VoidLink C2 Persistence and Privilege Escalation Behavioral Detection
This rule detects various behaviors associated with the VoidLink threat, focusing on persistence, privilege escalation, and evasion techniques. It identifies suspicious kernel module loading from temporary directories, the presence of hidden rootkit files, container escape attempts, and cloud metadata harvesting. The rule correlates these activities to reduce false positives, specifically looking for combinations such as suspicious module loads with hidden rootkit files or container escapes, container escapes with cloud metadata harvesting, hidden rootkit files with container escapes or cloud metadata harvesting, and eBPF evasion techniques combined with suspicious module loads or hidden rootkit files. The detection logic suggests an adversary attempting to establish persistence, elevate privileges, and potentially exfiltrate cloud credentials within a Linux environment, possibly involving containerized setups.
Sigma
