Practical Guide to eBPF Security Tools: From Detection to Prevention#

1
# falco_to_slack.py - Send Falco alerts to Slack
2
import json
3
import requests
4
from flask import Flask, request
5

6
app = Flask(__name__)
7
SLACK_WEBHOOK = "https://hooks.slack.com/services/YOUR/WEBHOOK/URL"
8

9
@app.route('/falco', methods=['POST'])
10
def handle_falco_alert():
11
    alert = request.json
12

13
    # Parse Falco alert
14
    priority = alert.get('priority', 'INFO')
15
    output = alert.get('output', 'Unknown alert')
16
    rule = alert.get('rule', 'Unknown rule')
17

18
    # Color based on priority
19
    color_map = {
20
        'CRITICAL': '#FF0000',
21
        'WARNING': '#FFA500',
22
        'INFO': '#0000FF'
23
    }
24

25
    # Send to Slack
26
    slack_message = {
27
        "attachments": [{
28
            "color": color_map.get(priority, '#808080'),
29
            "title": f"Falco Alert: {rule}",
30
            "text": output,
31
            "fields": [
32
                {"title": "Priority", "value": priority, "short": True},
33
                {"title": "Rule", "value": rule, "short": True}
34
            ]
35
        }]
36
    }
37

38
    requests.post(SLACK_WEBHOOK, json=slack_message)
39
    return '', 200
40

41
if __name__ == '__main__':
42
    app.run(host='0.0.0.0', port=5000)

1
# network-monitoring.yaml - Monitor suspicious network connections
2
apiVersion: cilium.io/v1alpha1
3
kind: TracingPolicy
4
metadata:
5
  name: network-security-monitoring
6
spec:
7
  kprobes:
8
    - call: "tcp_connect"
9
      syscall: false
10
      args:
11
        - index: 0
12
          type: "sock"
13
      selectors:
14
        - matchArgs:
15
            - index: 0
16
              operator: "NotDPort"
17
              values:
18
                - 80
19
                - 443
20
                - 22
21
          matchActions:
22
            - action: Sigkill
23
              argError: -1
24
        - matchArgs:
25
            - index: 0
26
              operator: "DAddr"
27
              values:
28
                - "10.0.0.0/8"
29
                - "172.16.0.0/12"
30
                - "192.168.0.0/16"
31
          matchActions:
32
            - action: NoPost # Don't kill, just log
33

34
---
35
# file-integrity.yaml - File integrity monitoring
36
apiVersion: cilium.io/v1alpha1
37
kind: TracingPolicy
38
metadata:
39
  name: file-integrity-monitoring
40
spec:
41
  kprobes:
42
    - call: "security_file_open"
43
      syscall: false
44
      args:
45
        - index: 0
46
          type: "file"
47
        - index: 1
48
          type: "int"
49
      selectors:
50
        - matchArgs:
51
            - index: 0
52
              operator: "Prefix"
53
              values:
54
                - "/etc/"
55
                - "/usr/bin/"
56
                - "/usr/sbin/"
57
            - index: 1
58
              operator: "Equal"
59
              values:
60
                - "2" # O_RDWR
61
          matchActions:
62
            - action: Post
63

64
---
65
# process-execution.yaml - Monitor process execution
66
apiVersion: cilium.io/v1alpha1
67
kind: TracingPolicy
68
metadata:
69
  name: process-execution-monitoring
70
spec:
71
  tracepoints:
72
    - subsystem: "sched"
73
      event: "sched_process_exec"
74
      args:
75
        - index: 0
76
          type: "string"
77
      selectors:
78
        - matchArgs:
79
            - index: 0
80
              operator: "In"
81
              values:
82
                - "curl"
83
                - "wget"
84
                - "nc"
85
                - "ncat"
86
                - "socat"
87
          matchBinaries:
88
            - operator: "NotIn"
89
              values:
90
                - "/usr/bin/apt"
91
                - "/usr/bin/yum"
92
          matchActions:
93
            - action: Post
94
              rateLimit: 10 # Max 10 events per second

1
// tetragon-processor/main.go - Process Tetragon events
2
package main
3

4
import (
5
    "encoding/json"
6
    "fmt"
7
    "log"
8
    "os"
9

10
    "github.com/cilium/tetragon/api/v1/tetragon"
11
    "google.golang.org/grpc"
12
)
13

14
type SecurityEvent struct {
15
    Type      string                 `json:"type"`
16
    Timestamp string                 `json:"timestamp"`
17
    Process   map[string]interface{} `json:"process"`
18
    Parent    map[string]interface{} `json:"parent"`
19
    Args      []string              `json:"args"`
20
    Action    string                `json:"action"`
21
}
22

23
func processEvent(event *tetragon.GetEventsResponse) {
24
    switch ev := event.Event.(type) {
25
    case *tetragon.GetEventsResponse_ProcessExec:
26
        handleProcessExec(ev.ProcessExec)
27
    case *tetragon.GetEventsResponse_ProcessExit:
28
        handleProcessExit(ev.ProcessExit)
29
    case *tetragon.GetEventsResponse_ProcessKprobe:
30
        handleKprobeEvent(ev.ProcessKprobe)
31
    }
32
}
33

