eBPF-Based-Process-Behavior-Analyzer.sh

#!/bin/bash

# =====================================================================

# Linux Malware Analysis Toolkit #1: eBPF-Based Process Behavior Analyzer

# =====================================================================

#

# Description:

# This script utilizes eBPF technology to monitor and analyze process

# behavior in real-time, helping to detect potentially malicious

# activities on Linux systems.

#

# Options:

# 1. Trace system calls by specific process

# 2. Monitor file access activities

# 3. Track network connections

# 4. Detect process execution chains

# 5. Analyze memory mapping operations

# 6. Trace process capabilities changes

# 7. Monitor namespace transitions

# 8. Detect unexpected syscall patterns

# 9. Track process privilege escalation

# 10. Monitor inter-process communications

# 11. Log process credential changes

# 12. Profile process resource usage

# 13. Detect process injection attempts

# 14. Monitor filesystem operations

# 15. Track container escape attempts

# 16. Analyze loaded kernel modules

# 17. Monitor bpf() syscall usage

# 18. Detect hidden process techniques

# 19. Track unauthorized file access attempts

# 20. Monitor syscall argument tampering

#

# Requirements:

# - Linux kernel 4.18+ for full functionality

# - bpftrace installed

# - bcc tools installed

# - root privileges

#

# =====================================================================

set -e

trap 'echo -e "\n[!] Script interrupted. Cleaning up..."; cleanup; exit 1' INT

# Text colors

RED='\033[0;31m'

GREEN='\033[0;32m'

YELLOW='\033[0;33m'

BLUE='\033[0;34m'

PURPLE='\033[0;35m'

NC='\033[0m' # No Color

# Verify required tools

check_requirements() {

echo -e "${BLUE}[*] Checking requirements...${NC}"



if [ "$(id -u)" -ne 0 ]; then

echo -e "${RED}[!] This script must be run as root${NC}"

exit 1

fi



local kernel_version=$(uname -r | cut -d. -f1,2)

if (( $(echo "$kernel_version < 4.18" | bc -l) )); then

echo -e "${YELLOW}[!] Warning: Some features may not work on kernel
$kernel_version (4.18+ recommended)${NC}"

fi



for cmd in bpftrace timeout jq ps grep awk; do

if ! command -v $cmd &> /dev/null; then

echo -e "${RED}[!] Required tool not found: $cmd${NC}"

echo -e "${YELLOW}[*] Please install missing dependencies and try again${NC}"

exit 1

fi

done



if ! command -v bcc-tools &> /dev/null && ! [ -d "/usr/share/bcc/tools" ]; then

echo -e "${YELLOW}[!] BCC tools not found. Some features may be limited.${NC}"

echo -e "${YELLOW}[*] Install BCC tools for full functionality${NC}"

fi



echo -e "${GREEN}[+] All requirements satisfied${NC}"

}

cleanup() {

# Kill any running bpftrace or BCC processes

pkill -f bpftrace &>/dev/null || true

echo -e "${GREEN}[+] Cleanup completed${NC}"

}

# Option 1: Trace system calls by specific process

trace_syscalls() {

echo -e "${BLUE}[*] Trace system calls by process${NC}"

read -p "Enter PID or process name to trace (leave empty to trace all): " target

read -p "Enter duration in seconds (default: 30): " duration

duration=${duration:-30}



echo -e "${GREEN}[+] Tracing syscalls for ${target:-all processes} for $duration
seconds...${NC}"



if [ -z "$target" ]; then

timeout $duration bpftrace -e 'tracepoint:syscalls:sys_enter_* { @[probe, comm,
pid] = count(); }' 2>/dev/null

elif [[ "$target" =~ ^[0-9]+$ ]]; then

timeout $duration bpftrace -e "tracepoint:syscalls:sys_enter_* /pid == $target/
{ @[probe, comm, pid] = count(); }" 2>/dev/null

else

timeout $duration bpftrace -e "tracepoint:syscalls:sys_enter_* /comm ==
\"$target\"/ { @[probe, comm, pid] = count(); }" 2>/dev/null

fi



echo -e "${GREEN}[+] Syscall tracing completed${NC}"

}

# Option 2: Monitor file access activities

monitor_file_access() {

echo -e "${BLUE}[*] Monitor file access activities${NC}"

read -p "Enter directory to monitor (default: /etc): " directory

directory=${directory:-/etc}

read -p "Enter duration in seconds (default: 30): " duration

duration=${duration:-30}



echo -e "${GREEN}[+] Monitoring file access in $directory for $duration
seconds...${NC}"



timeout $duration bpftrace -e "

#include



tracepoint:syscalls:sys_enter_openat {

\$filename = str(args->filename);

if (\$filename != 0 && strncmp(\$filename, \"$directory\", ${#directory}) == 0)
{

printf(\"PID: %-6d COMM: %-15.15s UID: %-6d GID: %-6d | OPEN: %s\\n\",

pid, comm, uid, gid, \$filename);

}

}



tracepoint:syscalls:sys_enter_read /arg0 > 0/ {

@reads[pid, comm] = count();

}



tracepoint:syscalls:sys_enter_write /arg0 > 0/ {

@writes[pid, comm] = count();

}



interval:s:5 {

printf(\"\\n--- Read/Write Summary (5s) ---\\n\");

print(@reads, \"\\nReads by Process:\\n\");

print(@writes, \"\\nWrites by Process:\\n\");

clear(@reads);

clear(@writes);

}

" 2>/dev/null



echo -e "${GREEN}[+] File access monitoring completed${NC}"

}

# Option 3: Track network connections

track_network_connections() {

echo -e "${BLUE}[*] Track network connections${NC}"

read -p "Enter process name to monitor (leave empty for all): " process

read -p "Enter duration in seconds (default: 30): " duration

duration=${duration:-30}



echo -e "${GREEN}[+] Tracking network connections for ${process:-all processes}
for $duration seconds...${NC}"



if [ -z "$process" ]; then

filter=""

else

filter="/comm == \"$process\"/"

fi



timeout $duration bpftrace -e "

#include

#include



kprobe:tcp_connect $filter {

\$sk = (struct sock *)arg0;

\$inet_family = \$sk->__sk_common.skc_family;



if (\$inet_family == AF_INET || \$inet_family == AF_INET6) {

\$daddr = ntop(\$inet_family, \$sk->__sk_common.skc_daddr);

\$dport = \$sk->__sk_common.skc_dport;

\$saddr = ntop(\$inet_family, \$sk->__sk_common.skc_rcv_saddr);

\$sport = \$sk->__sk_common.skc_num;



printf(\"PID: %-6d COMM: %-15.15s UID: %-6d | CONNECT: %s:%d -> %s:%d\\n\",

pid, comm, uid, \$saddr, \$sport, \$daddr, \$dport);

}

}



kprobe:tcp_accept $filter {

\$sk = (struct sock *)arg0;

\$inet_family = \$sk->__sk_common.skc_family;



if (\$inet_family == AF_INET || \$inet_family == AF_INET6) {

\$daddr = ntop(\$inet_family, \$sk->__sk_common.skc_daddr);

\$dport = \$sk->__sk_common.skc_dport;

\$saddr = ntop(\$inet_family, \$sk->__sk_common.skc_rcv_saddr);

\$sport = \$sk->__sk_common.skc_num;



printf(\"PID: %-6d COMM: %-15.15s UID: %-6d | ACCEPT: %s:%d <- %s:%d\\n\",

pid, comm, uid, \$saddr, \$sport, \$daddr, \$dport);

}

}

" 2>/dev/null



echo -e "${GREEN}[+] Network connection tracking completed${NC}"

}

# Option 4: Detect process execution chains

detect_process_chains() {

echo -e "${BLUE}[*] Detect process execution chains${NC}"

read -p "Enter duration in seconds (default: 30): " duration

duration=${duration:-30}



echo -e "${GREEN}[+] Monitoring process execution chains for $duration
seconds...${NC}"



timeout $duration bpftrace -e "

tracepoint:syscalls:sys_enter_execve,

tracepoint:syscalls:sys_enter_execveat {

printf(\"TIME: %-8llu PID: %-6d PPID: %-6d UID: %-6d GID: %-6d | EXEC: %s\\n\",

nsecs, pid, curtask->real_parent->tgid, uid, gid, comm);



printf(\" ARGS: \");

\$argp = args->argv;

\$i = 0;

\$arg = user_string(\$argp);

while (\$arg != 0 && \$i < 5) {

printf(\"%s \", \$arg);

