Triple Cross eBPF Rootkit Execve Hijack Detection

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•2•0•24

Detects the execution of the 'execve_hijack' component of the Triple Cross eBPF rootkit. This specific file is used by the rootkit to elevate privileges by hijacking the 'execve' system call, often in conjunction with the 'sudo' command.