[Intel]: https://github.com/hardenedvault/ved-ebpf

[timb-machine]

Area

Defensive tools

Parent threat

Execution, Privilege Escalation, Defense Evasion

Finding

https://github.com/hardenedvault/ved-ebpf

Industry reference

attack:T1574:Hijack Execution Flow
attack:T1548.001:Setuid and Setgid
attack:T1620:Reflective Code Loading
attack:T1068:Exploitation for Privilege Escalation
uses:eBPF

Malware reference

No response

Actor reference

No response

Component

Linux

Scenario

No response