Sigma high test sigma

Triple Cross eBPF Rootkit Install Commands

Detects default install commands of the Triple Cross eBPF rootkit based on the "deployer.sh" script

View Source

Detection Logic

{
  "selection": {
    "Image
| endswith": "/sudo",
    "CommandLine
| contains
| all": [
      " tc ",
      " enp0s3 "
    ],
    "CommandLine
| contains": [
      " qdisc ",
      " filter "
    ]
  },
  "condition": "selection"
}

False Positives

  • ⚠ Unlikely

Field Validations

Loading…

Comments (0)

Loading comments...