Defeating EDR Evading Malware with Memory Forensics
Discover advanced memory forensics techniques to detect and analyze EDR-evading malware, including system call manipulation, module overwriting, and debug register abuse.
Busting Red Team Trends with Style - Building a Custom ETW-Based Sysmon Replacement
Dive into advanced threat hunting with a custom ETW-based Sysmon replacement, exploring enhanced telemetry capabilities for detecting sophisticated red team techniques and threat actor fingerprinting.
HookChain: A New Perspective for Bypassing EDR Solutions
Discover a sophisticated EDR bypass technique combining IAT Hooking, dynamic SSN resolution, and indirect system calls to redirect Windows subsystem execution flow while remaining undetected by traditional security measures.
Making Linux Fly: Towards a Certified Linux Kernel
Explore efforts to create a certified Linux kernel, enhancing reliability and security through formal verification techniques and advanced testing methodologies.
Seccomp Filtering for Struct Pointers
Explore advanced seccomp filtering techniques for struct pointers, enhancing system call security in Linux environments.
kfuncs for BPF LSM Use Cases - Lecture
Explore kfuncs for BPF LSM use cases with experts Liu, Singh, and Bobrowski. Gain insights into advanced Linux security mechanisms and their practical applications.
WALI: A Thin Linux Kernel Interface for WebAssembly
Explore WALI, a thin layer enabling WebAssembly to interact seamlessly with Linux systems, enhancing application portability and security while leveraging existing compiler backends.
Tracking Down Sources of Kernel Errors with Retsnoop
Explore kernel error tracking with retsnoop, a BPF-based tool for efficient debugging and introspection without modifying the kernel or using printk().
eBPF Superpowers - Platform Engineering
Explore eBPF's powerful capabilities for enhancing Linux kernel functionality and revolutionizing networking, security, and observability in modern systems.
Evolution of ptrace from strace's Perspective
Explore ptrace API evolution through strace's lens, examining its usage, missing features, and potential kernel improvements for diagnostic utilities.
Improving Kafka Performance: Switching from ext4 to XFS for 80% Faster Writes
Detailed analysis of Kafka performance optimization, exploring file system impact on latency. Covers Kafka internals, tracing, journaled file systems, and the switch from ext4 to XFS for 80% speed improvement.
Using Seccomp to Limit the Linux Kernel Attack Surface
Explore seccomp for limiting Linux system calls, enhancing application security. Learn implementation, tools, and considerations for effective use in containers, browsers, and more.
The UAPI Kernel API Wishlist
Explore Lennart Poettering's vision for improving the Linux kernel's user-space API, addressing current limitations and proposing enhancements for better system integration.
Seccomp and eBPF: Understanding Container Security and Kernel Access Control
Explore container security hardening through Seccomp and eBPF, comparing their approaches to limiting Linux kernel access and implementing the principle of least privilege in Kubernetes environments.
Windows: Under the Covers - From Hello World to Kernel Mode
Dive into the fascinating journey of how a simple printf() command transforms into pixels on screen, exploring Windows' internal mechanisms and kernel-mode operations.
eBPF for Creating Least Privileged Policies - Implementing Security Through Kernel Monitoring
Discover how eBPF enables least privileged policies through kernel code injection, monitoring system calls, and process execution to enhance security against CVEs with minimal application overhead.
Reinventing Seccomp with eBPF and KRSI for Enhanced Kernel Security
Explore how eBPF and KRSI can enhance Linux kernel security beyond traditional Seccomp capabilities, with practical demonstrations for implementing advanced syscall filtering in containerized environments.
/proc for Security Analysts - Unveiling Threats and Forensic Treasures
Explore Linux's /proc filesystem for security analysis, learning essential techniques for threat detection, process monitoring, and digital forensics in real-world scenarios.
Practical Data-Only Attack Generation Using Einstein - A Dynamic Taint Analysis Approach
Discover how Einstein pipeline uses dynamic taint analysis to generate data-only attacks, scan vulnerable system calls, and create exploits that bypass modern security mitigations in server applications.
Endokernel - A Thread Safe Monitor for Lightweight Subprocess Isolation
Explore how Endokernel achieves secure subprocess isolation through thread-safe monitoring, efficient memory isolation, and systematic policy enforcement for enhanced application security.