Sigma rule: BPFDoor Abnormal Process ID or Lock File Accessed

Rule

Title

BPFDoor Abnormal Process ID or Lock File Accessed

Status

test

Level

high

Author

Rafal Piasecki

Date

2022-08-10

Modified

2026-03-30

File

rules/linux/auditd/path/lnx_auditd_bpfdoor_file_accessed.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

detects BPFDoor .lock and .pid files access in temporary file storage facility

Log source

product

linux

service

auditd

Detection

selection:
    type: 'PATH'
    name:
        - /var/run/aepmonend.pid
        - /var/run/auditd.lock
        - /var/run/cma.lock
        - /var/run/console-kit.pid
        - /var/run/consolekit.pid
        - /var/run/daemon.pid
        - /var/run/hald-addon.pid
        - /var/run/hald-smartd.pid
        - /var/run/haldrund.pid
        - /var/run/hp-health.pid
        - /var/run/hpasmlit.lock
        - /var/run/hpasmlited.pid
        - /var/run/kdevrund.pid
        - /var/run/lldpad.lock
        - /var/run/mcelog.pid
        - /var/run/system.pid
        - /var/run/uvp-srv.pid
        - /var/run/vmtoolagt.pid
        - /var/run/xinetd.lock
condition: selection

False positives (as the rule lists them)

• Unlikely

Tags

• attack.execution
• attack.t1106
• attack.t1059

MITRE ATT&CK ids this rule names

• T1059
• T1106

References

• https://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/
• https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor
• https://www.rapid7.com/blog/post/tr-bpfdoor-telecom-networks-sleeper-cells-threat-research-report/
• https://github.com/rapid7/Rapid7-Labs/blob/741c7196ec12a0a56b63463d1fd726ff14d3a97a/BPFDoor/rapid7_detect_bpfdoor.sh

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/auditd/path/lnx_auditd_bpfdoor_file_accessed.yml