\$argp++;

\$arg = user_string(\$argp);

\$i++;

}

if (\$i >= 5) {

printf(\"...\");

}

printf(\"\\n\");



@execution_chains[curtask->real_parent->comm, comm] = count();

}



interval:s:5 {

printf(\"\\n--- Process Execution Chain Summary (5s) ---\\n\");

printf(\"%-20s -> %-20s | Count\\n\", \"Parent Process\", \"Child Process\");

print(@execution_chains);

}

" 2>/dev/null



echo -e "${GREEN}[+] Process chain detection completed${NC}"

}

# Option 5: Analyze memory mapping operations

analyze_memory_mappings() {

echo -e "${BLUE}[*] Analyze memory mapping operations${NC}"

read -p "Enter PID to monitor (leave empty for all): " target_pid

read -p "Enter duration in seconds (default: 30): " duration

duration=${duration:-30}



if [ -z "$target_pid" ]; then

pid_filter=""

else

pid_filter="/pid == $target_pid/"

fi



echo -e "${GREEN}[+] Analyzing memory mapping operations for ${target_pid:-all
processes} for $duration seconds...${NC}"



timeout $duration bpftrace -e "

#include



tracepoint:syscalls:sys_enter_mmap $pid_filter {

printf(\"PID: %-6d COMM: %-15.15s | MMAP: addr=0x%lx len=%lu prot=%d flags=%d
fd=%d off=%lu\\n\",

pid, comm, args->addr, args->len, args->prot, args->flags, args->fd,
args->offset);

}



tracepoint:syscalls:sys_enter_mprotect $pid_filter {

printf(\"PID: %-6d COMM: %-15.15s | MPROTECT: addr=0x%lx len=%lu prot=%d\\n\",

pid, comm, args->addr, args->len, args->prot);

}



kprobe:security_mmap_file $pid_filter {

\$file = (struct file *)arg0;

\$prot = arg1;

\$flags = arg2;



if (\$file != 0) {

\$pathname = \$file->f_path.dentry->d_name.name;

if (\$pathname != 0) {

\$name = str(\$pathname);

printf(\"PID: %-6d COMM: %-15.15s | MMAP FILE: %s (prot=%d, flags=%d)\\n\",

pid, comm, \$name, \$prot, \$flags);



if ((\$prot & 0x4) && (\$prot & 0x1)) { // PROT_EXEC | PROT_READ

printf(\" [ALERT] Executable memory mapping detected!\\n\");

}

}

}

}



tracepoint:syscalls:sys_enter_memfd_create $pid_filter {

printf(\"PID: %-6d COMM: %-15.15s | MEMFD_CREATE: name=%s flags=%d\\n\",

pid, comm, str(args->uname), args->flags);

printf(\" [ALERT] Possible fileless execution technique!\\n\");

}

" 2>/dev/null



echo -e "${GREEN}[+] Memory mapping analysis completed${NC}"

}

# Option 6: Trace process capabilities changes

trace_capabilities() {

echo -e "${BLUE}[*] Trace process capabilities changes${NC}"

read -p "Enter duration in seconds (default: 30): " duration

duration=${duration:-30}



echo -e "${GREEN}[+] Tracing capability changes for $duration seconds...${NC}"



timeout $duration bpftrace -e "

tracepoint:syscalls:sys_enter_capset {

printf(\"PID: %-6d COMM: %-15.15s UID: %-6d | CAPSET: header->pid=%d\\n\",

pid, comm, uid, args->header->pid);

}



kprobe:cap_capable {

\$cap_id = arg1;

\$cap_name = \"UNKNOWN\";



if (\$cap_id == 0) { \$cap_name = \"CAP_CHOWN\"; }

else if (\$cap_id == 1) { \$cap_name = \"CAP_DAC_OVERRIDE\"; }

else if (\$cap_id == 2) { \$cap_name = \"CAP_DAC_READ_SEARCH\"; }

else if (\$cap_id == 3) { \$cap_name = \"CAP_FOWNER\"; }

else if (\$cap_id == 4) { \$cap_name = \"CAP_FSETID\"; }

else if (\$cap_id == 5) { \$cap_name = \"CAP_KILL\"; }

else if (\$cap_id == 6) { \$cap_name = \"CAP_SETGID\"; }

else if (\$cap_id == 7) { \$cap_name = \"CAP_SETUID\"; }

else if (\$cap_id == 8) { \$cap_name = \"CAP_SETPCAP\"; }

else if (\$cap_id == 12) { \$cap_name = \"CAP_NET_ADMIN\"; }

else if (\$cap_id == 13) { \$cap_name = \"CAP_NET_RAW\"; }

else if (\$cap_id == 14) { \$cap_name = \"CAP_IPC_LOCK\"; }

else if (\$cap_id == 16) { \$cap_name = \"CAP_SYS_MODULE\"; }

else if (\$cap_id == 17) { \$cap_name = \"CAP_SYS_RAWIO\"; }

else if (\$cap_id == 18) { \$cap_name = \"CAP_SYS_CHROOT\"; }

else if (\$cap_id == 19) { \$cap_name = \"CAP_SYS_PTRACE\"; }

else if (\$cap_id == 21) { \$cap_name = \"CAP_SYS_ADMIN\"; }

else if (\$cap_id == 23) { \$cap_name = \"CAP_SYS_TIME\"; }

else if (\$cap_id == 24) { \$cap_name = \"CAP_SYS_RESOURCE\"; }

else if (\$cap_id == 25) { \$cap_name = \"CAP_SYS_BOOT\"; }



printf(\"PID: %-6d COMM: %-15.15s UID: %-6d | CAP CHECK: %s (%d)\\n\",

pid, comm, uid, \$cap_name, \$cap_id);



if (\$cap_id == 16 || \$cap_id == 21 || \$cap_id == 19) {

printf(\" [ALERT] Sensitive capability check detected!\\n\");

}



@cap_usage[comm, \$cap_name] = count();

}



interval:s:5 {

printf(\"\\n--- Capability Usage Summary (5s) ---\\n\");

print(@cap_usage);

}

" 2>/dev/null



echo -e "${GREEN}[+] Capability tracing completed${NC}"

}

# Option 7: Monitor namespace transitions

monitor_namespaces() {

echo -e "${BLUE}[*] Monitor namespace transitions${NC}"

read -p "Enter duration in seconds (default: 30): " duration

duration=${duration:-30}



echo -e "${GREEN}[+] Monitoring namespace transitions for $duration
seconds...${NC}"



timeout $duration bpftrace -e "

tracepoint:syscalls:sys_enter_unshare,

tracepoint:syscalls:sys_enter_setns {

printf(\"TIME: %-8llu PID: %-6d PPID: %-6d COMM: %-15.15s | NAMESPACE OPERATION:
%s\\n\",

nsecs, pid, curtask->real_parent->tgid, comm, probe);



if (comm != \"docker\" && comm != \"containerd\" &&

comm != \"runc\" && comm != \"systemd\" &&

comm != \"lxc\" && comm != \"podman\") {

printf(\" [ALERT] Potential container escape attempt: unexpected namespace
operation by %s\\n\", comm);

}

}



kprobe:switch_task_namespaces {

printf(\"PID: %-6d COMM: %-15.15s | SWITCH NAMESPACE\\n\", pid, comm);

}

" 2>/dev/null



echo -e "${GREEN}[+] Namespace monitoring completed${NC}"

}

# Option 8: Detect unexpected syscall patterns

detect_syscall_patterns() {

echo -e "${BLUE}[*] Detect unexpected syscall patterns${NC}"

read -p "Enter duration in seconds (default: 30): " duration

duration=${duration:-30}



echo -e "${GREEN}[+] Detecting unusual syscall patterns for $duration
seconds...${NC}"



timeout $duration bpftrace -e "

BEGIN {

printf(\"Monitoring for suspicious syscall patterns...\\n\");

}



// Detect ptrace syscall (often used for process manipulation)

tracepoint:syscalls:sys_enter_ptrace {

printf(\"[ALERT] PID: %-6d COMM: %-15.15s UID: %-6d | PTRACE detected:
request=%d pid=%d\\n\",

pid, comm, uid, args->request, args->pid);

}



// Monitor process hiding techniques

tracepoint:syscalls:sys_enter_kill /args->sig == 0/ {

@proc_check[pid, comm] = count();

