Add BPF_MAP_FREEZE to perf_event output maps to prevent easily blinding of sysmon
@MarioHewardt is already working on this.
Since Jun 17, 2024.
Assessment
This issue has not been assessed yet.
Description
Currently Sysmon uses a BPF_MAP_TYPE_PERF_EVENT_ARRAY map to send output from eBPF programs back to the user mode Sysmon process. This map can easily be either updated or cleared from other user mode programs, leaving Sysmon unable to see the eBPF programs outputs and makes process activities invisible.
Sysmon can use the BPF_MAP_FREEZE syscall option to freeze these output maps to prevent easily disabling of the map from userspace. However, loaded eBPF programs could still delete the map elements and has no known mitigation yet.
- Dominant language
- C
- Stars
- 2.2k
- Forks
- 220
- Avg merge
- 11d 22h
- Merged PRs (30d)
- 2
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from microsoft/SysmonForLinux
-
microsoft/SysmonForLinux#238 · 1 assignee ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
microsoft/SysmonForLinux#233 ·
-
microsoft/SysmonForLinux#230 · 1 assignee ·
-
microsoft/SysmonForLinux#226 · 1 assignee ·
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
microsoft/SysmonForLinux#220 · 2 reactions ·
All issues in microsoft/SysmonForLinux
Similar issues
-
Status: Waiting triage Type: Bug
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
nanoframework/Home#1857 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 1/5 Under an hour Newbie friendliness 92/100
libsdl-org/SDL#16372 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
corazawaf/coraza-nginx#140 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100