BPFtrace Unsafe Option Usage

Title: BPFtrace Unsafe Option Usage
Status: test
Description:Detects the usage of the unsafe bpftrace option
References:
  -https://embracethered.com/blog/posts/2021/offensive-bpf-bpftrace/
  -https://bpftrace.org/
Author: Andreas Hunkeler (@Karneades)
Date: 2022-02-11
modified:None
Tags:

• -'attack.execution'
• -'attack.t1059.004'

Logsource:

• category: process_creation
• product: linux

Detection:
  selection:
    Image|endswith: 'bpftrace'
    CommandLine|contains: '--unsafe'
  condition:selection
Falsepositives:
  -Legitimate usage of the unsafe option
Level: medium