}



// Detect potential shellcode execution patterns

tracepoint:syscalls:sys_enter_mprotect /args->prot & 0x4/ { // PROT_EXEC

@mprotect_exec[pid, comm] = count();

printf(\"PID: %-6d COMM: %-15.15s | MPROTECT with EXEC permissions: addr=0x%lx
len=%lu\\n\",

pid, comm, args->addr, args->len);

}



tracepoint:syscalls:sys_enter_mmap /args->prot & 0x4/ { // PROT_EXEC

@mmap_exec[pid, comm] = count();

if (args->flags & 0x20) { // MAP_ANONYMOUS

printf(\"[ALERT] PID: %-6d COMM: %-15.15s | Anonymous executable memory mapping
detected!\\n\",

pid, comm);

}

}



// Detect suspicious file operations in /proc

tracepoint:syscalls:sys_enter_openat /strncmp(str(args->filename), \"/proc\", 5)
== 0/ {

@proc_access[pid, comm, str(args->filename)] = count();



if (strncmp(str(args->filename), \"/proc/self/mem\", 14) == 0) {

printf(\"[ALERT] PID: %-6d COMM: %-15.15s | Suspicious access to
/proc/self/mem\\n\",

pid, comm);

}

}



// Detect attempts to load kernel modules

tracepoint:syscalls:sys_enter_init_module,

tracepoint:syscalls:sys_enter_finit_module {

printf(\"[ALERT] PID: %-6d COMM: %-15.15s UID: %-6d | Kernel module operation
detected!\\n\",

pid, comm, uid);

}



interval:s:5 {

printf(\"\\n--- Suspicious Syscall Summary (5s) ---\\n\");



printf(\"\\nExecutable Memory Mappings:\\n\");

print(@mmap_exec);



printf(\"\\nExecutable Memory Protection Changes:\\n\");

print(@mprotect_exec);



printf(\"\\nProcess Status Checks (possible process hiding):\\n\");

print(@proc_check);



printf(\"\\n/proc Filesystem Access Patterns:\\n\");

print(@proc_access);

}

" 2>/dev/null



echo -e "${GREEN}[+] Syscall pattern detection completed${NC}"

}

# Option 9: Track process privilege escalation

track_privilege_escalation() {

echo -e "${BLUE}[*] Track process privilege escalation${NC}"

read -p "Enter duration in seconds (default: 30): " duration

duration=${duration:-30}



echo -e "${GREEN}[+] Monitoring privilege escalation attempts for $duration
seconds...${NC}"



timeout $duration bpftrace -e "

// Track set*uid/set*gid syscalls

tracepoint:syscalls:sys_enter_setuid,

tracepoint:syscalls:sys_enter_setgid,

tracepoint:syscalls:sys_enter_setreuid,

tracepoint:syscalls:sys_enter_setregid,

tracepoint:syscalls:sys_enter_setresuid,

tracepoint:syscalls:sys_enter_setresgid {

printf(\"TIME: %-8llu PID: %-6d COMM: %-15.15s UID: %-6d | %s\\n\",

nsecs, pid, comm, uid, probe);



if (uid != 0) {

printf(\" [ALERT] Non-root process attempting privilege change!\\n\");

}

}



// Track successful UID/GID changes

tracepoint:syscalls:sys_exit_setuid,

tracepoint:syscalls:sys_exit_setgid,

tracepoint:syscalls:sys_exit_setreuid,

tracepoint:syscalls:sys_exit_setregid,

tracepoint:syscalls:sys_exit_setresuid,

tracepoint:syscalls:sys_exit_setresgid /args->ret == 0/ {

printf(\"PID: %-6d COMM: %-15.15s | %s succeeded\\n\",

pid, comm, probe);

}



// Monitor privileged file access

tracepoint:syscalls:sys_enter_open,

tracepoint:syscalls:sys_enter_openat {

\$filename = str(args->filename);



if (\$filename != 0) {

if (strncmp(\$filename, \"/etc/passwd\", 11) == 0 ||

strncmp(\$filename, \"/etc/shadow\", 11) == 0 ||

strncmp(\$filename, \"/etc/sudoers\", 12) == 0) {

printf(\"PID: %-6d COMM: %-15.15s UID: %-6d | Accessing sensitive file: %s\\n\",

pid, comm, uid, \$filename);



if (strncmp(\$filename, \"/etc/shadow\", 11) == 0 && uid != 0) {

printf(\" [ALERT] Non-root process accessing shadow password file!\\n\");

}

}

}

}



// Track sudo/su execution

tracepoint:syscalls:sys_enter_execve,

tracepoint:syscalls:sys_enter_execveat {

\$argp = args->argv;

\$arg0 = user_string(\$argp);



if (\$arg0 != 0) {

if (strncmp(\$arg0, \"/usr/bin/sudo\", 13) == 0 ||

strncmp(\$arg0, \"/bin/sudo\", 9) == 0 ||

strncmp(\$arg0, \"/usr/bin/su\", 11) == 0 ||

strncmp(\$arg0, \"/bin/su\", 7) == 0) {

printf(\"PID: %-6d COMM: %-15.15s UID: %-6d | Privilege escalation tool:
%s\\n\",

pid, comm, uid, \$arg0);



\$i = 1;

\$argp++;

\$arg = user_string(\$argp);

printf(\" Command: %s\", \$arg0);

while (\$arg != 0 && \$i < 10) {

printf(\" %s\", \$arg);

\$argp++;

\$arg = user_string(\$argp);

\$i++;

}

if (\$i >= 10) {

printf(\" ...\");

}

printf(\"\\n\");

}

}

}

" 2>/dev/null



echo -e "${GREEN}[+] Privilege escalation monitoring completed${NC}"

}

# Option 10: Monitor inter-process communications

monitor_ipc() {

echo -e "${BLUE}[*] Monitor inter-process communications${NC}"

read -p "Enter duration in seconds (default: 30): " duration

duration=${duration:-30}



echo -e "${GREEN}[+] Monitoring IPC mechanisms for $duration seconds...${NC}"



timeout $duration bpftrace -e "

// Track socket communications

tracepoint:syscalls:sys_enter_socket,

tracepoint:syscalls:sys_enter_socketpair {

printf(\"PID: %-6d COMM: %-15.15s | SOCKET: domain=%d type=%d protocol=%d\\n\",

pid, comm, args->family, args->type, args->protocol);



if (args->family == 1) { // AF_UNIX

@unix_sockets[pid, comm] = count();

}

}



// Track shared memory operations

tracepoint:syscalls:sys_enter_shmget,

tracepoint:syscalls:sys_enter_shmat,

tracepoint:syscalls:sys_enter_shmdt,

tracepoint:syscalls:sys_enter_shmctl {

printf(\"PID: %-6d COMM: %-15.15s | SHARED MEMORY: %s\\n\",

pid, comm, probe);

@shm_ops[pid, comm, probe] = count();

}



// Track message queues

tracepoint:syscalls:sys_enter_msgget,

tracepoint:syscalls:sys_enter_msgsnd,

tracepoint:syscalls:sys_enter_msgrcv,

tracepoint:syscalls:sys_enter_msgctl {

printf(\"PID: %-6d COMM: %-15.15s | MESSAGE QUEUE: %s\\n\",

pid, comm, probe);

@msg_ops[pid, comm, probe] = count();

}



// Track named pipes

tracepoint:syscalls:sys_enter_mkfifo {

printf(\"PID: %-6d COMM: %-15.15s | CREATE NAMED PIPE: %s\\n\",

pid, comm, str(args->pathname));

}



// Track pipe creation

tracepoint:syscalls:sys_enter_pipe,

tracepoint:syscalls:sys_enter_pipe2 {

printf(\"PID: %-6d COMM: %-15.15s | CREATE PIPE\\n\", pid, comm);

@pipe_create[pid, comm] = count();

}



// Monitor memfd communication (often used in fileless malware)

tracepoint:syscalls:sys_enter_memfd_create {

printf(\"PID: %-6d COMM: %-15.15s | MEMFD_CREATE: name=%s flags=%d\\n\",

pid, comm, str(args->uname), args->flags);

printf(\" [ALERT] Potential fileless malware technique detected!\\n\");

}



interval:s:5 {

printf(\"\\n--- IPC Summary (5s) ---\\n\");



printf(\"\\nUNIX Socket Usage:\\n\");

print(@unix_sockets);



printf(\"\\nShared Memory Operations:\\n\");

print(@shm_ops);



printf(\"\\nMessage Queue Operations:\\n\");

print(@msg_ops);



printf(\"\\nPipe Creation:\\n\");

print(@pipe_create);

