Title
#ebpf
sundsta

sundsta

05/10/2021, 7:13 PM
https://github.com/microsoft/ebpf-for-windows interesting news in this space! Has anyone tested if the existing bpf tables for osquery work with this?
s

seph

05/10/2021, 7:15 PM
I was just going to post that! 🙂
Mike Myers

Mike Myers

05/10/2021, 7:52 PM
It probably would be possible to collect similar process/socket events using this on Windows. But, the getting started guide begins with "first, load these device drivers" so that's a dead-end for osquery. If Windows starts shipping with eBPF drivers loaded already, someone could port osquery's BPF tables to windows
a

alessandrogario

05/10/2021, 10:16 PM
if it's bpf i'll do it! 😎
defensivedepth

defensivedepth

05/16/2021, 2:34 PM
So if we were able to pre-load the device drivers outside of core osquery, then
maybe?
it would work? Would it be possible for Launcher or Orbit to load the drivers @seph @zwass?
zwass

zwass

05/16/2021, 2:39 PM
Definitely something worth looking into. It is intended for Orbit to be able to handle some outside-of-osquery setup.
a

alessandrogario

05/16/2021, 3:16 PM
is this something we can already experiment with?
zwass

zwass

05/16/2021, 3:31 PM
Seems like yes based on the github?
s

seph

05/17/2021, 5:56 PM
Launcher could, yes. Obviously it would be a patch. and we’d want to think about failure modes.