Threat From The Inside: Investigate eBPF Malware
summary
eBPF is kernel‑hook code that threat actors use to pseudoadd privilege escalation and to text‑replace hiding cronjob outputs; most real‑world malware still uses classic BPF but researchers are already seeing Linux features ported to Windows. Investigative steps include bpftool prog/map show, dumping JITed assembly and bytecode, extracting embedded ELF blobs with strings+dd, and memory dumps/volatility or BPF‑B3; tracing tools like Tracy detect loads but only prospectively.
AI-written summary · about
chapters (12)
- 0:00Threat from inside
- 1:06What is eBPF
- 6:40eBPF in security
- 8:03Offensive eBPF
- 10:37eBPF malware demo
- 12:23eBPF malware examples
- 17:44Windows eBPF support
- 19:32Investigating with eBPF
- 26:44Investigation techniques
- 27:09Reversing eBPF
- 35:35Reverse engineering
- 35:56Final thoughts
related talks
51meBPF Warfare - Detecting Kernel & eBPF Rootkits with Tracee
40mExploring Runtime Security and Forensic using eBPF
42mResolving Performance and Security Issues with eBPF
36meBPF for Runtime Security
56mAs a wise Chinese man said: good malware uses BPF
29meBPF on the Rise - Getting Started
20mThink eBPF for Kernel Security Monitoring
16mWhy Everyone Should Care About eBPF