SunnyDayBPF: Post-Syscall User-Buffer Telemetry Deception with eBPF


Security tools do not observe reality directly.

They observe telemetry.

And telemetry is only as trustworthy as the path that produced it.

SunnyDayBPF is a research technique that explores what happens when that path can be...