Evasive Maneuvers: Strategies to Overcome Runtime Detection Tools
summary
Explains concrete bypasses against eBPF-based runtime detectors: demonstrates an io_uring-based syscall evasion that creates and reads symlinks without triggering trace hooks, shows using alternative syscalls (open_by_handle_at) and in-memory exec to avoid execve hooks, and performs live demos of tampering eBPF maps to disable agents and event-exhaustion floods that drop alerts. Covers TOCTOU races, killing local agents, overlayfs image fingerprint avoidance, nsenter instead of API calls, and mitigation notes like BPF override return and LSM hooks for harder protection.
AI-written summary · about
chapters (12)
- 0:00Runtime detection tools intro
- 4:36Bypassing via config gaps
- 6:03Evading with symlinks and iouring
- 10:01Alternative system calls and custom implementations
- 11:50Exploiting eBPF maps
- 15:26Killing runtime agents
- 17:12Event exhaustion on eBPF
- 18:39Time-of-check time-of-use vulnerabilities
- 20:47Container filesystem attacks
- 23:55Kubernetes evasion
- 25:40eBPF rootkits
- 27:00Detecting eBPF loads
related talks
40mExploring Runtime Security and Forensic using eBPF
42mResolving Performance and Security Issues with eBPF
41mAPTs Way: Evading Your EBNIDS
34mHow Clusters Fail Under Attack and How We Detect It at Runtime with eBPF signals
28mFileless Attack - Detecting the Undetectable
32mReal Time Security - eBPF for Preventing attacks
51meBPF Warfare - Detecting Kernel & eBPF Rootkits with Tracee
32mContainer Escape Paths Nobody Monitors: Abusing Linux Debug Interfaces