timb-machine / timb-machine/linux-malware
[Intel]: https://www.form3.tech/engineering/content/bypassing-ebpf-tools
Nobody has claimed this yet.
- Dominant language
- HTML
- Stars
- 1.2k
- Forks
- 95
- PR merge metrics
- No merged PRs in 30d
Description
Area
Offensive techniques
Parent threat
Execution, Privilege Escalation, Defense Evasion
Finding
https://www.form3.tech/engineering/content/bypassing-ebpf-tools
Industry reference
uses:eBPF
attack:T1620:Reflective Code Loading
Malware reference
No response
Actor reference
No response
Component
Linux
Scenario
No response
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked Form3 article about bypassing eBPF tools and review the issue fields for the offensive technique, parent threat, references, and Linux component. Identify where this repository records comparable malware intelligence entries, then add the cited finding with the provided ATT&CK reference and verify it matches the surrounding entry format.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux
- Domain
- operating-systems, security
- Issue type
- Documentation
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100