Fileless Attack - Detecting the Undetectable
summary
A live demo builds a container with a binary that writes and executes code directly in memory using memfd_create and shows it running under an innocuous process name. Detection uses eBPF-based tools: Falco, Tracee, Tetragon; Tracee’s built-in signatures and a Falco rule flag the memfd execution, while a Tetragon tracing policy can auto-kill matching processes. The demo works on default installs but notes evasion paths (other loaders, packed payloads) and differences between tracepoints and kprobes for reliable alerts.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:29Fileless attacks overview
- 5:04Fileless attacks in Linux
- 9:23eBPF for detection
- 12:57Demo with Falco Tetragon Tracee
- 15:49Detecting with Falco
- 18:39Tetragon real-time monitoring
- 22:13Tracee detecting code execution
- 24:38Live demo Tracee detection
- 26:31Detection challenges
- 27:33Conclusion
related talks
30mEvasive Maneuvers: Strategies to Overcome Runtime Detection Tools
40mExploring Runtime Security and Forensic using eBPF
34mHow Clusters Fail Under Attack and How We Detect It at Runtime with eBPF signals
45mThe Container Escape Room: An Exploration of Container Escapes
37mDynamic Image Scanning Through System Tracing
32mYou Can Run, but You Can't Hide - Finding the Footprints of Hidden Shellcode
32mContainer Escape Paths Nobody Monitors: Abusing Linux Debug Interfaces
51meBPF Warfare - Detecting Kernel & eBPF Rootkits with Tracee