Attributed metadata history

Offensive eBPF - From Input Events to a Basic bpftrace Keylogger

While the extended Berkeley Packet Filter (eBPF) it is frequently used for performance monitoring and networking, its ability to attach to almost any kernel function makes it a potent tool for security research and, theoretically, for building stealthy surveillance tools like keyloggers. In this post, we will build a keylogger from scratch using bpftrace. We will move from blind reconnaissance to

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.