}

" 2>/dev/null



echo -e "${GREEN}[+] IPC monitoring completed${NC}"

}

# Option 11: Log process credential changes

log_credential_changes() {

echo -e "${BLUE}[*] Log process credential changes${NC}"

read -p "Enter duration in seconds (default: 30): " duration

duration=${duration:-30}



echo -e "${GREEN}[+] Monitoring credential changes for $duration
seconds...${NC}"



timeout $duration bpftrace -e "

// Track all credential change functions

kprobe:commit_creds {

printf(\"PID: %-6d COMM: %-15.15s | CREDENTIAL CHANGE\\n\", pid, comm);



// Get the new credentials structure

\$cred = (struct cred *)arg0;

if (\$cred != 0) {

printf(\" New UID: %d GID: %d EUID: %d EGID: %d\\n\",

\$cred->uid.val, \$cred->gid.val,

\$cred->euid.val, \$cred->egid.val);



// Alert on certain patterns

if ((\$cred->uid.val == 0 || \$cred->euid.val == 0) && uid != 0) {

printf(\" [ALERT] Process gained root credentials from non-root context!\\n\");

}

}

}



// Track security operations related to credentials

kprobe:security_task_fix_setuid {

printf(\"PID: %-6d COMM: %-15.15s | SECURITY CHECK: task_fix_setuid\\n\",

pid, comm);

}



// Track capabilities that might be assigned

kprobe:cap_bprm_set_creds {

printf(\"PID: %-6d COMM: %-15.15s | CAPABILITY ASSIGNMENT during execve\\n\",

pid, comm);

}



// Track changes to process security context (SELinux)

kprobe:security_task_setpgid,

kprobe:security_task_kill {

printf(\"PID: %-6d COMM: %-15.15s | SECURITY CONTEXT OPERATION: %s\\n\",

pid, comm, probe);

}

" 2>/dev/null



echo -e "${GREEN}[+] Credential change monitoring completed${NC}"

}

# Option 12: Profile process resource usage

profile_resource_usage() {

echo -e "${BLUE}[*] Profile process resource usage${NC}"

read -p "Enter PID to monitor (leave empty for all): " target_pid

read -p "Enter duration in seconds (default: 30): " duration

duration=${duration:-30}



if [ -z "$target_pid" ]; then

pid_filter=""

else

pid_filter="/pid == $target_pid/"

fi



echo -e "${GREEN}[+] Profiling resource usage for ${target_pid:-all processes}
for $duration seconds...${NC}"



timeout $duration bpftrace -e "

// Track CPU usage by sampling

profile:hz:99 $pid_filter {

@cpu[pid, comm] = count();

}



// Track I/O operations

tracepoint:syscalls:sys_enter_read,

tracepoint:syscalls:sys_enter_pread64,

tracepoint:syscalls:sys_enter_readv $pid_filter {

@reads[pid, comm] = count();

@read_bytes[pid, comm] = sum(args->count);

}



tracepoint:syscalls:sys_enter_write,

tracepoint:syscalls:sys_enter_pwrite64,

tracepoint:syscalls:sys_enter_writev $pid_filter {

@writes[pid, comm] = count();

@write_bytes[pid, comm] = sum(args->count);

}



// Track memory allocations

kretprobe:kmalloc $pid_filter {

@kmalloc[pid, comm] = count();

@kmem_bytes[pid, comm] = sum(retval);

}



// Track process creation

tracepoint:syscalls:sys_enter_clone,

tracepoint:syscalls:sys_enter_fork,

tracepoint:syscalls:sys_enter_vfork $pid_filter {

@process_create[pid, comm] = count();

}



interval:s:5 {

printf(\"\\n--- Resource Usage Summary (5s) ---\\n\");



printf(\"\\nCPU Usage (sample count):\\n\");

print(@cpu);

clear(@cpu);



printf(\"\\nRead Operations:\\n\");

print(@reads);

printf(\"\\nBytes Read:\\n\");

print(@read_bytes);

clear(@reads);

clear(@read_bytes);



printf(\"\\nWrite Operations:\\n\");

print(@writes);

printf(\"\\nBytes Written:\\n\");

print(@write_bytes);

clear(@writes);

clear(@write_bytes);



printf(\"\\nKernel Memory Allocations:\\n\");

print(@kmalloc);

printf(\"\\nKernel Bytes Allocated:\\n\");

print(@kmem_bytes);

clear(@kmalloc);

clear(@kmem_bytes);



printf(\"\\nProcess Creation:\\n\");

print(@process_create);

clear(@process_create);

}

" 2>/dev/null



echo -e "${GREEN}[+] Resource usage profiling completed${NC}"

}

# Option 13: Detect process injection attempts

detect_process_injection() {

echo -e "${BLUE}[*] Detect process injection attempts${NC}"

read -p "Enter duration in seconds (default: 30): " duration

duration=${duration:-30}



echo -e "${GREEN}[+] Monitoring for process injection techniques for $duration
seconds...${NC}"



timeout $duration bpftrace -e "

// Track ptrace usage (common for code injection)

tracepoint:syscalls:sys_enter_ptrace {

printf(\"PID: %-6d COMM: %-15.15s UID: %-6d | PTRACE: request=%d pid=%d\\n\",

pid, comm, uid, args->request, args->pid);



// PTRACE_POKETEXT/PTRACE_POKEDATA (4) is used for writing to process memory

if (args->request == 4) {

printf(\" [ALERT] Process memory modification detected via ptrace!\\n\");

}



// PTRACE_ATTACH (16) is used to attach to a process

if (args->request == 16) {

printf(\" Process %d (%s) is attaching to PID %d\\n\", pid, comm, args->pid);

}

}



// Track process_vm_writev (direct process memory writing)

tracepoint:syscalls:sys_enter_process_vm_writev {

printf(\"PID: %-6d COMM: %-15.15s | PROCESS_VM_WRITEV: pid=%d\\n\",

pid, comm, args->pid);

printf(\" [ALERT] Direct process memory write detected!\\n\");

}



// Monitor /proc/pid/mem access for writing

tracepoint:syscalls:sys_enter_open,

tracepoint:syscalls:sys_enter_openat {

\$filename = str(args->filename);



if (\$filename != 0 && strncmp(\$filename, \"/proc/\", 6) == 0) {

if (strstr(\$filename, \"/mem\") != 0) {

\$flags = args->flags;

// Check if file is opened for writing

if (\$flags & 0x1 || \$flags & 0x2) { // O_WRONLY or O_RDWR

printf(\"PID: %-6d COMM: %-15.15s | Opening %s for writing\\n\",

pid, comm, \$filename);

printf(\" [ALERT] Process memory manipulation via /proc detected!\\n\");

}

}

}

}



// Monitor shared memory with executable permissions (potential code injection)

tracepoint:syscalls:sys_enter_mmap {

if ((args->prot & 0x4) && (args->flags & 0x1)) { // PROT_EXEC and MAP_SHARED

printf(\"PID: %-6d COMM: %-15.15s | MMAP: Creating shared executable
memory\\n\",

pid, comm);

printf(\" [ALERT] Potential shared memory code injection vector!\\n\");

}

}



// Monitor debugfs access (which can be used for memory manipulation)

tracepoint:syscalls:sys_enter_open,

tracepoint:syscalls:sys_enter_openat {

\$filename = str(args->filename);



if (\$filename != 0 && strncmp(\$filename, \"/sys/kernel/debug\", 17) == 0) {

printf(\"PID: %-6d COMM: %-15.15s | Accessing debugfs: %s\\n\",

pid, comm, \$filename);



if (comm != \"systemd\" && comm != \"udevd\" &&

comm != \"snapd\" && comm != \"kernel\") {

printf(\" [ALERT] Suspicious debugfs access!\\n\");

}

}

}



// Detect shellcode-like behavior (syscall instruction)

kprobe:__x64_sys_execve {

// Get the instruction pointer that caused the syscall

\$ip = reg(\"ip\");



// Check if it's in a mapped executable area rather than in .text segment

@exec_syscalls[pid, comm, \$ip] = count();

}



interval:s:5 {

printf(\"\\n--- Process Injection Detection Summary (5s) ---\\n\");

printf(\"\\nExecve Syscall Origins:\\n\");

print(@exec_syscalls);

}

" 2>/dev/null



echo -e "${GREEN}[+] Process injection detection completed${NC}"

