IronWorm eBPF Rootkit Loaded via npm/node Process to /sys/fs/bpf/

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects the loading of an eBPF rootkit by Node.js or NPM processes. This rule monitors for file creation events within the /sys/fs/bpf/ directory triggered by these processes, which is a known behavior of the IronWorm infostealer attempting to hide processes and network connections.