Enable BPF Kprobes Tracing
This rule detects attempts to enable BPF kprobes tracing on a Linux system. This is achieved by writing '1' to specific files within the '/sys/kernel/debug/tracing/events/kprobes/' directory, specifically targeting '/myprobe/enable' or '/myretprobe/enable'. This activity can be indicative of an attacker attempting to gain deep system visibility or to implement advanced evasion techniques.
Sigma
