Triple Cross eBPF Rootkit Install Commands

Title: Triple Cross eBPF Rootkit Install Commands
Status: test
Description:Detects default install commands of the Triple Cross eBPF rootkit based on the "deployer.sh" script
References:
  -https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/apps/deployer.sh
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-05
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1014'

Logsource:

• category: process_creation
• product: linux

Detection:
  selection:
    Image|endswith: '/sudo'
    CommandLine|contains|all:
      -' tc '
      -' enp0s3 '

    CommandLine|contains:
      -' qdisc '
      -' filter '

  condition:selection
Falsepositives:
  -Unlikely
Level: high