BPFDoor
Software · ATTACK:enterprise:S1161
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1161",
"title": "BPFDoor",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1161",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--8d1f89fd-4dde-40ab-80e0-a7b80249162e",
"external_id": "S1161",
"domain": "enterprise",
"created": "2024-09-20T23:08:38.199Z",
"modified": "2026-05-12T15:12:00.737Z",
"version": "1.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Harries JustForFun 2022",
"url": "https://www.crowdstrike.com/blog/how-to-hunt-for-decisivearchitect-and-justforfun-implant/"
},
{
"source_name": "JustForFun"
},
{
"source_name": "Backdoor.Solaris.BPFDOOR.ZAJE"
},
{
"source_name": "Backdoor.Linux.BPFDOOR"
},
{
"source_name": "Merces BPFDOOR 2023",
"url": "https://www.trendmicro.com/en_us/research/23/g/detecting-bpfdoor-backdoor-variants-abusing-bpf-filters.html"
},
{
"source_name": "Deep Instinct BPFDoor 2023",
"url": "https://www.deepinstinct.com/blog/bpfdoor-malware-evolves-stealthy-sniffing-backdoor-ups-its-game"
},
{
"source_name": "Sandfly BPFDoor 2022",
"url": "https://sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/"
}
]
}Explicit source assertions (13)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1161 → uses → ATTACK:enterprise:T1070
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0d76add8-c0f1-44e3-abf2-f6063c43a100
Sandfly BPFDoor 2022ATTACK:enterprise:S1161 → uses → ATTACK:enterprise:T1480.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--19ac2479-ffef-40dc-9dbb-02c11ba49908
Deep Instinct BPFDoor 2023ATTACK:enterprise:S1161 → uses → ATTACK:enterprise:T1480
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1d2b2827-7289-487a-9ea5-b1245ea7448a
Sandfly BPFDoor 2022ATTACK:enterprise:S1161 → uses → ATTACK:enterprise:T1036.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f6db008-885e-4fdf-b5f5-97132c9e96b1
Sandfly BPFDoor 2022ATTACK:enterprise:S1161 → uses → ATTACK:enterprise:T1205.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--698640b5-aa2a-45cf-ad49-2f2b13c5e1ea
Deep Instinct BPFDoor 2023 · Sandfly BPFDoor 2022ATTACK:enterprise:S1161 → uses → ATTACK:enterprise:T1564.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7b979855-6b0e-4230-b940-d57d35787cbf
Deep Instinct BPFDoor 2023ATTACK:enterprise:S1161 → uses → ATTACK:enterprise:T1036.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7dcbc85c-ab95-4b3f-9f4b-c52badc8a46a
Sandfly BPFDoor 2022ATTACK:enterprise:S1161 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9695560f-3cb5-4138-b52a-9ece83f8f778
Sandfly BPFDoor 2022ATTACK:enterprise:S1161 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--99fe6bfd-6199-4a9d-a18b-49c6f7be4074
Sandfly BPFDoor 2022ATTACK:enterprise:S1161 → uses → ATTACK:enterprise:T1059.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a8c03a54-4337-449c-8ef0-d77046eb650f
Sandfly BPFDoor 2022ATTACK:enterprise:S1161 → uses → ATTACK:enterprise:T1686
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ad269937-6339-4686-8f3b-369e0c65afc6
Sandfly BPFDoor 2022ATTACK:enterprise:S1161 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bc1c0019-3072-413f-add4-da266e467edf
Sandfly BPFDoor 2022ATTACK:enterprise:S1161 → uses → ATTACK:enterprise:T1690
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e13b34ab-ba4a-4fc0-9bea-3cd4ed165a57
Sandfly BPFDoor 2022