On Detection, Information Security, Research, Detection Engineering.
behavior will be similar to the previous tools we’ve analyzed. An advantage of BOFs is that they integrate the functionality directly into the agent itself, removing many more superficial detection opportunities. For instance, when executed, it does not create a process (like NetSess.exe or