Tracking Files across the operating system using eBPF
summary
Metal Armor hooks eBPF syscall events to detect file creation and then track renames, moves, deletes, compression/decompression and uploads, tagging sensitive files with embedded IDs (moving toward content hashes). It records lineage on-disk in SQLite, filters by path/IP to save memory/CPU, and can traverse create→rename→compress→upload graphs to attribute cross-host transfers when both endpoints are observed. Built responses include killing or preventing processes, quarantining or uploading files for scanning; practical result: a Shaw/npm malware rule is written and rolled out in ~15 minutes to block spawning infra-wide.
AI-written summary · about
chapters (7)
- 0:00Introduction to Metal Armor
- 1:05Problem and solution overview
- 2:30How Metal Armor works
- 6:06Use cases and responses
- 8:58File tracking with fage
- 16:49Challenges and improvements
- 19:01Q&A session
related talks
40mExploring Runtime Security and Forensic using eBPF
20mThink eBPF for Kernel Security Monitoring
36meBPF for Runtime Security
39mFinding the Needles in a Haystack: Identifying Suspicious Behaviors...
29mRuntime Security at Scale With EBPF: Hybrid Detection and Root Cause…
25mProtecting Modern Workloads with eBPF superpowers
32mReal Time Security - eBPF for Preventing attacks
30mEvasive Maneuvers: Strategies to Overcome Runtime Detection Tools