of-triple-cross-ebpf-rootkit-install-commands-via-sudo-t-22236d75

title: Linux Process Execution of Triple Cross eBPF Rootkit Install Commands via sudo tc
id: 8a28be79-e6fe-405c-9d9c-9a6071d18379
status: test
description: This rule matches Linux process creation where a command executed with sudo includes traffic-control (tc) and filter operations targeting a specific interface (enp0s3) and using qdisc/filter syntax. Attackers installing eBPF-based components or rootkits commonly use tc to attach and manage eBPF programs, so identifying these command patterns can highlight stealthy persistence attempts. It relies on process creation telemetry including the executed image path ending with /sudo and the full command line contents.
references:
  - https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/apps/deployer.sh
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_triple_cross_rootkit_install.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-05
tags:
  - attack.stealth
  - attack.t1014
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /sudo
    CommandLine|contains|all:
      - " tc "
      - " enp0s3 "
    CommandLine|contains:
      - " qdisc "
      - " filter "
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 22236d75-d5a0-4287-bf06-c93b1770860f
    type: derived

What it detects

This rule matches Linux process creation where a command executed with sudo includes traffic-control (tc) and filter operations targeting a specific interface (enp0s3) and using qdisc/filter syntax. Attackers installing eBPF-based components or rootkits commonly use tc to attach and manage eBPF programs, so identifying these command patterns can highlight stealthy persistence attempts. It relies on process creation telemetry including the executed image path ending with /sudo and the full command line contents.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.