Rule Info
Name
MAL_LNX_Scales_EBPF_Rootkit_Jun26
Author
Pierre-Henri Pezier
Description
Detects the presence of the Scales eBPF rootkit, which is a malicious tool used to hide processes and network connections on Linux systems.
Score
80
Reference
Date
2026-06-10
Minimum Yara
3.5.0
Rule Hash
b95d706575b690c80cb7754dd1cefb26
Tags
['LINUX', 'T1014', 'MAL', 'FILE']
Required Modules
[]
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
5
Suspicious (< 10 engines)
15
Clean (0 engines)
8
Rule Matches
Timestamp
Positives
Total
Hash
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR