[Intel]: https://unfinished.bike/fun-with-the-new-bpfdoor-2023

[timb-machine]

Area

Malware reports

Parent threat

Defense Evasion

Finding

https://unfinished.bike/fun-with-the-new-bpfdoor-2023

Industry reference

attack:T1205.002:Socket Filters
attack:T1205:Traffic Signaling
uses:BPF
uses:Non-persistentStorage
attack:T1070.006:Timestomp
attack:T1070.004:File Deletion

Malware reference

BPFDoor
/malware/binaries/BPFDoor
wltm

Actor reference

No response

Component

Linux

Scenario

No response