Versions (4)
Version DetailsCurrent
Rev: 5 • May 5, 2026, 12:00 PMET MALWARE BPFDoor ICMP Echo Reply, Heartbeat (Outbound)
alert icmp $HOME_NET any -> any any (msg:"ET MALWARE BPFDoor ICMP Echo Reply, Heartbeat (Outbound)"; xbits:isset,ET.bpfdoor,track ip_src; itype:0; reference:url,rapid7.com/blog/post/tr-new-whitepaper-stealthy-bpfdoor-variants/; reference:url,community.emergingthreats.net/t/sig-bpfdoor-icmpshell-icmp-artifacts-from-rapid7-whitepaper/3271; classtype:command-and-control; sid:2069174; rev:5; metadata:affected_product Linux, attack_target Client_Endpoint, created_at 2026_05_05, deployment Perimeter, malware_family BPFDoor, confidence Medium, signature_severity Major, tag BPF, updated_at 2026_05_14; target:src_ip;)
May 5, 2026, 12:00 PM
May 14, 2026, 12:00 PM
May 6, 2026, 9:34 PM
May 14, 2026, 10:34 PM
rules/emerging-malware.rules