}

# Option 14: Monitor filesystem operations

monitor_filesystem() {

echo -e "${BLUE}[*] Monitor filesystem operations${NC}"

read -p "Enter specific directory to monitor (leave empty for all): " target_dir

read -p "Enter duration in seconds (default: 30): " duration

duration=${duration:-30}



if [ -z "$target_dir" ]; then

dir_filter=""

dir_msg="all filesystem"

else

dir_filter="/strncmp(str(args->filename), \"$target_dir\", ${#target_dir}) ==
0/"

dir_msg="$target_dir"

fi



echo -e "${GREEN}[+] Monitoring $dir_msg operations for $duration
seconds...${NC}"



timeout $duration bpftrace -e "

// Track file creation

tracepoint:syscalls:sys_enter_creat,

tracepoint:syscalls:sys_enter_open,

tracepoint:syscalls:sys_enter_openat /args->flags & 0x40/ $dir_filter { //
O_CREAT

\$filename = str(args->filename);

if (\$filename != 0) {

printf(\"PID: %-6d COMM: %-15.15s UID: %-6d | CREATE: %s\\n\",

pid, comm, uid, \$filename);

}

}



// Track file deletion

tracepoint:syscalls:sys_enter_unlink,

tracepoint:syscalls:sys_enter_unlinkat $dir_filter {

\$filename = str(args->filename);

if (\$filename != 0) {

printf(\"PID: %-6d COMM: %-15.15s UID: %-6d | DELETE: %s\\n\",

pid, comm, uid, \$filename);



if (strstr(\$filename, \".bash_history\") != 0 ||

strstr(\$filename, \".zsh_history\") != 0 ||

strstr(\$filename, \".mysql_history\") != 0 ||

strstr(\$filename, \"/var/log/\") != 0 ||

strstr(\$filename, \"/var/audit/\") != 0) {

printf(\" [ALERT] Potential log/history file deletion!\\n\");

}

}

}



// Track file modifications

tracepoint:syscalls:sys_enter_rename,

tracepoint:syscalls:sys_enter_renameat,

tracepoint:syscalls:sys_enter_renameat2 $dir_filter {

\$oldname = str(args->oldname);

\$newname = str(args->newname);

if (\$oldname != 0 && \$newname != 0) {

printf(\"PID: %-6d COMM: %-15.15s UID: %-6d | RENAME: %s -> %s\\n\",

pid, comm, uid, \$oldname, \$newname);



if ((strstr(\$newname, \".so\") != 0 || strstr(\$newname, \"lib\") != 0) &&

uid != 0) {

printf(\" [ALERT] Non-root process modifying library file!\\n\");

}

}

}



// Track permission changes

tracepoint:syscalls:sys_enter_chmod,

tracepoint:syscalls:sys_enter_fchmod,

tracepoint:syscalls:sys_enter_fchmodat $dir_filter {

\$filename = str(args->filename);

\$mode = args->mode;

if (\$filename != 0) {

printf(\"PID: %-6d COMM: %-15.15s UID: %-6d | CHMOD: %s mode=0%o\\n\",

pid, comm, uid, \$filename, \$mode);



if (\$mode & 0111) { // executable bit

printf(\" Setting executable permission\\n\");

}

}

}



// Track ownership changes

tracepoint:syscalls:sys_enter_chown,

tracepoint:syscalls:sys_enter_fchown,

tracepoint:syscalls:sys_enter_lchown,

tracepoint:syscalls:sys_enter_fchownat $dir_filter {

\$filename = str(args->filename);

if (\$filename != 0) {

printf(\"PID: %-6d COMM: %-15.15s UID: %-6d | CHOWN: %s uid=%d gid=%d\\n\",

pid, comm, uid, \$filename, args->user, args->group);

}

}



// Track suspicious file access

tracepoint:syscalls:sys_enter_open,

tracepoint:syscalls:sys_enter_openat $dir_filter {

\$filename = str(args->filename);

if (\$filename != 0) {

// Check for sensitive files

if (strstr(\$filename, \"passwd\") != 0 ||

strstr(\$filename, \"shadow\") != 0 ||

strstr(\$filename, \"/etc/ssh/\") != 0 ||

strstr(\$filename, \"/root/.ssh/\") != 0 ||

strstr(\$filename, \"id_rsa\") != 0 ||

strstr(\$filename, \"authorized_keys\") != 0) {

printf(\"PID: %-6d COMM: %-15.15s UID: %-6d | ACCESS SENSITIVE: %s\\n\",

pid, comm, uid, \$filename);



if (uid != 0 && (strstr(\$filename, \"shadow\") != 0 ||

strstr(\$filename, \"/root/.ssh/\") != 0)) {

printf(\" [ALERT] Non-root process accessing highly sensitive file!\\n\");

}

}

}

}



// Track writes to /dev/mem or /dev/kmem (direct memory manipulation)

tracepoint:syscalls:sys_enter_open,

tracepoint:syscalls:sys_enter_openat {

\$filename = str(args->filename);

\$flags = args->flags;



if (\$filename != 0 &&

(\$flags & 0x1 || \$flags & 0x2) && // O_WRONLY or O_RDWR

(strncmp(\$filename, \"/dev/mem\", 8) == 0 ||

strncmp(\$filename, \"/dev/kmem\", 9) == 0 ||

strncmp(\$filename, \"/dev/port\", 9) == 0)) {

printf(\"PID: %-6d COMM: %-15.15s UID: %-6d | DIRECT MEMORY ACCESS: %s\\n\",

pid, comm, uid, \$filename);

printf(\" [ALERT] Direct hardware memory manipulation detected!\\n\");

}

}

" 2>/dev/null



echo -e "${GREEN}[+] Filesystem monitoring completed${NC}"

}

# Option 15: Track container escape attempts

track_container_escapes() {

echo -e "${BLUE}[*] Track container escape attempts${NC}"

read -p "Enter duration in seconds (default: 30): " duration

duration=${duration:-30}



echo -e "${GREEN}[+] Monitoring for container escape techniques for $duration
seconds...${NC}"



timeout $duration bpftrace -e "

// Monitor privileged container capabilities

kprobe:cap_capable {

\$cap_id = arg1;



if (\$cap_id == 16 || \$cap_id == 21) { // CAP_SYS_MODULE or CAP_SYS_ADMIN

printf(\"PID: %-6d COMM: %-15.15s | Privileged capability check: %d\\n\",

pid, comm, \$cap_id);



if (\$cap_id == 21) { // CAP_SYS_ADMIN

printf(\" [ALERT] Process checking for CAP_SYS_ADMIN (potential container
escape)\\n\");

}

}

}



// Monitor mount namespace escapes

tracepoint:syscalls:sys_enter_mount {

printf(\"PID: %-6d COMM: %-15.15s | MOUNT: src=%s dst=%s type=%s\\n\",

pid, comm, str(args->source_name), str(args->target_name),
str(args->filesystemtype));



if (strncmp(str(args->filesystemtype), \"proc\", 4) == 0 ||

strncmp(str(args->filesystemtype), \"sysfs\", 5) == 0) {

printf(\" [ALERT] Potential container escape via %s mount\\n\",
str(args->filesystemtype));

}

}



// Monitor device mounting (common escape technique)

tracepoint:syscalls:sys_enter_mount {

\$src = str(args->source_name);

\$dst = str(args->target_name);



if (\$src != 0 && \$dst != 0) {

if (strncmp(\$src, \"/dev\", 4) == 0) {

printf(\"PID: %-6d COMM: %-15.15s | Device mount: %s -> %s\\n\",

pid, comm, \$src, \$dst);

printf(\" [ALERT] Potential container escape via device mount\\n\");

}

}

}



// Monitor access to host devices

tracepoint:syscalls:sys_enter_open,

tracepoint:syscalls:sys_enter_openat {

\$filename = str(args->filename);



if (\$filename != 0) {

if (strncmp(\$filename, \"/dev/\", 5) == 0 &&

(strstr(\$filename, \"mem\") != 0 ||

strstr(\$filename, \"kmem\") != 0 ||

strstr(\$filename, \"port\") != 0 ||

strncmp(\$filename, \"/dev/sd\", 7) == 0 ||

strncmp(\$filename, \"/dev/nvme\", 9) == 0)) {

printf(\"PID: %-6d COMM: %-15.15s | Access to sensitive device: %s\\n\",

pid, comm, \$filename);

printf(\" [ALERT] Potential container escape via device access\\n\");

}

}

}



// Monitor cgroup manipulation (common for escapes)

tracepoint:syscalls:sys_enter_open,

tracepoint:syscalls:sys_enter_openat {

\$filename = str(args->filename);

