Adhokshaj Mishra works as Security Research Lead – Detections and Threat Research specializing in Linux and MacOS platforms.
eBPF has been gaining popularity as primary choice for writing various instrumentation and event monitoring tools; because of its comparative simplicity, ability to probe kernel as well as user-space while providing decent safety guarantees (that it will not crash kernel, or deadlock the system etc.).
As a result, a lot of security products have moved to eBPF based telemetry collection, which is then further used to detect security related events, incidents, anomalies etc. The goal of this talk is to explore eBPF in a bit more depth to understand its limitations, as well as how an attacker can evade from eBPF based monitoring; which can provide evasion against multiple tools without having to rely on product specific evasions.