EBPF Attacks

EBPF Attacks is an AI Engineering skill for Claude Code, published by CyberStrikeus in CyberStrike.

1.7K stars269 forkson CyberStrikeus/CyberStrikeAdded 2026/08/12+4% in starsRepository updated 2026/08/12

aiai-agentai-securitybug-bountycybersecuritydevsecopsethical-hackinghackinghacking-toolllmmcpmcp-servermitre-attackoffensive-securityowasppenetration-testingpentestred-teamsecuritysecurity-tools

Install in seconds

Install EBPF Attacks

Copy EBPF Attacks into your Claude Code skills folder. Run the command in your terminal, or review the source on GitHub before installing.

terminal

npx degit https://github.com/CyberStrikeus/CyberStrike/tree/main/.cyberstrike/skill/ebpf-attacks ~/.claude/skills/ebpf-attacks

Requires Node.js. Downloads this skill only — not the rest of the repository — into your Claude Code skills folder.

Without Node.js

git clone https://github.com/CyberStrikeus/CyberStrike.git

Clones the whole repository, then copy the skill’s own directory into your skills folder yourself.

In this catalog

Source file: .cyberstrike/skill/ebpf-attacks/SKILL.md in CyberStrikeus/CyberStrike
Installs to: ~/.claude/skills/ebpf-attacks
Collection: One of 51 skills cataloged from this repository
Category: AI Engineering — 2451 skills

What EBPF Attacks does

EBPF Attacks documents eBPF-based post-exploitation techniques on Linux, including credential harvesting, process hiding, and traffic interception. Use it when working with kernel-level monitoring or stealth-detection workflows.

EBPF Attacks is cataloged under AI Engineering on DirSkills. EBPF Attacks comes from a repository tagged ai, ai-agent, ai-security, bug-bounty and cybersecurity.

Documentation

README

Excerpt

eBPF Post-Exploitation Methodology

eBPF (Extended Berkeley Packet Filter) enables kernel-level instrumentation without loading kernel modules. After gaining root on a Linux target, eBPF programs can intercept system calls, userspace function calls, and network traffic — operating below userland monitoring tools.

Prerequisites

Before deploying eBPF tools, verify:

Root access — all eBPF operations require CAP_SYS_ADMIN or CAP_BPF
Kernel version — Linux 4.18+ for full BPF features, 5.8+ for BPF ring buffer
BCC installed — python3 -c "from bcc import BPF" must succeed on target
No BPF LSM — check cat /sys/kernel/security/lsm for bpf restrictions

This is the opening of the README. Read the full README on GitHub.

Frequently asked about EBPF Attacks

What else does CyberStrikeus publish alongside EBPF Attacks?
EBPF Attacks is one of 51 skills that DirSkills catalogs from CyberStrikeus/CyberStrike, the repository it ships in. Its siblings there include AMI Age Compliance, AMI Encryption Check and AMI Naming Convention Compliance. Each one is a separate skill with its own page in this directory, installs the same way EBPF Attacks does, and is maintained by CyberStrikeus in that same repository. The rest of the collection is listed on the CyberStrikeus/CyberStrike page.
How does EBPF Attacks compare to other AI Engineering skills?
EBPF Attacks ranks #925 by stars among the 2451 AI Engineering skills in this catalog. The most-starred ones next to it are Architecture Decision Records, AI-First Engineering and Agentic OS. DirSkills ranks by the star count of the repository each skill ships in, so that order reflects how popular those repositories are rather than any review of EBPF Attacks against them. Open each page to compare what they document and how they install.