Kernel Hook Points

Kernel Hook Points

KB's eBPF instrumentation layer (kb-core/ebpf/) currently implements six hook points, one per behavioral dimension (see Zone Model And Scoring). Events are emitted into a shared ring buffer for zero-copy delivery to userspace (kbd_sensor).

Implemented Hooks

Hook	Type	Dimension	Weight	Source file
Process lifecycle (fork/exec/exit)	tracepoint:sched	PROCESS	20%	kb_process.bpf.c
Syscall entry	tracepoint:raw_syscalls:sys_enter	SYSCALL	25%	kb_syscall.bpf.c
Credential commit	kprobe:commit_creds	PRIVILEGE	20%	kb_privilege.bpf.c
Sensitive file open	tracepoint:syscalls:sys_enter_openat (LSM planned)	FILE	10%	kb_file.bpf.c
Network connect/bind	tracepoint:syscalls:sys_enter_connect / sys_enter_bind	NETWORK	10%	kb_network.bpf.c
Memory map/protect	tracepoint:syscalls:sys_enter_mmap / sys_enter_mprotect	MEMORY	15%	kb_memory.bpf.c

All six are also combined into a single unified object, kbd_sensor.bpf.c, which is the actual production sensor — the individual per-hook binaries above remain useful for isolated testing/debugging (see kb-core).

Privilege escalation detection

commit_creds is hooked to snapshot uid/gid/euid/cap_effective per-pid and diff against the previous snapshot on every call. An event is only emitted when credentials actually changed; escalation is flagged when new_uid < old_uid or new_euid == 0.

Memory anomaly detection

kb_memory.bpf.c flags:

• RWX mappings (PROT_READ | PROT_WRITE | PROT_EXEC all set) — classic shellcode staging.
• Anonymous + executable mappings.
• W^X violations on mprotect — adding PROT_EXEC to an existing mapping (write-then-execute is a canonical exploit pattern).

Sensitive file surveillance

Currently checks path prefixes for /etc/shadow, /etc/passwd, /etc/sudoers, /root/, and (standalone collector only) /.ssh/. See Event Contract for the exact behavior difference between the standalone collector and the unified sensor.

Proposed Additional Hooks (not yet implemented)

The following were identified as high-value gaps in docs/architecture/hookpoints.md and are tracked as future work, not current behavior:

Process & Execution

• kprobe:do_execveat_common — catches execveat() (exec from file descriptor), a common LOLBin evasion vector
• tracepoint:sched:sched_process_ptrace — ptrace attachment detection (debugger/injection)
• kprobe:kernel_clone — lower-level than sched tracepoints; catches flags like CLONE_NEWUSER

Privilege & Credential

• kprobe:security_capable — fires on every capability check, not just changes
• kprobe:set_user — UID transitions bypassing commit_creds in some paths
• kprobe:override_creds / kprobe:revert_creds — abusable for temporary escalation

Memory & Code Injection

• kprobe:__do_mmap — finer-grained anonymous+exec detection
• uprobe on libc:dlopen — dynamic library injection into running processes
• kprobe:process_vm_writev — direct cross-process memory write (near-exclusively used for injection)

File & Filesystem

• kprobe:vfs_write on /proc/*/mem — writing to another process's memory via procfs
• lsm:inode_rename — file rename tricks (log tampering, binary swapping)
• kprobe:security_inode_create — file creation in sensitive directories (/etc, /bin, /lib)
• lsm:file_open on /etc/passwd, /etc/sudoers, /root/.ssh/ — targeted credential surveillance

Network

• kprobe:tcp_connect — full socket struct including dest IP/port before syscall return
• kprobe:udp_sendmsg — DNS exfiltration / C2-over-UDP that tracepoint:net may miss
• lsm:socket_bind on privileged ports — listener setup by a non-privileged process post-escalation

Kernel Integrity

• kprobe:kallsyms_lookup_name — rootkit symbol-resolution technique
• kprobe:ftrace_set_filter — tampering with KB's own tracing subsystem
• kprobe:module_put / kprobe:try_module_get — LKM reference-count monitoring

Timers & Scheduling (Persistence Detection)

• kprobe:mod_timer — unusual timer registration (persistence callbacks)
• tracepoint:irq:softirq_entry on unusual vectors — deferred-execution tricks

Highest-value gaps flagged in the docs: process_vm_writev, security_capable, do_execveat_common, and the /proc/*/mem write hook — these cover injection and privilege-probing patterns the current hook set leaves partially blind to.

See also: Cross Kernel Portability for how new hooks should be written to remain CO-RE compatible, and kb-core for the build system.