Let’s dissect malwares by collecting their syscalls with eBPF - Thomas Labarussias

Описание к видео Let’s dissect malwares by collecting their syscalls with eBPF - Thomas Labarussias

As infrastructure managers, we often have to deal with malwares. Although we do our best to avoid or block them, some slip through the net anyway. Let's imagine that you or a member of your team got their hands on one of these malicious binaries. How can you find out what its purpose was? You can try to uncompile the binary or explore it in hexadecimal mode, two tried and tested but time-consuming methods. Let's try a new approach and analyze the malware's behavior by running it in an isolated environment and collecting all its syscalls using eBPF.

Комментарии

Информация по комментариям в разработке

Похожие видео