Linux Triple Cross eBPF Rootkit TC Filter Install

Danny Y@zendannyy

•updated Jun 20, 2026•0•0•1

Detects install-time commands from the Triple Cross eBPF rootkit deployer that attach a BPF filter to a host NIC via traffic control (tc). The rootkit hijacks execve and other syscalls from kernel space to hide processes, files, and traffic while maintaining C2 access.