When we designed Oligo's detection coverage, we used the MITRE ATT&CK Enterprise matrix as an organizing framework. Not because ATT&CK is a complete model of attacker behavior (it is not, and MITRE would say the same), but because it provides a common vocabulary for mapping what a detection system can see to what defenders actually care about finding. This post goes through the mapping systematically: which ATT&CK sub-techniques are observable at Linux kernel boundary via kprobes, tracepoints, LSM hooks, and uprobes, which are partially observable, and which fall outside what eBPF can reasonably instrument.
Mapping eBPF Hooks to Observation Points
The four hook types observe different execution layers:
- Kprobes attach to kernel function entry or return points. They can fire on any kernel symbol. The most useful for security are the syscall entry points (
sys_enter_*), network stack functions, and filesystem VFS layer functions. - Tracepoints are stable, documented kernel instrumentation points that kernel developers maintain across kernel versions. They are preferred over kprobes where they exist because they have guaranteed stability. The
syscalls:sys_enter_*tracepoints cover most observable syscall behavior. - LSM hooks attach at Linux Security Module decision points: file access decisions, socket operations, process creation. They fire before the operation is permitted and can be used to block as well as observe.
- Uprobes attach to userspace function entry points in specific binaries. Useful for language runtime instrumentation (attaching to Python interpreter dispatch, JVM method calls, Node.js require) without requiring recompilation.
Execution Tactic
T1059.004 (Command and Scripting Interpreter: Unix Shell) can be observed through the tracepoint on sys_enter_execve when the executed binary is a shell interpreter (/bin/sh, /bin/bash, /bin/zsh, etc.). Detection confidence depends on the parent process: a shell launched by a web server is high confidence, while one launched by a terminal emulator is a false positive in most environments.
T1059.006 (Command and Scripting Interpreter: Python) is visible through the same execve tracepoint by watching for python or python3 executables under unexpected parents. A uprobe on Python's PyEval_EvalCodeEx provides more precise visibility into the scripts being evaluated.
T1106 (Native API) includes direct syscall use to bypass standard library wrappers. A kprobe on syscall entry points can observe it regardless of origin. BPF stack inspection can identify processes making syscalls without matching libc wrappers in their stack trace.
Privilege Escalation and Defense Evasion
T1548.001 (Abuse Elevation Control Mechanism: Setuid and Setgid) is visible through an LSM hook on security_bprm_check when a setuid binary runs, and through sys_enter_execve with the file's mode bits.
T1548.003 (Abuse Elevation Control Mechanism: Sudo and Sudo Caching) is only partly observable. The sudo invocation appears at the execve tracepoint, while caching and credential transfer occur in sudo's userspace and are better monitored with a uprobe on sudo authentication functions.
T1055 (Process Injection) and its sub-techniques are especially significant for application-layer runtime security. Kernel signals include sys_enter_ptrace (T1055.008), sys_enter_process_vm_writev for direct writes into another process's memory (T1055.001), and sys_enter_memfd_create followed by sys_enter_execve for fileless execution (T1055.009). Each produces a distinct syscall signature for unambiguous detection.
T1070.002 (Indicator Removal: Clear Linux or Mac System Logs) can be observed with an LSM hook on file operations aimed at /var/log/. A non-privileged process truncating or deleting log files is anomalous regardless of workload context.
T1027.013 (Obfuscated Files or Information: Encrypted/Encoded File Transfer) is partly visible at the network layer through unusual outbound ports, high entropy payloads, which BPF can estimate from network buffers, and asymmetric data volumes. Inspecting full content requires network tooling beyond the kernel eBPF attachment points Oligo uses.
Discovery and Lateral Movement
T1082 (System Information Discovery) can be observed through file read tracepoints for /proc/cpuinfo, /proc/meminfo, /etc/os-release, and /etc/hostname when an unusual process sequence accesses them.
T1033 (System Owner/User Discovery) includes reads of /etc/passwd, /etc/shadow (critical), plus calls to getpwuid and getgroups. Any non-root, non-PAM process accessing /etc/shadow is a high-confidence alert regardless of the workload baseline.
T1046 (Network Service Discovery) appears as port scanning: rapid connect() syscalls across sequential ports or addresses. A tracepoint on sys_enter_connect exposes it, with frequency analysis performed in the BPF program or ring buffer consumer.
Exfiltration
T1041 (Exfiltration Over C2 Channel) and T1048.003 (Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol) can be observed by monitoring outbound connections to destinations absent from the workload's established network baseline. The destination, port, and data volume appear in the sys_enter_connect and sys_enter_sendto tracepoints. If the channel uses TLS, content inspection requires decryption, which is not feasible at the eBPF layer for TLS 1.3 sessions.
What eBPF Cannot Observe
Several ATT&CK technique families receive limited coverage from kernel eBPF instrumentation alone. T1014 (Rootkit) sub-techniques that alter kernel data structures can evade eBPF programs in the same kernel space, though the verifier prevents rootkit techniques from modifying eBPF programs. Application-layer techniques that remain in userspace and generate no anomalous syscalls, including T1564 sub-techniques involving steganography or in-memory data hiding, leave no kernel-visible signals.
T1543.002 (Create or Modify System Process: Systemd Service) can be observed through writes to systemd unit file paths, but only when the service is installed persistently. Persistence that exists only in memory is more difficult to observe without memory forensics.
Coverage is strongest for behavioral techniques that touch the kernel, including execution, injection, network activity, file access, and privilege escalation. It is weaker for techniques confined to userspace state or network content. In containerized runtime application security, the kernel-interacting group captures most post-exploitation behavior that matters.