\$flags = args->flags;



if (\$filename != 0 && (\$flags & 0x1 || \$flags & 0x2)) { // O_WRONLY or O_RDWR

if (strncmp(\$filename, \"/sys/fs/cgroup\", 14) == 0 ||

strncmp(\$filename, \"/proc/sys\", 9) == 0) {

printf(\"PID: %-6d COMM: %-15.15s | Writing to sensitive path: %s\\n\",

pid, comm, \$filename);

printf(\" [ALERT] Potential container escape via cgroup/sysctl
manipulation\\n\");

}

}

}



// Monitor for core_pattern manipulation (CVE-2019-5736)

tracepoint:syscalls:sys_enter_open,

tracepoint:syscalls:sys_enter_openat {

\$filename = str(args->filename);

\$flags = args->flags;



if (\$filename != 0 && (\$flags & 0x1 || \$flags & 0x2)) { // O_WRONLY or O_RDWR

if (strncmp(\$filename, \"/proc/sys/kernel/core_pattern\", 28) == 0) {

printf(\"PID: %-6d COMM: %-15.15s | Writing to core_pattern: %s\\n\",

pid, comm, \$filename);

printf(\" [ALERT] Potential container escape via core_pattern\\n\");

}

}

}



// Monitor for potential runC container escape attempts

tracepoint:syscalls:sys_enter_open,

tracepoint:syscalls:sys_enter_openat {

\$filename = str(args->filename);



if (\$filename != 0) {

if (strstr(\$filename, \"docker\") != 0 ||

strstr(\$filename, \"containerd\") != 0 ||

strstr(\$filename, \"runc\") != 0) {

if (strstr(\$filename, \"/proc/self/exe\") != 0) {

printf(\"PID: %-6d COMM: %-15.15s | Suspicious container binary access: %s\\n\",

pid, comm, \$filename);

printf(\" [ALERT] Potential runC container escape attempt (CVE-2019-5736)\\n\");

}

}

}

}

" 2>/dev/null



echo -e "${GREEN}[+] Container escape monitoring completed${NC}"

}

# Option 16: Analyze loaded kernel modules

analyze_kernel_modules() {

echo -e "${BLUE}[*] Analyze loaded kernel modules${NC}"

read -p "Enter duration in seconds (default: 30): " duration

duration=${duration:-30}



echo -e "${GREEN}[+] Monitoring kernel module operations for $duration
seconds...${NC}"



timeout $duration bpftrace -e "

// Monitor module loading

tracepoint:syscalls:sys_enter_init_module {

printf(\"PID: %-6d COMM: %-15.15s UID: %-6d | LOADING KERNEL MODULE\\n\",

pid, comm, uid);



if (uid != 0) {

printf(\" [ALERT] Non-root user attempting to load kernel module!\\n\");

}

}



// Monitor module removal

tracepoint:syscalls:sys_enter_delete_module {

printf(\"PID: %-6d COMM: %-15.15s UID: %-6d | REMOVING KERNEL MODULE: %s\\n\",

pid, comm, uid, str(args->name));



if (uid != 0) {

printf(\" [ALERT] Non-root user attempting to remove kernel module!\\n\");

}

}



// Monitor kernel module file operations

tracepoint:syscalls:sys_enter_open,

tracepoint:syscalls:sys_enter_openat {

\$filename = str(args->filename);



if (\$filename != 0) {

if (strstr(\$filename, \".ko\") != 0 ||

strncmp(\$filename, \"/lib/modules/\", 13) == 0) {

printf(\"PID: %-6d COMM: %-15.15s UID: %-6d | KERNEL MODULE FILE ACCESS:
%s\\n\",

pid, comm, uid, \$filename);

}

}

}



// Monitor kmod execution (used for module operations)

tracepoint:syscalls:sys_enter_execve,

tracepoint:syscalls:sys_enter_execveat {

\$argp = args->argv;

\$arg0 = user_string(\$argp);



if (\$arg0 != 0) {

if (strstr(\$arg0, \"insmod\") != 0 ||

strstr(\$arg0, \"modprobe\") != 0 ||

strstr(\$arg0, \"rmmod\") != 0 ||

strstr(\$arg0, \"modinfo\") != 0) {

printf(\"PID: %-6d COMM: %-15.15s UID: %-6d | MODULE TOOL EXECUTION: %s\\n\",

pid, comm, uid, \$arg0);



\$i = 1;

\$argp++;

\$arg = user_string(\$argp);

printf(\" Command: %s\", \$arg0);

while (\$arg != 0 && \$i < 10) {

printf(\" %s\", \$arg);

\$argp++;

\$arg = user_string(\$argp);

\$i++;

}

if (\$i >= 10) {

printf(\" ...\");

}

printf(\"\\n\");

}

}

}



// Monitor debugfs/sysfs manipulation (used in rootkits)

tracepoint:syscalls:sys_enter_open,

tracepoint:syscalls:sys_enter_openat {

\$filename = str(args->filename);

\$flags = args->flags;



if (\$filename != 0 && (\$flags & 0x1 || \$flags & 0x2)) { // O_WRONLY or O_RDWR

if (strncmp(\$filename, \"/sys/kernel\", 11) == 0 ||

strncmp(\$filename, \"/sys/module\", 11) == 0 ||

strncmp(\$filename, \"/proc/kallsyms\", 14) == 0) {

printf(\"PID: %-6d COMM: %-15.15s UID: %-6d | KERNEL STRUCTURE WRITE: %s\\n\",

pid, comm, uid, \$filename);

printf(\" [ALERT] Potential rootkit or LKM manipulation activity!\\n\");

}

}

}

" 2>/dev/null



echo -e "${GREEN}[+] Kernel module analysis completed${NC}"

}

# Option 17: Monitor bpf() syscall usage

monitor_bpf() {

echo -e "${BLUE}[*] Monitor bpf() syscall usage${NC}"

read -p "Enter duration in seconds (default: 30): " duration

duration=${duration:-30}



echo -e "${GREEN}[+] Monitoring BPF operations for $duration seconds...${NC}"



timeout $duration bpftrace -e "

// Monitor BPF syscall usage

tracepoint:syscalls:sys_enter_bpf {

printf(\"PID: %-6d COMM: %-15.15s UID: %-6d | BPF: cmd=%d\\n\",

pid, comm, uid, args->cmd);



// BPF commands

if (args->cmd == 0) {

printf(\" BPF_MAP_CREATE\\n\");

} else if (args->cmd == 1) {

printf(\" BPF_MAP_LOOKUP_ELEM\\n\");

} else if (args->cmd == 2) {

printf(\" BPF_MAP_UPDATE_ELEM\\n\");

} else if (args->cmd == 3) {

printf(\" BPF_MAP_DELETE_ELEM\\n\");

} else if (args->cmd == 4) {

printf(\" BPF_MAP_GET_NEXT_KEY\\n\");

} else



// BPF commands (continued)

} else if (args->cmd == 5) {

printf(\" BPF_PROG_LOAD\\n\");

printf(\" [ALERT] BPF program being loaded - potential for kernel
manipulation!\\n\");

} else if (args->cmd == 6) {

printf(\" BPF_OBJ_PIN\\n\");

} else if (args->cmd == 7) {

printf(\" BPF_OBJ_GET\\n\");

} else if (args->cmd == 8) {

printf(\" BPF_PROG_ATTACH\\n\");

printf(\" [ALERT] BPF program being attached!\\n\");

} else if (args->cmd == 9) {

printf(\" BPF_PROG_DETACH\\n\");

}



@bpf_cmds[pid, comm, args->cmd] = count();

}



// Track successful BPF operations

tracepoint:syscalls:sys_exit_bpf /args->ret >= 0/ {

printf(\" Result: SUCCESS (fd/id=%d)\\n\", args->ret);

}



// Monitor kprobe and tracepoint operations (often used with BPF)

kprobe:security_bpf {

printf(\"PID: %-6d COMM: %-15.15s | BPF security check\\n\",

pid, comm);

}



// Monitor direct BPF map operations

kprobe:bpf_map_update_elem,

kprobe:bpf_map_lookup_elem {

printf(\"PID: %-6d COMM: %-15.15s | BPF map operation: %s\\n\",

pid, comm, probe);

}



interval:s:5 {

printf(\"\\n--- BPF Operations Summary (5s) ---\\n\");

printf(\"%-6s %-15s %-20s | %s\\n\", \"PID\", \"COMM\", \"CMD\", \"COUNT\");

print(@bpf_cmds);

