Offensive BPF: Detection Ideas
Brief
This post is part of a series about Offensive BPF that I’m working on to learn how BPFs use will impact offensive security, malware and detection engineering.
Click the “ebpf” tag to see all relevant posts.
In the last few posts, we talked about a bpftrace and how attackers can use it to their advantage. This post is about my initial ideas and strategies to detecting malicious usage.
Detecting BPF misuse
There are a set of detection ideas for Blue Teams. Since we primarily talked about bpftrace so far, let’s explore that angle.