azqzazq1show about everything Say hello
← Back to research

RESEARCH ARCHIVE / SUNNYDAYBPF

SunnyDayBPF

Post Syscall User Buffer Telemetry Deception with eBPF
eBPF telemetry deception post syscall kprobe/kretprobe observation layer SIEM/EDR evasion user buffer manipulation

The Problem

Modern Linux security systems rely on a fundamental assumption: the data collected by a monitoring agent accurately represents what actually happened on the system. SIEM platforms, EDR/XDR backends, audit pipelines, log collectors, and runtime security engines all operate under this trust model.

actual system behavior == collected telemetry == observed security data

SunnyDayBPF challenges this assumption. The research demonstrates that a gap exists between what actually happened on a system and what a security agent observes and reports. If the agent reads data but the data no longer represents the original event, the entire downstream pipeline operates on a false representation of reality.

The event still happens. The monitoring agent still reads data. But the data observed no longer represents the original event.

How It Works

SunnyDayBPF implements a post syscall telemetry deception model. The technique uses eBPF programs attached to syscall tracepoints to intercept the return path of read-like system calls. The manipulation occurs in the narrow window after the kernel has written data into the user space buffer but before the monitoring agent processes that data.

Syscall Timeline: The Manipulation Window sys_enter BPF Program Entry Identify target process Record buffer pointer Store in BPF map kernel work Kernel Processes Syscall Read data from source Copy to user buffer Original data written sys_exit MANIPULATION WINDOW Syscall completed Buffer contains real data bpf_probe_write_user() rewrites buffer contents agent reads Normal Flow vs. SunnyDayBPF Flow Normal Telemetry Pipeline System activity Agent reads data Agent parses original data Detection logic Accurate SIEM/EDR ground truth == observed telemetry SunnyDayBPF Deception System activity Agent reads data Buffer rewritten by BPF Detection logic (altered) Misleading SIEM/EDR ground truth != observed telemetry

Technical Model

The deception operates at the boundary between kernel-provided data and user space agent interpretation. At the sys_enter tracepoint, the BPF program identifies a target telemetry-consuming process by its comm name or PID, then records the user space buffer pointer involved in the read-like operation into a BPF map.

At the sys_exit tracepoint, the BPF program verifies that the syscall completed successfully (return value > 0), retrieves the previously stored buffer pointer, inspects the contents, and selectively alters telemetry-relevant content using bpf_probe_write_user. The target process continues execution normally, unaware that its buffer has been modified.

Key Distinction from Traditional Evasion

Traditional evasion attempts to prevent events from being seen: hiding processes, disabling sensors, avoiding detection triggers. SunnyDayBPF takes a fundamentally different approach. It allows the event to occur, allows the monitoring process to read data, and alters the observation before processing. The distinction is between hiding and deceiving.

ApproachMethodEvent visible?Agent runs?Data accurate?
Traditional evasionHide or prevent eventNoYesN/A
Sensor disablingKill or stop agentNoNoN/A
SunnyDayBPFAlter observationYesYesNo

Affected Telemetry Paths

The technique is relevant to any monitoring system that reads telemetry through read-like syscalls into user space buffers. This includes but is not limited to:

Downstream Impact: What Trusts Agent Telemetry? Compromised Telemetry SIEM Platform EDR/XDR Audit Pipeline Alerting Logic Forensic Timeline Compliance Logging Incident Response All downstream systems receive misleading data

Prerequisites and Constraints

RequirementDetails
CapabilitiesCAP_BPF + CAP_PERFMON (or root)
Kernel configCONFIG_BPF_KPROBE_OVERRIDE=y for bpf_probe_write_user
Target bufferMust be in writable user memory (stack/heap, not .rodata)
BPF helpersbpf_probe_read_user, bpf_probe_write_user, bpf_get_current_comm
AttachmentTracepoints: sys_enter_read, sys_exit_read (and variants)

The Deeper Question

SunnyDayBPF highlights that defenders should not only ask "did the event happen?" but also "can I trust the path through which I observed the event?"

Many detection systems trust data after it is collected by user space agents. If that data can be changed after collection but before processing, then downstream systems may receive a misleading view of the system. This impacts alerting logic, forensic timelines, process visibility, file activity monitoring, compliance logging, audit trails, behavioral detection, and incident response workflows.

The defense against observation-layer deception requires correlation across independent telemetry sources. A single-source telemetry model, where one agent provides all visibility, is fundamentally fragile against this class of attack. Defenders should monitor loaded eBPF programs, restrict BPF capabilities in production, audit unexpected tracepoint and kprobe attachments, and compare user space agent telemetry with independent kernel-level telemetry.

GitHub Repository