ebpfkit

eBPF feature request for the eBFP foundation. The ability to completely disable eBPF without having to recompile the kernel, ideally in a kernel boot option. e.g. ebpf=0 Why? eBPF can bypass most facets of security controls and exposes potential and future file-less/disk-less vulnerabilities from trusted actors. [1][2][3] [1] - https://github.com/h3xduck/TripleCross [2] - https://github.com/pathtofile/bad-bpf [3] - https://github.com/Gui774ume/ebpfkit

You have also https://github.com/pathtofile/bad-bpf or https://github.com/Gui774ume/ebpfkit which are good references also

More like this: Monitoring component: https://github.com/Gui774ume/ebpfkit-monitor Another rootkit: https://github.com/Gui774ume/ebpfkit

eBPF is amazing because it has such a broad scope and is relatively simple to implement. I'd recommend anyone interested in a starting point look at ebpfkit, the eBPF rootkit. https://github.com/Gui774ume/ebpfkit