BPFDoor / AVERAT / Rekoobe IOC Sweep (hashes, domains, IPs)
Detects endpoint and network activity matching known Indicators of Compromise (IOCs) associated with BPFDoor, AVERAT, and Rekoobe backdoors based on Rapid7 research. The query checks for specific file hashes, IP addresses, and domain names across process, file, image load, network, and DNS events.
Microsoft Sentinel (KQL)
