The Detection Problem
Legitimate Linux software also renames tasks, opens connections, starts shells, and uses debugging interfaces. Treating one unusual syscall as a malware verdict creates noise rather than detection. ZayoSentry keeps kernel events neutral until time, PID context, and independent behavioral signals support correlation.
Detection without context is noise.
Architecture
The kernel layer reports facts. A C/libbpf sensor reads ring-buffer events, while the Python layer adds process context, correlates signals, invokes ZayoELF when applicable, and writes the incident report.
Kernel Telemetry
The sensor exposes behavioral primitives; it does not label them malicious in the kernel. Coverage verified from the BPF and C userspace sources:
| TRACEPOINT / CALL | TELEMETRY PRIMITIVE | CONTEXT |
|---|---|---|
sched_process_exec | Process execution | Exec lifecycle and executable path |
sched_process_exit | Process exit | Exit code and measured lifetime |
socket(AF_PACKET) | Packet socket | Raw packet visibility |
setsockopt(SO_ATTACH_FILTER) | Classic BPF filter | Socket-filter attachment |
prctl(PR_SET_NAME) | Process rename | Task-name change signal |
connect(AF_INET) | Outbound connection | IPv4 destination and port |
ptrace | Ptrace activity | Debugging or injection context |
unlinkat | Self-deletion context | Deleted backing executable check |
open / openat / openat2 | Persistence write | Writable access to configured startup paths |
Current network destination telemetry is IPv4-only. The AF_PACKET hook records domain 17 socket creation; the userspace output describes it as raw-socket telemetry.
Context-Aware Correlation
A critical detection requires score ≥ 6 and either two strong categories, or one strong category plus at least three distinct scored categories. A category contributes points once per PID context, preventing repeated weak events from inflating the result.
| CATEGORY | SCORE | QUALITY |
|---|---|---|
persistence_write | +4 | strong |
raw_socket | +3 | strong |
writable_dir_execution | +3 | strong |
self_deletion | +3 | strong |
ptrace | +3 | strong |
bpf_socket_filter | +2 | medium |
suspicious_shell | +2 | medium |
abnormal_pid_file | +2 | medium |
process_renaming | +1 | weak |
outbound_connection | +1 | weak |
shell_execution | 0 | neutral |
memfd_execution | 0 | neutral |
readonly_temp_mount_execution | 0 | neutral |
Operating Modes
MODE 01
LIVE
Starts the host eBPF sensor, correlates telemetry across system processes, and writes a Markdown incident report when the session ends.
MODE 02
SCAN
Runs one target ELF in an isolated container or unshare fallback, filters host-side sensor output to the target process tree, adds ZayoELF output, and writes a verdict report.
+ ZAYOELF STATIC→CORRELATED REPORT
- Podman preferred; Docker then unshare are fallbacks.
- Default network: none
- Read-only root filesystem and read-only target bind mount
- 256 MB memory, 100 PID, 15-second default timeout
- Container executes as UID 10001; these controls reduce exposure but are not an isolation guarantee.
ZayoELF Integration
ZayoELF remains an independent static-analysis project. In Scan mode, ZayoSentry runs it host-side against the target before dynamic execution; after a correlated live detection it can also inspect the process backing file. Results and SHA-256 metadata are included in the incident record.
READ THE ZAYOELF REPORT →Detection Logic / ATT&CK Context
The rules attach ATT&CK context to reported actions. Several mappings are intentionally broad or combined; they are reporting context, not proof that a complete technique occurred.
| RULE CONTEXT | MITRE ATT&CK |
|---|---|
| Suspicious shell execution | T1059 |
| Writable-directory execution | T1204 / T1036 |
| Boot-script persistence | T1547.010 |
| Self-deletion | T1070.004 |
| Ptrace activity | T1055 |
| AF_PACKET / BPF filter | T1040 |
| Process renaming | T1036.003 |
| Outbound connection | T1071 / T1090 |
Validation
A controlled BPFDoor-inspired fixture exercises a writable-directory launch followed by process renaming, AF_PACKET raw-socket creation, classic BPF filter attachment, and an IPv4 connection. It is validation of that behavior chain—not a claim of coverage for every BPFDoor variant.
readonly_temp_mount_execution+0process_renaming+1raw_socket+3bpf_socket_filter+2outbound_connection+1
Engineering Decisions
Read-only execution
Execution from a temporary path scores 0 when its mount is read-only, covering the scan bind mount and similar contexts.
memfd
A memfd-backed executable is normalized to neutral memfd execution rather than scored as masquerading.
Shell context
Shell execution starts at 0 and becomes +2 only when a strong category exists in the same context window.
Self exclusion
Sensor, dashboard, and ZayoELF processes use PID and exact-name matching rather than broad substring suppression.
Limitations & Future Work
- Replace the text/regex sensor interface with a structured NDJSON or binary event protocol.
- Add unit tests and CI for rules, garbage collection, and correlation behavior.
- Track cgroup/container identity alongside PID context.
- Extend connect telemetry to IPv6.
- Clarify thread identity with explicit TID/TGID handling.
- Measure sensor overhead and event throughput.
Project Lineage
The project builds on a research progression rather than replacing earlier work: ATT&CK labs developed reproducible behavior studies; ZayoELF added ELF triage; Red Menshen/BPFDoor research supplied a Linux tradecraft case; ZayoSentry brings those threads into telemetry and detection engineering.
Technical Stack / Source
- KERNEL / SENSOR
- eBPF · CO-RE · C · libbpf · ring buffer
- ENGINE
- Python · PyYAML · PID context · Markdown reports
- ANALYSIS
- Podman / Docker / unshare · ZayoELF · pyelftools
- SOURCE
- No verified public ZayoSentry source URL was present in the supplied archive or portfolio data.