How does rupurt detect eBPF-based rootkits?

[bad-antics]

Traditional rootkit scanners miss eBPF rootkits. How does rupurt handle detection of malicious eBPF programs?

[bad-antics]

rupurt uses a dedicated eBPF detection module that works on multiple levels:

1. BPF Program Enumeration
We enumerate all loaded BPF programs via bpf(BPF_PROG_GET_NEXT_ID) and check each against our signature database of known malicious eBPF programs.

2. Hook Point Analysis
rupurt maps which kernel functions have BPF programs attached (kprobes, tracepoints, XDP, tc). Suspicious attachment points include:

• sys_read/sys_write hooks (data exfiltration)
• sys_getdents hooks (file hiding)
• packet_rcv hooks (network backdoors)
• cred_* hooks (privilege escalation)

3. Behavioral Analysis
Even unknown eBPF programs get flagged if they:

• Modify return values of system calls
• Access process credentials structures
• Write to userspace memory from kernel context
• Communicate with userspace via unexpected maps

4. BPF Map Inspection
We dump BPF maps and look for encoded C2 addresses, encryption keys, or hidden PIDs.

This gives us detection capability against rootkits like ebpfkit, TripleCross, and pamspy that traditional scanners completely miss.