}

" 2>/dev/null



echo -e "${GREEN}[+] BPF usage monitoring completed${NC}"

}

# Option 18: Detect hidden process techniques

detect_hidden_processes() {

echo -e "${BLUE}[*] Detect hidden process techniques${NC}"

read -p "Enter duration in seconds (default: 30): " duration

duration=${duration:-30}



echo -e "${GREEN}[+] Monitoring for process hiding techniques for $duration
seconds...${NC}"



timeout $duration bpftrace -e "

// Monitor /proc traversal

kprobe:proc_pid_readdir {

@proc_readdir[pid, comm] = count();

}



// Monitor getdents/getdents64 syscalls (directory listing)

tracepoint:syscalls:sys_enter_getdents,

tracepoint:syscalls:sys_enter_getdents64 {

@getdents[pid, comm] = count();

}



// Monitor specific process hiding techniques

kprobe:proc_readdir {

@proc_read[pid, comm, \"proc_readdir\"] = count();

}



tracepoint:syscalls:sys_enter_ptrace /args->request == 31/ { // PTRACE_ATTACH

printf(\"PID: %-6d COMM: %-15.15s | PTRACE_ATTACH to PID %d\\n\",

pid, comm, args->pid);



// Try to detect if the target process exists

@ptrace_targets[pid, comm, args->pid] = count();

}



// Detect changes to task struct links (potential unlink from task_struct)

kprobe:find_task_by_vpid {

@find_task[pid, comm, arg0] = count();

}



kretprobe:find_task_by_vpid /retval == 0/ {

\$vpid = arg0;

// Non-zero PID should return a valid task

if (\$vpid > 0 && \$vpid < 4000000) {

printf(\"PID: %-6d COMM: %-15.15s | Process %d not found (potential hidden
process)\\n\",

pid, comm, \$vpid);

}

}



// Monitor process creation/exit to track active PIDs

tracepoint:sched:sched_process_fork {

@pids[args->child_pid] = nsecs;

printf(\"PID: %-6d COMM: %-15.15s | PROCESS CREATED: %d\\n\",

pid, comm, args->child_pid);

}



tracepoint:sched:sched_process_exit {

@exit_pids[pid] = nsecs;

delete(@pids[pid]);

printf(\"PID: %-6d COMM: %-15.15s | PROCESS EXIT\\n\", pid, comm);

}



// Monitor tasks that manipulate the pidns number

kprobe:copy_process {

@new_task[pid, comm] = count();

}



tracepoint:syscalls:sys_enter_clone /args->clone_flags & 0x20000000/ { //
CLONE_NEWPID

printf(\"PID: %-6d COMM: %-15.15s | Creating new PID namespace\\n\",

pid, comm);

}



interval:s:5 {

printf(\"\\n--- Process Hiding Detection Summary (5s) ---\\n\");



printf(\"\\n/proc Directory Reads:\\n\");

print(@proc_readdir);



printf(\"\\nDirectory Entry Reads:\\n\");

print(@getdents);



printf(\"\\nProcess Lookups (find_task_by_vpid):\\n\");

print(@find_task);



clear(@proc_readdir);

clear(@getdents);

clear(@find_task);

}

" 2>/dev/null



echo -e "${GREEN}[+] Hidden process detection completed${NC}"

}

# Option 19: Track unauthorized file access attempts

track_unauthorized_access() {

echo -e "${BLUE}[*] Track unauthorized file access attempts${NC}"

read -p "Enter duration in seconds (default: 30): " duration

duration=${duration:-30}



echo -e "${GREEN}[+] Monitoring for unauthorized file access attempts for
$duration seconds...${NC}"



timeout $duration bpftrace -e "

// Monitor permission denied errors

tracepoint:syscalls:sys_exit_open,

tracepoint:syscalls:sys_exit_openat /args->ret == -13/ { // -EACCES

@access_denied[pid, comm] = count();

}



// Track specific patterns of file access

kprobe:security_file_permission {

\$file = (struct file *)arg0;

if (\$file != 0) {

\$path = \$file->f_path.dentry->d_name.name;

if (\$path != 0) {

\$name = str(\$path);

\$mask = arg1;



// MAY_READ = 0x4, MAY_WRITE = 0x2, MAY_EXEC = 0x1

if ((\$mask & 0x2) &&

(\$name != 0)) {

@file_write_check[pid, comm, \$name] = count();

}

}

}

}



kretprobe:security_file_permission /retval != 0/ {

printf(\"PID: %-6d COMM: %-15.15s UID: %-6d | Permission denied for file
operation\\n\",

pid, comm, uid);

}



// Monitor access control checks

kprobe:security_path_truncate,

kprobe:security_path_mkdir,

kprobe:security_path_rmdir,

kprobe:security_path_symlink,

kprobe:security_path_link,

kprobe:security_path_rename,

kprobe:security_path_chmod,

kprobe:security_path_chown {

printf(\"PID: %-6d COMM: %-15.15s UID: %-6d | Security check: %s\\n\",

pid, comm, uid, probe);

}



kretprobe:security_path_truncate,

kretprobe:security_path_mkdir,

kretprobe:security_path_rmdir,

kretprobe:security_path_symlink,

kretprobe:security_path_link,

kretprobe:security_path_rename,

kretprobe:security_path_chmod,

kretprobe:security_path_chown /retval != 0/ {

printf(\" Result: DENIED (potential unauthorized access)\\n\");

@security_denied[pid, comm, probe] = count();

}



// Monitor dac_override capability use (bypassing permissions)

kprobe:cap_capable /arg1 == 1/ { // CAP_DAC_OVERRIDE

printf(\"PID: %-6d COMM: %-15.15s UID: %-6d | DAC_OVERRIDE capability
check\\n\",

pid, comm, uid);



if (uid != 0) {

printf(\" [ALERT] Non-root process checking for permission bypass
capability!\\n\");

}

}



// Monitor suspicious chmod operations

tracepoint:syscalls:sys_enter_chmod,

tracepoint:syscalls:sys_enter_fchmod,

tracepoint:syscalls:sys_enter_fchmodat {

\$mode = args->mode;



// Check if setting root setuid/setgid bits or wide permissions

if ((\$mode & 0x800) || (\$mode & 0x400) || (\$mode & 0x777) == 0x777) {

\$filename = args->filename ? str(args->filename) : \"(unknown)\";



printf(\"PID: %-6d COMM: %-15.15s UID: %-6d | Suspicious chmod: %s
mode=0%o\\n\",

pid, comm, uid, \$filename, \$mode);



if (\$mode & 0x800) {

printf(\" [ALERT] Setting setuid bit on file!\\n\");

}

if (\$mode & 0x400) {

printf(\" [ALERT] Setting setgid bit on file!\\n\");

}

if ((\$mode & 0x777) == 0x777) {

printf(\" [ALERT] Setting wide open permissions (777)!\\n\");

}

}

}



interval:s:5 {

printf(\"\\n--- File Access Control Violations Summary (5s) ---\\n\");



printf(\"\\nPermission Denied Events:\\n\");

print(@access_denied);



printf(\"\\nSecurity Subsystem Denials:\\n\");

print(@security_denied);



printf(\"\\nFile Write Security Checks:\\n\");

print(@file_write_check);



clear(@access_denied);

clear(@security_denied);

clear(@file_write_check);

}

" 2>/dev/null



echo -e "${GREEN}[+] Unauthorized access monitoring completed${NC}"

}

# Option 20: Monitor syscall argument tampering

monitor_syscall_tampering() {

echo -e "${BLUE}[*] Monitor syscall argument tampering${NC}"

read -p "Enter target process name or PID (leave empty for all): " target

read -p "Enter duration in seconds (default: 30): " duration

duration=${duration:-30}



if [[ "$target" =~ ^[0-9]+$ ]]; then

filter="/pid == $target/"

target_desc="PID $target"

elif [ -n "$target" ]; then

filter="/comm == \"$target\"/"

target_desc="process $target"

else

filter=""

target_desc="all processes"

fi



echo -e "${GREEN}[+] Monitoring syscall arguments for $target_desc for $duration
seconds...${NC}"



timeout $duration bpftrace -e "

// Monitor key syscalls with security implications

// execve with argument checks

tracepoint:syscalls:sys_enter_execve $filter {

\$filename = str(args->filename);

printf(\"PID: %-6d COMM: %-15.15s UID: %-6d | EXECVE: %s\\n\",

pid, comm, uid, \$filename);



