BlackHat Arsenal 2022: Detecting Linux kernel rootkits with Aqua Tracee

A session by Asaf Eitani and Alon Zivony from the Aqua Nautilus research team that was played at BlackHat Arsenal 2022
In this session we discuss:
The tracing methods available in Linux operation systems, as well as what criteria need to be considered when picking one.
What makes eBPF technology to be so great and suitable as a tracing method
Presenting the usage of Aqua Tracee, an open source tool for eBPF runtime security
Most recent research about Linux kernel rootkits along with real-life examples and methods to detect each step in the rootkits attack flow.

[@steverielly]

Well done guys, excellent session!

[@hybridreaverhd]

you can also hide/enumerate rootkits (kernel modules) using their kobj member