34
func handleProcessExec(exec *tetragon.ProcessExec) {
35
    // Check for suspicious process execution patterns
36
    binary := exec.Process.Binary
37
    args := exec.Process.Arguments
38

39
    // Detect reverse shell patterns
40
    if isReverseShell(binary, args) {
41
        alert := SecurityEvent{
42
            Type:      "REVERSE_SHELL",
43
            Timestamp: exec.Process.ExecTime.String(),
44
            Process: map[string]interface{}{
45
                "binary": binary,
46
                "pid":    exec.Process.Pid.Value,
47
                "uid":    exec.Process.Uid.Value,
48
            },
49
            Args:   args,
50
            Action: "BLOCKED",
51
        }
52
        sendAlert(alert)
53
    }
54
}
55

56
func isReverseShell(binary string, args []string) bool {
57
    // Implement detection logic
58
    suspiciousBinaries := []string{"nc", "ncat", "socat", "bash", "sh"}
59
    suspiciousArgs := []string{"-e", "-c", "exec", "socket"}
60

61
    for _, b := range suspiciousBinaries {
62
        if binary == b {
63
            for _, arg := range args {
64
                for _, s := range suspiciousArgs {
65
                    if arg == s {
66
                        return true
67
                    }
68
                }
69
            }
70
        }
71
    }
72
    return false
73
}
74

75
func main() {
76
    // Connect to Tetragon
77
    conn, err := grpc.Dial("localhost:54321", grpc.WithInsecure())
78
    if err != nil {
79
        log.Fatal(err)
80
    }
81
    defer conn.Close()
82

83
    client := tetragon.NewFineGuidanceSensorsClient(conn)
84
    stream, err := client.GetEvents(context.Background(), &tetragon.GetEventsRequest{})
85
    if err != nil {
86
        log.Fatal(err)
87
    }
88

89
    // Process events
90
    for {
91
        event, err := stream.Recv()
92
        if err != nil {
93
            log.Printf("Error receiving event: %v", err)
94
            continue
95
        }
96
        processEvent(event)
97
    }
98
}

1
// custom-signature.go - Detect privilege escalation
2
package main
3

4
import (
5
    "fmt"
6
    "github.com/aquasecurity/tracee/signatures/helpers"
7
    "github.com/aquasecurity/tracee/types/detect"
8
    "github.com/aquasecurity/tracee/types/protocol"
9
    "github.com/aquasecurity/tracee/types/trace"
10
)
11

12
type PrivilegeEscalation struct {
13
    cb detect.SignatureHandler
14
}
15

16
func (sig *PrivilegeEscalation) Init(cb detect.SignatureHandler) error {
17
    sig.cb = cb
18
    return nil
19
}
20

21
func (sig *PrivilegeEscalation) GetMetadata() (detect.SignatureMetadata, error) {
22
    return detect.SignatureMetadata{
23
        ID:          "CUSTOM-001",
24
        Version:     "1.0.0",
25
        Name:        "Privilege Escalation Detection",
26
        Description: "Detects potential privilege escalation attempts",
27
        Properties: map[string]interface{}{
28
            "Severity": "Critical",
29
            "Category": "Threat",
30
        },
31
    }, nil
32
}
33

34
func (sig *PrivilegeEscalation) GetSelectedEvents() ([]detect.SignatureEventSelector, error) {
35
    return []detect.SignatureEventSelector{
36
        {Source: "tracee", Name: "sched_process_exec"},
37
        {Source: "tracee", Name: "setuid"},
38
        {Source: "tracee", Name: "setgid"},
39
        {Source: "tracee", Name: "capset"},
40
    }, nil
41
}
42

43
func (sig *PrivilegeEscalation) OnEvent(event protocol.Event) error {
44
    ee, ok := event.Payload.(trace.Event)
45
    if !ok {
46
        return fmt.Errorf("invalid event")
47
    }
48

49
    switch ee.EventName {
50
    case "setuid":
51
        uid, _ := helpers.GetTraceeIntArgumentByName(ee, "uid")
52
        if uid == 0 && ee.ProcessUID != 0 {
53
            // Non-root becoming root
54
            sig.cb(detect.Finding{
55
                SigMetadata: sig.GetMetadata(),
56
                Event:       event,
57
                Data: map[string]interface{}{
58
                    "process": ee.ProcessName,
59
                    "pid":     ee.ProcessID,
60
                    "oldUID":  ee.ProcessUID,
61
                    "newUID":  uid,
62
                },
63
            })
64
        }
65
    }
66

67
    return nil
68
}

1
# tracee_processor.py - Process Tracee JSON output
2
import json
3
import sys
4
from datetime import datetime
5
from elasticsearch import Elasticsearch
6

