Kunai: Your New Threat Hunting Tool For Linux

The speaker, an independent incident response consultant, introduces Kunai, a Linux monitoring tool for threat hunting intended to fill the gap left by Sysmon on Windows. His objections to the existing Linux port covered its XML configuration, a C++ codebase that is hard to collaborate on, a Windows-style event set that fits Linux poorly, and a repository that had gone quiet. His goals were to keep the useful ideas, balance raw and over-processed events, and provide solid documentation.

Kunai relies on eBPF rather than a kernel module. eBPF programs pass a verifier, run in a sandboxed virtual machine inside the kernel, attach to many kernel points, and share data with user space through maps. Rust was chosen so one language covers both kernel and user-space code, using the Aya library. The speaker also describes the learning curve, a mid-project library switch, and upstream contributions. Features include process tracking by unique IDs, events for executed and memory-mapped files, chronological JSON output, and host-side correlation, such as attaching a hostname to a connection using an earlier DNS event. Container activity is harder because files inside containers are not visible from the host.

Using CO-RE, a single binary runs on LTS kernels from 5.4 to 6.1, and the project's CI tests each kernel. Future development depends on funding and includes new probes. In questions, the speaker suggested Android could work but doubted Apple's kernel supports the needed eBPF features.