Triple Cross eBPF Rootkit Default LockFile

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects the creation of the file "rootlog" which is used by the TripleCross rootkit as a way to check if the backdoor is already running.