Skip to main content
Version: Next

🔧 Detection Mechanisms

eBPF-Logo

Jibril employs sophisticated eBPF-based mechanisms to monitor system behavior and collect security-relevant data from the Linux kernel. These mechanisms work together to provide comprehensive visibility into file access, process execution, and network activity—all with minimal performance impact.

🧠 In-Kernel Intelligence

All monitoring logic runs inside the kernel using eBPF,
eliminating expensive context switches and enabling real-time detection.

The result? Sub-microsecond detection latency and
consistent sub-2% CPU usage regardless of workload.

🎯 Core Mechanisms​

Jibril's detection engine is built on several specialized monitoring mechanisms:

🧠 eBPF Foundation​

Kernel-level monitoring using eBPF programs to collect data with minimal performance impact.

Key Features:

  • Query-driven architecture
  • In-kernel data storage
  • Zero event loss
  • Efficient memory usage

Learn more →

📁 File Access Monitoring​

Track filesystem operations including reads, writes, modifications, and deletions.

Detection Capabilities:

  • Suspicious file access patterns
  • Unauthorized access attempts
  • Configuration file tampering
  • Credential file monitoring

Learn more →

⚙️ Execution Tracking​

Monitor process creation, execution, and termination with full ancestry tracking.

Detection Capabilities:

  • Unusual execution patterns
  • Hidden process execution
  • Code injection attempts
  • Malicious tool execution

Learn more →

🔌 Loader Interception​

Intercept and monitor dynamic loader activities to detect execution path bypasses.

Detection Capabilities:

  • Direct loader execution
  • Hidden ELF execution
  • Library injection
  • Code-on-the-fly

Learn more →

🌐 Network Monitoring​

Track network connections, DNS resolutions, and data flows with complete context.

Detection Capabilities:

  • Malicious domain access
  • C2 communication
  • Data exfiltration
  • Network policy enforcement

Learn more → | Network Peers →

🔍 Probes and Traces​

Monitor kernel introspection tools to detect sophisticated attacks and rootkits.

Detection Capabilities:

  • eBPF program loading
  • Perf event monitoring
  • Ftrace usage detection
  • Kernel modification attempts

Learn more →

📚 Detection Coverage​

Jibril's mechanisms enable comprehensive detection across three main categories:

📁 File Access Detection Recipes​

Security Files:

  • Capabilities modification
  • Credentials access
  • SSL certificates
  • SSH key access

System Configuration:

  • PAM configuration
  • Sudoers files
  • Shell configuration
  • Package repositories

Fingerprinting:

  • CPU detection
  • Filesystem analysis
  • Machine identification
  • OS fingerprinting

Code Modification:

  • Procfs manipulation
  • Core pattern access
  • Shared library tampering
  • Binary self-deletion

Java Security:

  • Debug library loading
  • Instrument library loading

View all file access detections →

⚙️ Execution Detection Recipes​

Binary Execution:

  • Loader-based execution
  • Hidden ELF files
  • Unusual directory execution

Code Execution:

  • Code-on-the-fly
  • Interpreter shell spawning
  • Code injection

Network Tools:

  • File copy tools
  • MITM tools
  • Scanning tools
  • Sniffing tools

Credential Access:

  • Text-based lookup
  • Password usage
  • Memory scanning

Suspicious Activity:

  • DoS tool execution
  • Crypto miners
  • Container runtime abuse
  • Webserver shells

View all execution detections →

🌍 Network Peer Detection Recipes​

Threat Intelligence:

  • Badware domains
  • Phishing domains
  • Threat domains
  • C2 servers

Content Categories:

  • Adult content
  • Gambling sites
  • Piracy domains

Algorithmic Detection:

  • Dynamic DNS
  • Algorithmically generated domains (DGA)
  • Fake domains

New Threats:

  • Newly registered domains
  • Suspicious TLDs

Security Risks:

  • Plaintext communication
  • Cloud metadata access
  • VPN-like services
  • Tracking domains

View all network peer detections →

🔬 Technical Deep Dives​

Explore the technical implementation of each mechanism:

🚀 Next Steps​