-
BPF Program or Map Load via bpftool
Sep 19, 2026 · Domain: Endpoint OS: Linux Use Case: Threat Detection Tactic: Persistence Tactic: Defense Evasion Threat: Rootkit Data Source: Elastic Endgame Data Source: Elastic Defend Data Source: Auditd Manager Data Source: SentinelOne Data Source: Crowdstrike Resources: Investigation Guide Noise: Medium Performance: Normal Rule Type: Event Correlation (EQL) Platform: Linux ·Detects execution of bpftool commands used to load, attach, run, or pin eBPF programs, as well as create or update eBPF maps and links. These operations interact directly with the Linux eBPF subsystem and can modify kernel-level behavior. While commonly used by legitimate networking or observability tooling, unexpected or interactive usage may indicate eBPF-based rootkit activity, policy tampering, or unauthorized kernel instrumentation.
Read More -
BPF Program Tampering via bpftool
Sep 19, 2026 · Domain: Endpoint OS: Linux Use Case: Threat Detection Tactic: Defense Evasion Threat: Rootkit Data Source: Elastic Endgame Data Source: Elastic Defend Data Source: Auditd Manager Data Source: SentinelOne Data Source: Crowdstrike Resources: Investigation Guide Noise: High Performance: Normal Profile: Aggressive Rule Type: Event Correlation (EQL) Platform: Linux ·Detects execution of bpftool commands used to detach eBPF programs or links, or to delete or modify eBPF maps. These actions can disable, alter, or interfere with kernel-level instrumentation and enforcement mechanisms implemented through eBPF. In environments relying on eBPF-based networking, observability, or security controls, unexpected use of these operations may indicate defense evasion or runtime tampering.
Read More -
Detects the loading of a Linux kernel module through system calls. Threat actors may leverage Linux kernel modules to load a rootkit on a system providing them with complete control and the ability to hide from security products. As other rules monitor for the addition of Linux kernel modules through system utilities or .ko files, this rule covers the gap that evasive rootkits leverage by monitoring for kernel module additions on the lowest level through auditd_manager.
Read More -
Kernel Module Load from Unusual Location
This rule detects the loading of a kernel module from an unusual location. Threat actors may use this technique to maintain persistence on a system by loading a kernel module into the kernel namespace. This behavior is strongly related to the presence of a rootkit on the system.
Read More -
Kernel Module Load via Built-in Utility
Sep 19, 2026 · Domain: Endpoint OS: Linux Use Case: Threat Detection Tactic: Persistence Tactic: Defense Evasion Threat: Rootkit Data Source: Elastic Defend Resources: Investigation Guide Noise: High Performance: Normal Profile: Aggressive Rule Type: Event Correlation (EQL) Platform: Linux Resources: Osquery ·Detects the use of the insmod binary to load a Linux kernel object file. Threat actors can use this binary, given they have root privileges, to load a rootkit on a system providing them with complete control and the ability to hide from security products. Manually loading a kernel module in this manner should not be at all common and can indicate suspicious or malicious behavior.
Read More