SunnyDayBPF: Post-Syscall User-Buffer Telemetry Deception with eBPF

Short summary

SunnyDayBPF is a post-syscall telemetry deception technique using eBPF that targets a critical gap in security monitoring: the window after an agent reads data but before it parses and forwards that data to SIEM, EDR, or detection backends. By selectively modifying buffers during this window using eBPF hooks, attackers can cause security tools to forward data that diverges from what actually happened on the system. The research challenges the foundational assumption that data collection equals accurate observation.

• •eBPF-based technique that modifies telemetry buffers after read syscalls complete
• •Creates a critical gap between what actually happened and what security tools observe
• •Challenges the assumption that data collection guarantees accurate security monitoring

Generated with AI, which can make mistakes.