\$i = 0;

\$argp = args->argv;

\$arg = user_string(\$argp);

printf(\" ARGS: \");

while (\$arg != 0 && \$i < 10) {

printf(\"%s \", \$arg);

\$argp++;

\$arg = user_string(\$argp);

\$i++;

}

if (\$i >= 10) {

printf(\"...\");

}

printf(\"\\n\");

}



// connect with address validation

tracepoint:syscalls:sys_enter_connect $filter {

\$sa = (struct sockaddr *)args->uservaddr;

if (\$sa->sa_family == 2) { // AF_INET

\$in = (struct sockaddr_in *)\$sa;

\$addr = ntop(2, \$in->sin_addr.s_addr);

\$port = (\$in->sin_port >> 8) | ((\$in->sin_port << 8) & 0xff00);

printf(\"PID: %-6d COMM: %-15.15s UID: %-6d | CONNECT: %s:%d\\n\",

pid, comm, uid, \$addr, \$port);



// Check for connections to common C2 ports or suspicious IPs

if (\$port == 4444 || \$port == 8080 || \$port == 8443 ||

\$port == 1337 || \$port == 31337) {

printf(\" [ALERT] Connection to suspicious port %d detected!\\n\", \$port);

}

}

}



// open with path normalization check (detect path traversal)

tracepoint:syscalls:sys_enter_open,

tracepoint:syscalls:sys_enter_openat $filter {

\$filename = str(args->filename);

if (\$filename != 0) {

if (strstr(\$filename, \"../\") != 0 || strstr(\$filename, \"./\") != 0) {

printf(\"PID: %-6d COMM: %-15.15s UID: %-6d | PATH TRAVERSAL: %s\\n\",

pid, comm, uid, \$filename);

printf(\" [ALERT] Potential path traversal attempt detected!\\n\");

}

}

}



// prctl with specific codes (often used to hide processes)

tracepoint:syscalls:sys_enter_prctl $filter {

printf(\"PID: %-6d COMM: %-15.15s | PRCTL: option=%d arg2=0x%lx\\n\",

pid, comm, args->option, args->arg2);



if (args->option == 15) { // PR_SET_NAME

printf(\" Process renaming itself\\n\");

}

if (args->option == 31) { // PR_SET_SECCOMP

printf(\" [ALERT] Process enabling seccomp filtering!\\n\");

}

}



// ioctl with specific device checks

tracepoint:syscalls:sys_enter_ioctl $filter {

printf(\"PID: %-6d COMM: %-15.15s | IOCTL: fd=%d cmd=0x%x arg=0x%lx\\n\",

pid, comm, args->fd, args->cmd, args->arg);



if (args->cmd == 0x5401) { // TCGETS - terminal check (often for tty detection)

printf(\" Terminal device check\\n\");

}

}



// mmap suspicious flags

tracepoint:syscalls:sys_enter_mmap $filter {

if ((args->flags & 0x20) && (args->prot & 0x4)) { // MAP_ANONYMOUS | PROT_EXEC

printf(\"PID: %-6d COMM: %-15.15s | MMAP: Anonymous executable memory!\\n\",

pid, comm);

printf(\" [ALERT] Potential shellcode loading detected!\\n\");

}

}



// sendto with data inspection

tracepoint:syscalls:sys_enter_sendto $filter {

@sendto_count[pid, comm] = count();

@sendto_bytes[pid, comm] = sum(args->len);

}



// recvfrom with data inspection

tracepoint:syscalls:sys_enter_recvfrom $filter {

@recvfrom_count[pid, comm] = count();

@recvfrom_bytes[pid, comm] = sum(args->len);

}



// dup2/dup3 (often used for stdin/stdout/stderr redirection)

tracepoint:syscalls:sys_enter_dup2,

tracepoint:syscalls:sys_enter_dup3 $filter {

printf(\"PID: %-6d COMM: %-15.15s | %s: oldfd=%d newfd=%d\\n\",

pid, comm, probe, args->oldfd, args->newfd);



if (args->newfd < 3) { // stdout, stdin, stderr

printf(\" [NOTE] Process redirecting standard file descriptors\\n\");



if (comm != \"bash\" && comm != \"sh\" && comm != \"zsh\" &&

comm != \"sshd\" && comm != \"sudo\") {

printf(\" [ALERT] Suspicious standard I/O redirection!\\n\");

}

}

}



// setuid/setgid checks

tracepoint:syscalls:sys_enter_setuid,

tracepoint:syscalls:sys_enter_setgid $filter {

printf(\"PID: %-6d COMM: %-15.15s | %s: uid/gid=%d\\n\",

pid, comm, probe, args->uid);



if (uid != 0 && args->uid == 0) {

printf(\" [ALERT] Process attempting to gain root privileges!\\n\");

}

}



interval:s:5 {

printf(\"\\n--- Network Communication Summary (5s) ---\\n\");



printf(\"\\nSend Operations (count):\\n\");

print(@sendto_count);



printf(\"\\nSend Operations (bytes):\\n\");

print(@sendto_bytes);



printf(\"\\nReceive Operations (count):\\n\");

print(@recvfrom_count);



printf(\"\\nReceive Operations (bytes):\\n\");

print(@recvfrom_bytes);



clear(@sendto_count);

clear(@sendto_bytes);

clear(@recvfrom_count);

clear(@recvfrom_bytes);

}

" 2>/dev/null



echo -e "${GREEN}[+] Syscall argument monitoring completed${NC}"

}

# Main menu

show_menu() {

echo -e
"\n${PURPLE}=====================================================================\n"

echo -e " Linux Malware Analysis Toolkit #1 "

echo -e " eBPF-Based Process Behavior Analyzer "

echo -e
"\n=====================================================================${NC}\n"

echo -e "${BLUE}Select an option:${NC}"

echo -e " ${GREEN}1.${NC} Trace system calls by specific process"

echo -e " ${GREEN}2.${NC} Monitor file access activities"

echo -e " ${GREEN}3.${NC} Track network connections"

echo -e " ${GREEN}4.${NC} Detect process execution chains"

echo -e " ${GREEN}5.${NC} Analyze memory mapping operations"

echo -e " ${GREEN}6.${NC} Trace process capabilities changes"

echo -e " ${GREEN}7.${NC} Monitor namespace transitions"

echo -e " ${GREEN}8.${NC} Detect unexpected syscall patterns"

echo -e " ${GREEN}9.${NC} Track process privilege escalation"

echo -e " ${GREEN}10.${NC} Monitor inter-process communications"

echo -e " ${GREEN}11.${NC} Log process credential changes"

echo -e " ${GREEN}12.${NC} Profile process resource usage"

echo -e " ${GREEN}13.${NC} Detect process injection attempts"

echo -e " ${GREEN}14.${NC} Monitor filesystem operations"

echo -e " ${GREEN}15.${NC} Track container escape attempts"

echo -e " ${GREEN}16.${NC} Analyze loaded kernel modules"

echo -e " ${GREEN}17.${NC} Monitor bpf() syscall usage"

echo -e " ${GREEN}18.${NC} Detect hidden process techniques"

echo -e " ${GREEN}19.${NC} Track unauthorized file access attempts"

echo -e " ${GREEN}20.${NC} Monitor syscall argument tampering"

echo -e " ${RED}0.${NC} Exit"



echo -e "\n"

}

main() {

check_requirements



while true; do

show_menu

read -p "Enter your choice [0-20]: " choice



case $choice in

1) trace_syscalls ;;

2) monitor_file_access ;;

3) track_network_connections ;;

4) detect_process_chains ;;

5) analyze_memory_mappings ;;

6) trace_capabilities ;;

7) monitor_namespaces ;;

8) detect_syscall_patterns ;;

9) track_privilege_escalation ;;

10) monitor_ipc ;;

11) log_credential_changes ;;

12) profile_resource_usage ;;

13) detect_process_injection ;;

14) monitor_filesystem ;;

15) track_container_escapes ;;

16) analyze_kernel_modules ;;

17) monitor_bpf ;;

18) detect_hidden_processes ;;

19) track_unauthorized_access ;;

20) monitor_syscall_tampering ;;

0)

echo -e "${GREEN}[+] Exiting. Goodbye!${NC}"

cleanup

exit 0

;;

*)

echo -e "${RED}[!] Invalid option. Please try again.${NC}"

;;

esac



echo -e "\n${BLUE}Press Enter to continue...${NC}"

read

done

}

# Run the main function

main