IronWorm eBPF Rootkit Load by npm or Unexpected Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the deployment of the IronWorm eBPF kernel rootkit by monitoring for unauthorized bpf() syscalls, specifically when invoked by suspicious parent processes such as npm or shells. The rule tracks the loading of eBPF programs, the usage of tools like bpftool, tc, and ip, and the presence of specific file artifacts and indicators associated with rootkit behavior like hiding PIDs or network sockets.