lnx_potential_susp_ebpf_activity

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•28

Detects the presence of "bpf_probe_write_user" BPF helper-generated warning messages. Which could be a sign of suspicious eBPF activity on the system.