TripleCross eBPF Rootkit Default LockFile Creation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•22

Detects the creation of the file "/tmp/rootlog" which is used by the TripleCross eBPF rootkit as a way to check if the backdoor is already running. This file acts as a lockfile to prevent multiple instances of the rootkit from running simultaneously.