Lesson 1.63: Catching short-lived processes with eBPF
Some attacks never leave a process running: a job starts every two minutes, downloads a script, does its work in three seconds and exits. ps and osquery snapshots almost always miss it. eBPF lets small programs run inside the kernel on events such as 'a program was executed' or 'a file was opened', and the BCC tools use it to print every such event as it happens. In the lab the reporting database sends a little traffic to an unknown address every two minutes. You watch it with execsnoop, opensnoop and tcpconnect, see a customer table being exported, find the job and stop it.
17 min
You will learn to
- Explain why snapshots miss short-lived processes
- Trace every execve with execsnoop
- Trace file opens and TCP connects
- Rebuild a process tree from PIDs and PPIDs
- Confirm a fix by tracing again
Key terms
- eBPF
- Small verified programs that run inside the kernel on events (system calls, tracepoints, network packets).
- BCC tools
- Ready-made eBPF tools; on Ubuntu they're named with -bpfcc (execsnoop-bpfcc).
- execsnoop
- Prints every program execution: command, PID, parent PID, return code, arguments.
- opensnoop
- Prints every file open: PID, command, file descriptor, error, path.
- tcpconnect
- Prints every outgoing TCP connection attempt.
- timeout
- Runs a command for a fixed time, then stops it (exit code 124).
← Shell history and tool artifacts · All lessons · The psychology of social engineering →