MALWARE Linux/BPFDoor DNS C2 Magic Value Detected

Tim Peck@timpeck

•updated Dec 8, 2025•1•95

This rule detects DNS Command and Control (C2) activity associated with the Linux/BPFDoor malware. It specifically looks for DNS queries containing a magic value "X:" followed by a dot "." at the beginning of the query, indicating a potential C2 communication channel used by BPFDoor. The rule also includes a byte test to ensure the query length is greater than 20 bytes and a threshold to limit alerts to 3 occurrences within 300 seconds from the same source.