Developer submits Elastic detection rule to flag eBPF rootkit compilation on Linux hosts

A developer has submitted a pull request to the Elastic Security detection-rules repository addressing a gap in existing eBPF malware detection. While most current rules monitor for eBPF malware at the kernel-loading stage, this new rule targets an earlier phase — when attackers compile eBPF object files directly on a compromised host using the local Clang toolchain. Written in Elastic's Event Query Language (EQL), the rule monitors Linux process executions where Clang is invoked with arguments targeting the BPF backend, including little-endian, big-endian, and full target triple variants. Notably, the rule also captures failed compilation attempts, since Linux still logs execve calls even when Clang exits with a syntax error, helping defenders catch attackers making mistakes in real time. The pull request closes issue #6562 in the Elastic Security open-source repository.