I wrote a new Elastic detection rule to catch eBPF rootkits compiling on-host 🛡️

A new Elastic detection rule has been created to identify eBPF rootkits that are compiling on-host. eBPF, or extended Berkeley Packet Filter, is a powerful tool for observability and networking in Linux, but it has also become a favorite tool for attackers to create rootkits. Most open-source security rules focus on detecting eBPF malware when it loads into the kernel, but this new rule addresses a gap in identifying malware during its compilation stage.

The rule uses Event Query Language (EQL) to monitor process executions on Linux hosts specifically looking for clang being executed with arguments targeting the BPF backend. This approach accounts for various little-endian, big-endian, full target triples, and single-token flag variants that attackers may use. The rule also considers failed attempts where attackers might make typos, as Linux execve still logs these errors. By capturing these syntax errors, the query can detect attackers making mistakes in real-time.

The author of the rule, who is part of the Elastic Security detection-rules repository, noticed the need for this new detection method when attackers use the "Compile After Delivery" technique (T1027.004). Instead of dropping the eBPF object as a .c source code file, attackers compile it on the fly using the local clang toolchain.

To address this, the author submitted a pull request to Elastic (closing issue #6562). Collaboration with the original issue author, who provided a corpus of real-world clang execution logs, helped harden the query and remove blind spots. This open-source security collaboration demonstrates the power of community-driven security efforts.

When Elastic Defend or Auditbeat is running in your environment, keep an eye out for this new rule in an upcoming release.