Wazuh Guide Shows How to Detect Suspicious eBPF Activity on Linux

Summary

The guide demonstrates how to use a custom eBPF inventory collector and Wazuh rules to alert on unapproved programs and suspicious attachments associated with credential interception, tracing interference, packet filtering, and blocked connections.

Key points

A custom collector uses bpftool to inventory loaded eBPF programs, their attachments, and program tags, then sends JSON records to Wazuh.
The workflow compares program tags against an approved baseline and alerts on unapproved programs and selected attachment patterns.
Custom rules target probes on PAM libraries, ptrace tracepoints, XDP interfaces, and cgroup connection hooks.
A status rule reports collector errors that could create gaps in eBPF visibility.
The article demonstrates the detections with isolated attack emulations on an Ubuntu test endpoint.
The guide warns that the PAM emulation captures real passwords and that other tests can terminate processes or disrupt network traffic; it recommends using a disposable test endpoint.

Article Details

Defense Focus: Detect suspicious eBPF programs on Linux endpoints by comparing program tags with an approved baseline and alerting on unexpected attachments and collector errors.
Detection Methods: Use a custom collector to inventory loaded eBPF programs and their attachments, comparing program tags against an approved list.
Generate alerts for unapproved programs attached to PAM probes, the ptrace tracepoint, XDP interfaces, and cgroup connect4 hooks; also alert on other programs outside the baseline.
Run the collector every 30 seconds and monitor collector-status errors for potential visibility gaps.
Data Sources: bpftool inventories of loaded programs, links, perf events, network attachments, and cgroup attachments.
Collector JSON records containing program tags, types, names, attachment details, and collection status, written to /var/log/ebpf-inventory.json and forwarded by the Wazuh agent.
Rule Types: Custom Wazuh XML rules using JSON-decoded fields and PCRE2 field matching.
Platforms: Wazuh
Ubuntu 24.04
Defensive Actions: Review loaded eBPF programs before creating the approved tag baseline, and remove any tag that should not be approved.
Verify unexpected program attachments and investigate alerts using their program and attachment details.
Monitor collector errors and investigate them as possible eBPF visibility gaps.
Deploy the collector, configure the Wazuh agent to collect its JSON output, and apply the custom detection rules.
Run attack emulations only on a disposable test endpoint; stop the emulation tools and detach their eBPF programs afterward.