Linux Triple Cross eBPF rootkit install commands via sudo tc on enp0s3

Flags sudo tc commands using qdisc/filter syntax and enp0s3 consistent with eBPF rootkit installer behavior.

FreeReviewedSigma · High · v2

Product: linux
Category: process_creation
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-07-05
Updated: 2026-07-31

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1014Rootkit
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Linux process executions of sudo commands that include tc configuration keywords and specifically reference the enp0s3 interface while setting up qdisc and filter components. Such traffic control manipulations can be used to install or stage stealthy eBPF-based functionality, so correlating these command-line patterns helps flag suspicious rootkit deployment activity. The detection relies on process creation telemetry, including the executing image path and full command line contents.

Reporting behind it

Related detections9 linkedT1014 — drag to rearrange

Malicious ValleyRAT KernelQuick Rootkit Service and Shellcode Store Registry Keys

Malicious Koske Userland Rootkit Installation via ld.so.preload (via file_event)

Malicious TeamTNT prochider Rootkit Deployment as Shared Object (via file_event)

Malicious perfctl Rootkit Library Drop via ld.so.preload (via file_event)

Malicious Userland Rootkit Persistence via ld.so.preload on Linux

Malicious VoidLink Rootkit Dropper Artifacts via Filesystem (via file_event)

Suspicious LD_PRELOAD Library Injection via PUMAKIT Userland Rootkit

Malicious VoidLink Pinned eBPF Map in BPF Filesystem (via file_event)

Malicious ShadowGuard eBPF Rootkit Control via Magic Kill Signal (via process_creation)

Linux Triple Cross eBPF rootkit install commands via sudo tc on enp0s3

Pivot detection · T1014 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-process-execution-of-triple-cross-ebpf-rootkit-install-commands-via-sudo-t-22236d75

title: Linux Triple Cross eBPF rootkit install commands via sudo tc on enp0s3
id: 8a28be79-e6fe-405c-9d9c-9a6071d18379
status: test
description: This rule identifies Linux process executions of sudo commands that include tc configuration keywords and specifically reference the enp0s3 interface while setting up qdisc and filter components. Such traffic control manipulations can be used to install or stage stealthy eBPF-based functionality, so correlating these command-line patterns helps flag suspicious rootkit deployment activity. The detection relies on process creation telemetry, including the executing image path and full command line contents.
references:
  - https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/apps/deployer.sh
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_triple_cross_rootkit_install.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-05
tags:
  - attack.stealth
  - attack.t1014
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /sudo
    CommandLine|contains|all:
      - " tc "
      - " enp0s3 "
    CommandLine|contains:
      - " qdisc "
      - " filter "
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 22236d75-d5a0-4287-bf06-c93b1770860f
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL