Suspicious Bpfdoor TCP Ports Redirect (via auditd)

title: Suspicious Bpfdoor TCP Ports Redirect (via auditd)
id: 408a2cb3-2a35-541a-9acb-ef2fc9543f0b
status: stable
description: This rule detects all TCP traffic on particular port from adversary is routed to different port. ex. '/sbin/iptables -t nat -D PREROUTING -p tcp -s 192.168.1.1 --dport 22 -j REDIRECT --to-ports 42392' The traffic looks like encrypted SSH communications going to TCP port 22, but in reality is being directed to the shell port once it hits the iptables rule for the adversary host only.
references:
    - https://attack.mitre.org/techniques/T1686/
    - https://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/
    - https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor
author: Huntrule Team
date: 2026-07-23
tags:
    - attack.defense-impairment
    - attack.t1686
logsource:
    product: linux
    service: auditd
detection:
    cmd:
        type: 'EXECVE'
        a0|endswith: 'iptables'
        a1: '-t'
        a2: 'nat'
    keywords:
        - '--to-ports 42'
        - '--to-ports 43'
    condition: cmd and keywords
falsepositives:
    - Unknown
level: medium