IronWorm Rust Stealer with Tor and eBPF Rootkit Traits
This rule looks for a Rust-based stealer that uses Tor for hiding traffic and low-level Linux hooks associated with IronWorm. This malware targets developers through poisoned packages. Linux build servers are at special risk. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Microsoft Sentinel (KQL)
