Kernel-level threat detection and telemetry collection for blue team testing
A production-ready eBPF sensor that captures process execution, network connections, and file access at kernel level. Designed for blue team validation and integration with the Amalia threat analysis platform.
- Operator: Niels Weistra, CISSP
- Authorization: RoE-ITlusions-Testlab-2026
- Validity: 27 April 2026 through 31 December 2026, unless the engagement closes earlier
- Permitted environment: ITlusions-owned or fully managed testlab systems listed in the RoE
- Excluded: Customer production systems, unauthorized external cloud tenants, and third-party systems without a separate written RoE
- Evidence handling: Use synthetic test data; record critical findings in BrainCell
incidentsandvuln_reports
CISSP certification establishes professional context but does not replace written authorization. The referenced RoE is the controlling authority for every deployment, crash reproduction, and PoC execution.
Monitor honeypot systems and capture attacker behavior in real-time using eBPF, providing actionable intelligence for red team operations and blue team defense validation.
- Kernel-level visibility: Capture processes, network connections, and file I/O at kernel level
- Real-time threat detection: 4-layer detection engine (IP analysis, YARA, Sigma-Lite, correlation)
- High performance: Microsecond-level latency, minimal CPU impact (~1-3%)
- JSON telemetry: Structured event export for integration with analysis platforms
- Threat verdicts: Unified threat assessment combining multiple detection methods
- Amalia & BrainCell integration: Stream verdicts to red team analysis and persistent memory platforms
- Automated deployment: One-command installation on Linux servers (5.8+)
- Scalable: Ring buffer design handles high-frequency events
- Complete documentation: Architecture guides, deployment instructions, and examples
ITL.Amalia.Poc.eBpf/
├── kernel/programs/ # eBPF kernel programs
│ ├── sensor.bpf.c # Main eBPF program (~300 lines)
│ └── README.md
├── userspace/src/ # Python threat detection framework
│ ├── core/ # Configuration, logging, ABCs
│ ├── collection/ # Event data models
│ ├── detection/ # 4-layer threat detection
│ ├── integrations/ # Amalia, BrainCell exports
│ ├── application/ # Main orchestrator
│ ├── examples/ # Usage demonstrations
│ └── README.md
├── build/ # Installation & testing
│ ├── install.sh # Automated OS detection & setup
│ └── test_setup.sh # Capability verification
├── docs/ # Documentation (numbered x.y-title.md)
│ ├── 2.1-architecture.md # System design & data flow
│ ├── 1.2-setup.md # Development environment
│ ├── 3.1-usage.md # Advanced usage patterns
│ ├── 1.1-quickstart.md # 5-minute deployment
│ └── ... # see docs/ for the full numbered index
├── CMakeLists.txt # Build configuration
├── Makefile # Alternative build
└── CLAUDE.md # Project guidelines
# Copy to target system
scp -r ITL.Amalia.Poc.eBpf root@target:/tmp/
# Install dependencies and setup
ssh root@target
cd /tmp/ITL.Amalia.Poc.eBpf
sudo bash build/install.sh
# Verify system capabilities
sudo bash build/test_setup.sh# Collect for 60 seconds
sudo /opt/ebpf-implant/implant_agent.py --load --collect 60 --export
# Enable persistent monitoring
sudo systemctl enable ebpf-implant.service
sudo systemctl start ebpf-implant.service
# View results
cat /tmp/ebpf-telemetry/telemetry-*.json | python3 -m json.tool# Send telemetry to Amalia
sudo /opt/ebpf-implant/implant_agent.py \
--load --collect 3600 \
--amalia \
--amalia-url "http://amalia.local:8000/api/ingest" \
--amalia-token "YOUR_TOKEN"- PID, parent PID, UID/GID
- Command name and full argv
- Nanosecond-precision timestamps
- TCP/UDP 5-tuple (source/dest IP:port)
- Direction (inbound/outbound)
- Process and user context
- Path accessed
- Operation type (open, read, write)
- Access flags and mode bits
- Process context
┌─────────────────────────────────────┐
│ User-Space Application (Python) │
│ - Load eBPF bytecode │
│ - Attach to hooks │
│ - Poll ring buffers │
│ - Export to JSON / Amalia │
└────────────────┬────────────────────┘
│
Ring Buffer (IPC)
│
┌────────────────▼────────────────────┐
│ Kernel Space (eBPF Programs) │
│ - Tracepoints (sched, syscalls) │
│ - Kprobes (TCP connections) │
│ - Event filtering & aggregation │
│ - Direct kernel data access │
└─────────────────────────────────────┘
| Metric | Value | Impact |
|---|---|---|
| CPU overhead | ~1-3% | Negligible |
| Memory usage | ~30MB | Minimal |
| Syscall latency | +0.2µs | Imperceptible |
| Event loss | ~2% (configurable) | Acceptable |
Suitable for 24/7 continuous monitoring without performance degradation.
- Linux kernel 5.8+ (for ringbuf support)
- Root access
- Internet for initial setup
- clang/LLVM
- Python 3.6+
- BCC (or libbpf-python)
- Linux headers
- Raspberry Pi (ARMv7/ARMv8)
- Ubuntu/Debian
- RHEL/CentOS/Fedora
- Any Linux with kernel 5.8+
- 1.1-quickstart.md - 5-minute deployment guide
- 3.1-usage.md - Advanced usage patterns and integration
- 2.1-architecture.md - System design and concepts
- 1.2-setup.md - Development environment configuration
- Validate threat detection signatures (YARA, Sigma-Lite)
- Test response procedures against real kernel-level telemetry
- Measure detection latency and accuracy
- Tune threat correlation thresholds
- Continuous telemetry collection in isolated test networks
- Real-time process, network, and file access visibility
- Integration with SIEM and threat analysis platforms
- Incident response testing and validation
- Kernel-level event collection research
- eBPF performance and reliability testing
- Threat emulation and detection validation
- Blue team capability assessment
This tool generates realistic threat telemetry. Use only in:
- ✅ Authorized lab environments
- ✅ With proper Rules of Engagement (RoE)
- ✅ With system owner consent
- ✅ For defensive testing purposes
Unauthorized use is illegal.
What This Tool Does:
- Generates realistic process, network, and file access events
- Tests detection coverage for kernel-level visibility
- Validates threat analysis pipelines
- Provides telemetry for incident response validation
What Monitoring Should Catch:
- eBPF program loading (via audit or syscall monitoring)
- Ring buffer memory access patterns
- Process execution events flowing through detection systems
- Network connection events in detection pipeline
Contributions welcome! Focus areas:
- Additional event types (DNS, IPC, memory access)
- Sensor tamper detection (program unload auditing, ring buffer loss alerts)
- Detection improvements and signatures
- Platform support (ARM, x86_64, other architectures)
[To be determined]
Author: Niels Weistra
Organization: ITL (ITLusions)
Project: Amalia Red Team Platform
Date: August 9, 2026
- eBPF Official Guide
- Kernel BPF Documentation
- BCC Project
- MITRE ATT&CK Framework
- CVE-2021-3490, CVE-2020-27194 (eBPF verifier)