On-host eBPF compilation can be a useful signal for defenders, but it is not proof of a rootkit: legitimate observability, networking, and security software also builds and uses eBPF. Elastic’s title describes a new custom detection rule for this activity, but the reviewed public material does not provide its query, validation results, or alert history. Treat compilation as one stage in an investigation, alongside evidence of BPF program loading, attachment, and suspicious process behavior.
What an on-host compilation alert can tell you
eBPF rootkits abuse Linux’s BPF subsystem. A malicious program may be built on a compromised host and later loaded or attached using tools such as bpftool or a custom loader that invokes BPF system calls. Seeing output-producing compilation may therefore provide an earlier or complementary lead than watching only for a program being loaded.
These are distinct behaviors. A process producing a binary is evidence of build activity; it does not establish that the output is an eBPF program, that it was loaded, or that it is malicious. Conversely, a rootkit need not compile on the compromised machine, and the available sources do not establish one required compiler or build utility.
Correlate compilation with BPF-specific signals
Elastic Security Labs describes several useful monitoring points for activity in the BPF subsystem. Look for them as separate signals and correlate them with the build event, rather than treating any one event as conclusive.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute#1 Best Overall
| Signal | What it can show | How to interpret it |
|---|---|---|
| Output-producing compilation | A process performed build activity that created an output binary. | Useful context for a possible on-host build; not proof that the binary is an eBPF rootkit. Elastic’s prebuilt-rule reference describes a compilation-activity detection that focuses on output-producing activity and filters inspection-only operations. Elastic prebuilt rule reference. |
| BPF map operations | Map creation, lookup, or update behavior in the BPF subsystem. | Review the calling process, account, privilege context, and whether the activity fits expected software. Elastic Security Labs’ rootkit detection guidance. |
| BPF program load or attach | A program is being loaded into, or attached through, the BPF subsystem; activity may involve bpftool or a custom loader. |
Potentially closer to execution than a build event, but still requires context. Elastic’s rule reference also lists BPF program or map activity via bpftool. Elastic prebuilt rule reference. |
| Sensitive helper and kernel-log activity | Use of a sensitive helper such as bpf_probe_write_user, including evidence monitored through kernel logs. |
Investigate alongside process and BPF events; helper use is a signal, not a standalone verdict. Elastic Security Labs’ rootkit detection guidance. |
Elastic Security Labs also gives audit syscall examples covering map creation, lookup and update, program loading, and program attachment. Its guidance emphasizes layered monitoring rather than relying on a single event.
Why legitimate activity can trigger attention
Endpoint security agents, observability products, and networking software can all use eBPF. BPF map activity, program loading, and compilation may be expected on a particular host. Tune detections against the software and workloads in your environment; avoid treating every BPF action or binary-producing build as malicious.
Rank #2
Investigate the surrounding context: process ancestry, the user and privilege level, command and output files, whether the resulting artifact is followed by BPF load or attach behavior, and other host indicators. An alert is an investigative lead, not a verdict.
Check that the host provides the needed telemetry
Confirm that the relevant events are collected and that the fields available to your rule match its assumptions. Elastic documents that Elastic Endpoint uses eBPF for Linux event sourcing on kernel version 5.10.16 and newer; on older kernels it uses tracefs for this event-sourcing data. That implementation detail is not a guarantee that a particular compilation or BPF event is present in every deployment. See the Elastic eBPF repository for the documented implementation.
What is—and is not—publicly established about the new rule
The title identifies a new custom Elastic detection rule aimed at eBPF rootkits compiling on-host. The available public references do not show that rule’s exact definition, metadata, validation results, or alert history, so its query and effectiveness cannot be independently described here. Elastic’s detection-rules repository explains the project’s general role in developing, maintaining, testing, validating, and releasing Detection Engine rules; that does not establish that this specific custom rule was submitted to the repository or passed its checks.
Elastic’s current prebuilt-rule references provide related context—one for output-producing Linux compilation activity and another for BPF program or map activity via bpftool. They are adjacent detections, not evidence that the custom rule described in the title is a prebuilt Elastic rule. Nor do results attributed to other detections on named rootkit examples establish that this compilation rule detected those samples.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
