Sandfly users (even free users) can enable the following incident response checks to flag processes running as sniffers. It will easily find #BPFdoor. Here's how in this thread: 
We have checks for sniffer activity in the incident response modules. They are not run by default as they can be noisy at times, but we do have a tuned version that is not noisy. Select the hosts you want scanned, then in sandfly selection use the filter to find "sniffer".
Then select the ones you want run. I suggest using just the tuned version which will ignore some common false positives.
Then submit the scan and wait a bit. We'll agentlessly scan your Linux hosts and report any results like this #BPFDoor. You can see below that BPFDoor is masquerading this time as avahi-daemon, but the real name is "kdmtmpflush".
Fully licensed users can create a custom check to isolate it further to sniffers that are running with deleted process binaries. Customers can contact us for more information. We can do other things as well to broaden the net if you want.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
