Triple Cross eBPF Rootkit Persistence via cron.d or sudoers.d

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•27

Detects the creation of files named "ebpfbackdoor" within the "cron.d" and "sudoers.d" directories. This activity is associated with the TripleCross eBPF rootkit, which uses these locations for persistence.