Detecting eBPF Malware with Tracee

### Executive Summary This report examines malicious uses of eBPF, focusing on the pamspy malware which uses eBPF uprobes to hook pam_get_authtok in libpam.so and capture cleartext credentials; it details how eBPF programs are loaded and attached via Perf events (tracepoints, kprobes, uprobes, and their return variants) and describes how Aqua Tracee correlates eBPF and Perf event data to detect such malicious instrumentation.