Suspicious Enable BPF Kprobes Tracing (via process_creation)

title: Suspicious Enable BPF Kprobes Tracing (via process_creation)
id: 3eb7f850-1a2a-58c7-b831-5e01cff37ebe
status: stable
description: This rule detects common command used to enable bpf kprobes tracing
references:
    - https://embracethered.com/blog/posts/2021/offensive-bpf-bpftrace/
    - https://bpftrace.org/
    - https://www.kernel.org/doc/html/v5.0/trace/kprobetrace.html
author: Huntrule Team
date: 2026-02-13
tags:
    - attack.execution
    - attack.stealth
    - attack.t1059.004
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        CommandLine|contains|all:
            - 'echo 1 >'
            - '/sys/kernel/debug/tracing/events/kprobes/'
        CommandLine|contains:
            - '/myprobe/enable'
            - '/myretprobe/enable'
    condition: selection
falsepositives:
    - Unknown
level: medium