ebpf-edr

README

Huakiwi

Huwkiwi is an EDR powered by eBPF and Sigma.

Name

Huakiwi is named after Leioproctus huakiwi, a species of bee Endemic to New Zealand.

credit: hasherezade

Requirements

• kernel 4.4+ go-ebf requirement
• LLVM/Clang

Build

Simply run make after cloning the repo. it should generate a portable statically-linked binary.

git clone https://github.com/bm9w/huakiwi
cd huakiwi
make

Rules

current rules (almost all of them are borrowed from Elastic's public repo on SIEM rules)

• Potential Protocol Tunneling via EarthWorm
• Compression of Sensitive Files
• Potential OpenSSH Backdoor Logging Activity
• Attempt to Disable IPTables or Firewall
• Attempt to Disable Syslog Service
• Tampering of Bash Command-Line History
• Potential Disabling of SELinux
• File Deletion via Shred
• Removing a kernel module
• System Log File Deletion
• Interactive Terminal Spawned via Perl
• Interactive Terminal Spawned via Python
• Modification of Dynamic Linker Preload Shared Object

Contributions welcome!

Documentation

Overview

This program demonstrates attaching an eBPF program to a kernel symbol. The eBPF program will be attached to the start of the sys_execve kernel function and prints out the number of times it has been called every second.