Detection Evasion Using eBPF for Linux Fileless Malware

Existing detection techniques for Linux fileless mal-ware are not resistant to tampering with commands and files. In this paper, we propose three evasion methods using extended Berkley Packet Filter (eBPF) against the detection methods for Linux fileless malware. We implement the evasion techniques and demonstrate their feasibility. Additionally, we discuss mitigations against the evasions to improve the robustness of the existing detection methods.