T1014: eBPF Rootkit Loader (bad-bpf pidhide/sudoadd) Launched From Shell or Mete
Detects the launch of bad-bpf style eBPF rootkit loaders (pidhide with --pid-to-hide, sudoadd with --username) executed via sudo or from an interactive shell parent, representing the userspace step that issues bpf(BPF_PROG_LOAD) before tracepoint hooks go live.
YARA-L
