BPFDoor Backdoor PID or Lock File Access

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•43

This rule detects access to specific '.lock' and '.pid' files in the '/var/run/' directory, which are known indicators of the BPFDoor backdoor. The rule specifically looks for access to 'haldrund.pid', 'xinetd.lock', and 'kdevrund.pid'.