For most of the history of Linux security monitoring, defenders faced an ugly choice: userspace agents that attackers could blind, or kernel modules that could take down the fleet they were protecting. eBPF dissolved that trade-off, and the consequences for detection engineering are still being absorbed. Small verified programs now run inside the kernel, attached to syscalls, network paths, and internal tracepoints, streaming ground-truth telemetry with overhead low enough to leave on everywhere.
Why the Kernel Vantage Point Matters
The recurring lesson of intrusion forensics is that userspace lies. Processes can hide from listings, libraries can be preloaded to filter what monitoring agents see, and logs can simply be deleted. The kernel, by contrast, is where the events actually happen — a process either called execve or it did not, a socket either connected or it did not. Instrumenting at that layer means observing the syscall itself rather than trusting a userspace shim’s account of it.
Two attachment families do most of the security work. Tracepoints and kprobes observe events — process execution, file opens, privilege transitions, network connections — feeding detection pipelines. LSM-attached programs go further and enforce, allowing policy like “this container may never spawn a shell” to be evaluated in-kernel before the operation completes. Together they turn hunting hypotheses into queries against live kernel state: show me every process that opened a raw socket, every binary executed from a world-writable path, every outbound connection made by a workload that has never made one before.
What Changes for the Hunt Team
The practical shift is from artifact archaeology to behavioral observation. Instead of reconstructing an intrusion from whatever logs survived, hunters work with complete process ancestry — which shell spawned which interpreter, which connected where — captured at the moment it happened. Container awareness is the second dividend: because eBPF sees cgroup and namespace context, a connection can be attributed to a specific pod and image rather than to a node IP, which is the difference between a lead and a finding in Kubernetes environments.
eBPF moves the defender’s vantage point below the layer where most attackers currently know how to lie.
Note the word “currently.” Sophisticated adversaries are already adapting — researching detection blind spots between probe points, timing races in event submission, and, most directly, using eBPF themselves. Malicious eBPF programs make effective rootkits precisely because of the visibility the technology grants. This cuts in an instructive direction: loading eBPF requires elevated privileges, so a defender who monitors and restricts program loading turns the attacker’s tool into a high-signal tripwire. Treat every unexpected BPF program load on a production host as an incident until proven otherwise.
Operational Realities Before You Deploy
The technology is genuinely good; the deployments that fail do so for operational reasons.
- Kernel version spread across a real fleet complicates portability — insist on tooling built on CO-RE and BTF rather than per-kernel compilation.
- Event volume at kernel granularity is enormous; filter and aggregate in-kernel, because shipping raw syscall streams to a SIEM is a budget incident.
- Verifier safety protects the kernel from crashes, not your latency budget — measure overhead on your own workloads, especially on hot network paths.
- Enforcement mode deserves the same rollout discipline as any blocking control: observe first, alert second, block last.
Building Toward Durable Advantage
The teams getting the most from this shift treat eBPF telemetry as a substrate, not a product category. They start with the vendor or open-source tooling, but they invest in their own detections: encoding knowledge of their environment — which workloads should never exec, which namespaces should never talk to the internet — as in-kernel policy and high-signal alerts. That environmental specificity is what generic malware cannot anticipate.
The honest summary is that eBPF hands defenders a structural advantage on Linux for the first time in years: kernel-truth visibility at a cost that permits universal deployment. Advantages like that decay as adversaries adapt, which is precisely the argument for building competence now, while the asymmetry still favors you.