microsoft / microsoft/SysmonForLinux
Add BPF_MAP_FREEZE to perf_event output maps to prevent easily blinding of sysmon
Open
@MarioHewardt is already working on this.
Since Jun 17, 2024.
investigate
- Dominant language
- C
- Stars
- 2.2k
- Forks
- 220
- Avg merge
- 11d 22h
- Merged PRs (30d)
- 2
Description
Currently Sysmon uses a BPF_MAP_TYPE_PERF_EVENT_ARRAY map to send output from eBPF programs back to the user mode Sysmon process. This map can easily be either updated or cleared from other user mode programs, leaving Sysmon unable to see the eBPF programs outputs and makes process activities invisible.
Sysmon can use the BPF_MAP_FREEZE syscall option to freeze these output maps to prevent easily disabling of the map from userspace. However, loaded eBPF programs could still delete the map elements and has no known mitigation yet.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.