reverse engineering malware in a container - part 1

This page cannot be shown here. You can still read it on the original site — the toolbar below keeps your place in the directory.

part of the attack sim from the last post was an eBPF module that provided extended kernel-level monitoring and interference with processes. i thought it would be fun to reverse engineer it in a restricted environment, like a docker container. container the Dockerfile for the container is loaded with analysis tools. FROM ubuntu:20.04 # avoid interactive prompts during installation ENV…

Read on /posts/ebpf-1/ ↗