7
es = Elasticsearch(['localhost:9200'])
8

9
def process_tracee_event(event):
10
    """Process and enrich Tracee events for Elasticsearch"""
11

12
    # Parse event
13
    parsed = {
14
        'timestamp': datetime.utcnow(),
15
        'event_name': event.get('eventName'),
16
        'process': {
17
            'name': event.get('processName'),
18
            'pid': event.get('processId'),
19
            'uid': event.get('uid'),
20
            'binary': event.get('executable', {}).get('path')
21
        },
22
        'container': {
23
            'id': event.get('containerId'),
24
            'name': event.get('containerName')
25
        },
26
        'severity': classify_severity(event),
27
        'raw_event': event
28
    }
29

30
    # Add detection tags
31
    if is_suspicious_event(event):
32
        parsed['tags'] = ['suspicious', 'security']
33
        parsed['severity'] = 'high'
34

35
    return parsed
36

37
def classify_severity(event):
38
    """Classify event severity based on type and context"""
39
    high_severity_events = [
40
        'security_file_open', 'security_task_setuid',
41
        'process_vm_write', 'ptrace'
42
    ]
43

44
    if event.get('eventName') in high_severity_events:
45
        return 'high'
46

47
    if event.get('uid') == 0:  # Root activity
48
        return 'medium'
49

50
    return 'low'
51

52
def is_suspicious_event(event):
53
    """Detect suspicious patterns"""
54
    suspicious_patterns = [
55
        lambda e: e.get('eventName') == 'execve' and '/tmp' in e.get('pathname', ''),
56
        lambda e: e.get('eventName') == 'open' and '/etc/shadow' in e.get('pathname', ''),
57
        lambda e: e.get('processName') in ['nc', 'ncat', 'socat'],
58
    ]
59

60
    return any(pattern(event) for pattern in suspicious_patterns)
61

62
def main():
63
    for line in sys.stdin:
64
        try:
65
            event = json.loads(line)
66
            processed = process_tracee_event(event)
67

68
            # Index to Elasticsearch
69
            es.index(
70
                index=f"tracee-{datetime.utcnow().strftime('%Y.%m.%d')}",
71
                body=processed
72
            )
73

74
            # Alert on high severity
75
            if processed['severity'] == 'high':
76
                send_alert(processed)
77

78
        except json.JSONDecodeError:
79
            continue
80
        except Exception as e:
81
            print(f"Error processing event: {e}", file=sys.stderr)
82

83
if __name__ == '__main__':
84
    main()

1
#!/bin/bash
2
# monitor-ebpf.sh - Monitor eBPF program performance
3

4
# Check BPF program statistics
5
bpftool prog show | grep -E "name|run_time_ns|run_cnt"
6

7
# Monitor map usage
8
for map in $(bpftool map show | grep -E "id" | awk '{print $2}'); do
9
    echo "Map $map:"
10
    bpftool map show id $map
11
    echo "Entries: $(bpftool map dump id $map | wc -l)"
12
    echo "---"
13
done
14

15
# Check for dropped events
16
cat /sys/kernel/debug/tracing/trace_pipe | grep -i "lost"
17

18
# Monitor CPU usage by eBPF programs
19
perf record -e bpf:* -a -g -- sleep 10
20
perf report

1
# eBPF Security Hardening Script
2
#!/bin/bash
3

4
echo "Applying eBPF security hardening..."
5

6
# 1. Disable unprivileged eBPF
7
sysctl -w kernel.unprivileged_bpf_disabled=1
8
echo "kernel.unprivileged_bpf_disabled=1" >> /etc/sysctl.conf
9

10
# 2. Restrict BPF JIT
11
sysctl -w net.core.bpf_jit_harden=2
12
echo "net.core.bpf_jit_harden=2" >> /etc/sysctl.conf
13

14
# 3. Set up audit rules
15
cat >> /etc/audit/rules.d/ebpf.rules <<EOF
16
-a always,exit -F arch=b64 -S bpf -F a0=5 -k ebpf_load
17
-a always,exit -F arch=b64 -S bpf -F a0=6 -k ebpf_attach
18
EOF
19

20
# 4. Configure AppArmor/SELinux
21
# Example AppArmor profile
22
cat > /etc/apparmor.d/ebpf-security <<EOF
23
#include <tunables/global>
24

25
profile ebpf-security flags=(attach_disconnected) {
26
  #include <abstractions/base>
27

28
  capability sys_admin,
29
  capability bpf,
30
  capability perfmon,
31

32
  /sys/kernel/debug/tracing/** r,
33
  /proc/kallsyms r,
34

35
  deny /etc/passwd w,
36
  deny /etc/shadow w,
37
}
38
EOF
39

40
# 5. Set up logging
41
cat >> /etc/rsyslog.d/50-ebpf.conf <<EOF
42
:programname, isequal, "bpf" /var/log/ebpf.log
43
& stop
44
EOF
45

46
systemctl restart rsyslog
47
echo "Hardening complete!"