Sigma rule: Bpfdoor TCP Ports Redirect

Rule

Title

Bpfdoor TCP Ports Redirect

Status

test

Level

medium

Author

Rafal Piasecki

Date

2022-08-10

File

rules/linux/auditd/execve/lnx_auditd_bpfdoor_port_redirect.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

All TCP traffic on particular port from attacker is routed to different port. ex. '/sbin/iptables -t nat -D PREROUTING -p tcp -s 192.168.1.1 --dport 22 -j REDIRECT --to-ports 42392'
The traffic looks like encrypted SSH communications going to TCP port 22, but in reality is being directed to the shell port once it hits the iptables rule for the attacker host only.

Log source

product

linux

service

auditd

Detection

cmd:
    type: 'EXECVE'
    a0|endswith: 'iptables'
    a1: '-t'
    a2: 'nat'
keywords:
    - '--to-ports 42'
    - '--to-ports 43'
condition: cmd and keywords

False positives (as the rule lists them)

• Legitimate ports redirect

Tags

• attack.defense-impairment
• attack.t1686

MITRE ATT&CK ids this rule names

• T1686

References

• https://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/
• https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/auditd/execve/lnx_auditd_bpfdoor_port_redirect.yml