Exploring Runtime Security and Forensic using eBPF
summary
Shows how eBPF lives in the kernel, attaches via kprobes and tracepoints, and uses eBPF maps plus the verifier/JIT to inspect system calls for runtime security and forensics. Claims eBPF detects credential abuse, container escapes and syscall hooking by rootkits, and surfaces fileless attacks that use memfd_create demo (running a benign binary in-memory that traditional tracers miss). Includes a working demo and practical hooks to alert or block suspicious kernel-level behaviors.
AI-written summary · about
chapters (9)
- 0:00Start
- 8:41Workload Security
- 15:39System calls
- 18:27Linux kernel architecture
- 24:49Linux Kernel Timeline
- 27:04eBPF Use Cases
- 29:14Kubernetes Security
- 31:37Types of Rootkits
- 38:55Container Fileless Malware in the Wild
related talks
36meBPF for Runtime Security
42mResolving Performance and Security Issues with eBPF
51meBPF Warfare - Detecting Kernel & eBPF Rootkits with Tracee
32mReal Time Security - eBPF for Preventing attacks
40mThreat From The Inside: Investigate eBPF Malware
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
32meBPF: The Next Power Tool of SREs
16mWhy Everyone Should Care About eBPF