IronWorm eBPF Rootkit - BPF Load, Debugger Kill, and Process Ghosting

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule monitors for suspicious Linux kernel operations, including the loading of BPF programs via bpftool or system calls, and attempts by debugging or tracing tools to interact with processes using forceful termination signals. It also includes an anomaly detection branch that identifies processes with active network connections that are missing from the system process list, which may indicate process ghosting or hiding techniques.