Dynamic Image Scanning Through System Tracing
Talkat Cloud Native Security Day North America 2020 · on Tuesday, 2020-11-17· at 10:15· Virtual , VIrtual·
summary
Static scanning misses evasive malware that unpacks and executes payloads only at runtime, so dynamic scanning runs images in an ephemeral sandbox and instruments the kernel with eBPF probes to trace behavior. The implementation flags the mmap→mprotect sequence that creates executable memory and raises a memprot alert, then saves the evidence as a captured embedded binary for analysis. This approach finds obfuscated or supply‑chain malware that file‑based scanners overlook.
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:53Trivy Scan
- 2:00Known Vulnerabilities
- 4:05Misconfigurations
- 6:56Real world evasive malware (DzMLT)
- 7:46Software supply chain attacks
- 8:38Static Image Scanning
- 18:31Runtime Security - Shift Left
- 20:15Dynamic scan vs. Runtime security
- 23:15eBPF - Extended Barkley Packet Filter
- 26:56Tracee
- 36:11Summary
related talks
51mFull System Emulation: Achieving Successful Automated Dynamic Analysis of Evasive Malware
28mFileless Attack - Detecting the Undetectable
32mYou Can Run, but You Can't Hide - Finding the Footprints of Hidden Shellcode
23mThe Convergence Of EBPF, Buildroot, And QEMU For Automated Linux Malware Analysis
41mFreeze Drying for Capturing Environment-Sensitive Malware Alive
30mEvasive Maneuvers: Strategies to Overcome Runtime Detection Tools
35mDeep-Kernel Treasure Hunt: Finding exploitable structures in the Linux kernel
30mMicro-Virtualization Memory Tracing to Detect and Prevent Spraying Attacks