huntrule

Linux Triple Cross eBPF rootkit install commands via sudo tc on enp0s3

Flags sudo tc commands using qdisc/filter syntax and enp0s3 consistent with eBPF rootkit installer behavior.

FreeReviewedSigma · High · v2
Product
linux
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-07-05
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies Linux process executions of sudo commands that include tc configuration keywords and specifically reference the enp0s3 interface while setting up qdisc and filter components. Such traffic control manipulations can be used to install or stage stealthy eBPF-based functionality, so correlating these command-line patterns helps flag suspicious rootkit deployment activity. The detection relies on process creation telemetry, including the executing image path and full command line contents.

Reporting behind it

Related detections9 linkedT1014 — drag to rearrange
Suspicious Rootkit Configuration Registry Keys (via registry_set)
Suspicious Fake ACPIx86 Driver File Creation (via file_event)
Malicious ld.so.preload Hijack Loading libcext by Auto-Color (via process_creation)
Suspicious Loading of Malicious Netfilter Kernel Module for Traffic Signaling
Malicious Kernel Driver Load from User AppData Directory
Malicious Kernel Driver Service Registration for ProjectConfiguration Rootkit
Malicious Vulnerable Driver Mapping via KDU
Suspicious Kernel Module Load From World Writable Directory on Linux
Suspicious Kernel Module Load Or Unload For Rootkit Deployment via PUMAKIT
Linux Triple Cross eBPF rootkit install commands via sudo tc on enp0s3
Pivot detection · T1014 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.