Threat: Rootkit

BPF Program or Map Load via bpftool

Feb 23, 2026 · Domain: Endpoint OS: Linux Use Case: Threat Detection Tactic: Persistence Tactic: Defense Evasion Threat: Rootkit Data Source: Elastic Endgame Data Source: Elastic Defend Data Source: Auditd Manager Data Source: SentinelOne Data Source: Crowdstrike Resources: Investigation Guide ·

Share on:

Detects execution of bpftool commands used to load, attach, run, or pin eBPF programs, as well as create or update eBPF maps and links. These operations interact directly with the Linux eBPF subsystem and can modify kernel-level behavior. While commonly used by legitimate networking or observability tooling, unexpected or interactive usage may indicate eBPF-based rootkit activity, policy tampering, or unauthorized kernel instrumentation.

BPF Program Tampering via bpftool

Feb 23, 2026 · Domain: Endpoint OS: Linux Use Case: Threat Detection Tactic: Defense Evasion Threat: Rootkit Data Source: Elastic Endgame Data Source: Elastic Defend Data Source: Auditd Manager Data Source: SentinelOne Data Source: Crowdstrike Resources: Investigation Guide ·

Share on:

Detects execution of bpftool commands used to detach eBPF programs or links, or to delete or modify eBPF maps. These actions can disable, alter, or interfere with kernel-level instrumentation and enforcement mechanisms implemented through eBPF. In environments relying on eBPF-based networking, observability, or security controls, unexpected use of these operations may indicate defense evasion or runtime tampering.

Kernel Module Load from Unusual Location

Feb 23, 2026 · Domain: Endpoint OS: Linux Use Case: Threat Detection Tactic: Persistence Tactic: Defense Evasion Threat: Rootkit Data Source: Elastic Defend Resources: Investigation Guide ·

Share on:

This rule detects the loading of a kernel module from an unusual location. Threat actors may use this technique to maintain persistence on a system by loading a kernel module into the kernel namespace. This behavior is strongly related to the presence of a rootkit on the system.

Kernel Module Load via Built-in Utility

Feb 23, 2026 · Domain: Endpoint OS: Linux Use Case: Threat Detection Tactic: Persistence Tactic: Defense Evasion Threat: Rootkit Data Source: Elastic Endgame Data Source: Elastic Defend Data Source: Auditd Manager Data Source: SentinelOne Data Source: Crowdstrike Resources: Investigation Guide ·

Share on:

Detects the use of the insmod binary to load a Linux kernel object file. Threat actors can use this binary, given they have root privileges, to load a rootkit on a system providing them with complete control and the ability to hide from security products. Manually loading a kernel module in this manner should not be at all common and can indicate suspicious or malicious behavior.