Threat video1:00
BPFDoor eBPF Rootkit Code on Forums: Detection & IOCs
Forum users now trade eBPF rootkit code that lsmod misses. Hunt BPFDoor, Symbiote and LinkPro with 9 detection rules, 22 IOCs and a free Splunk SPL rule.
Read the full threat intel for eBPF Rootkits Gaining Traction on Underground Forums (Flare… →
Chapters
- 0:00The hookeBPF rootkit code circulates on underground forums.
- 0:05The storyFlare found tutorials and reposted code.
- 0:11Attack pathDefenders reproduce a known Jenkins flaw in a lab.
- 0:26AttributionNo threat actor: this was defensive research.
- 0:30Indicators of compromise17 indicators to hunt: 2 IPs, 1 domain and 1 URL, and more.
- 0:37MITRE ATT&CK techniques15 ATT&CK techniques, from initial access to command and control.
- 0:43Remediation5 steps now: Audit loaded eBPF programs, maps and links with bpftool prog.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00eBPF rootkit code circulates on underground forums.
0:05Flare found tutorials and reposted code.
0:08Families include BPFDoor and LinkPro.
0:12Defenders reproduce a known Jenkins flaw in a lab.
0:15LinkPro used that flaw.
0:17Without a kernel module, routine checks can miss them.
0:20Defenders audit eBPF programs now.
0:26No threat actor: this was defensive research.
0:3117 indicators to hunt: 2 IPs, 1 domain and 1 URL, and more.
0:3815 ATT&CK techniques, from initial access to command and control.
0:435 steps now: Audit loaded eBPF programs, maps and links with bpftool prog.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.