Techniques › T1205.002 › AN0463
AN0463 Analytic 0463
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Process creates a raw/packet socket and attaches a (e)BPF filter (setsockopt SO_ATTACH_FILTER/ATTACH_BPF or bpf(BPF_PROG_LOAD)). Immediately after a matching inbound packet, the same process binds/connects outward to a remote host (reverse shell or beacon).</p>
- Detects
- T1205.002 Socket Filters
- Part of
- DET0162 Socket-filter trigger → on-host raw-socket activity → reverse connection (T1205.002)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | socket(AF_PACKET|AF_INET, SOCK_RAW, *), setsockopt(… SO_ATTACH_FILTER|SO_ATTACH_BPF …), bpf(cmd=BPF_PROG_LOAD), open/openat path="/dev/bpf*" (BSD/macOS-like) or setcap cap_net_raw. | DC0032 Process Creation |
| linux:osquery | family=AF_PACKET or protocol raw; process name not in allowlist. | DC0082 Network Connection Creation |
| NSM:Flow | Rare inbound packet characteristics (ICMP/UDP/TCP to uncommon port) from src_ip followed ≤TimeWindow by outbound SF from same host to src_ip. | DC0085 Network Traffic Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
UserContext | Flag raw-socket activity outside privileged daemons (root-only by default). |
MinPayloadEntropy | If using packet content (Zeek), treat high-entropy single-packet triggers as suspicious. |
AFPacketAllowList | System services allowed to open AF_PACKET (dhclient, keepalived, LLDP, monitoring agents). |