Triple Cross eBPF Rootkit Default Persistence — Detection Rule

Detects the creation of "ebpfbackdoor" files in both "cron.d" and "sudoers.d" directories. Which both are related to the TripleCross persistence method

Read the full analysis on IntelFusions