IronWorm eBPF Rootkit Deployment and Anti-Debug Enforcement (T1014/T1562.001)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects suspicious eBPF activity characteristic of the IronWorm rootkit, including unauthorized pinning of BPF objects, loading of libbpf from non-standard user-writable directories, and malicious anti-debugging enforcement where unauthorized processes terminate security or diagnostic tools.