Repository Index

Capture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation. Supports Linux and Android on x86_64\arm64 and loong64.

• golang
• ebpf
• tls
• ssl

eBPF-based Security Observability and Runtime Enforcement

• bpf
• ebpf
• kernel
• kubernetes

Kyanos is a networking analysis tool using eBPF. It can visualize the time packets spend in the kernel, capture requests/responses, makes troubleshooting more efficient.

• command-line-tool
• ebpf
• network
• bpf

Packet, where are you? -- eBPF-based Linux kernel networking debugger

• linux
• network
• ebpf
• bpf

eBPF implementation that runs on top of Windows

A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.

• backdoor
• ebpf
• kernel
• rootkit

Learning eBPF, published by O'Reilly - out now! Here's where you'll find a VM config for the examples, and more

• ebpf
• ebpf-co-re
• linux-kernel

Process-aware, eBPF-based tcpdump

• ebpf
• ebpf-tc
• tcpdump
• tcpdump-like

Userspace eBPF VM

ebpfkit is a rootkit powered by eBPF

• ebpf
• security
• rootkit
• linux

lightweight system-level observability for AI Agents

• agent
• ebpf
• llm
• observability

A collection of eBPF programs demonstrating bad behavior, presented at DEF CON 29

Alaz: Advanced eBPF Agent for Kubernetes Observability – Effortlessly monitor K8s service interactions and performance metrics in your K8s environment. Gain in-depth insights with service maps, metrics, and more, while staying alert to crucial system anomalies 🐝

• ddosify
• ebpf
• kubernetes
• metrics

LordOS — a free, fast and secure GNU/Linux distribution based on Debian, with its own desktop environment: display server and Wayland compositor in C, a React UI engine on QuickJS, and private native apps.

• c
• debian
• desktop-environment
• ebpf

Prototyping kernel development work outside mainline

• kernel-modules
• kernel
• xdp
• ebpf-programs

The Linux port of the Sysinternals Sysmon tool.

Sigma Rules Engine inside the Linux Kernel using eBPF. Focusing on prevention capabilities

• ebpf
• security
• linux-kernel
• linux-security-module

🔍 Function-level tracing tool for Seccomp profiling, with eBPF

• ebpf
• ebpf-programs
• golang
• seccomp

bpflock - eBPF driven security for locking and auditing Linux machines

• bpf
• ebpf
• security
• lsm

Generic eBPF runtime

ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits

• linux
• security
• kernel
• rootkit

Red Canary's eBPF Sensor

• ebpf
• sensor
• edr-solutions

eBPF Information Flow Enforcement for AI Agent safety, security and effectiveness

• ebpf
• harness
• ifc
• policy-engine

Sample ebpf programs to analyze

• ebpf
• ebpf-programs
• ebpf-opcode