[Intel]: https://github.com/snapattack/bpfdoor-scanner

[timb-machine]

Area

Defensive tools

Parent threat

Persistence, Defense Evasion, Command and Control

Finding

https://github.com/snapattack/bpfdoor-scanner

Industry reference

attack:T1036:Masquerading
attack:T1070:Indicator Removal on Host
attack:T1205.002:Socket Filters

Malware reference

BPFDoor
Tricephalic Hellkeeper
Unix.Backdoor.RedMenshen
JustForFun

Actor reference

DecisiveArchitect

Component

No response

Scenario

No response