Join our colleague Constanze Roedig, key researcher at SBA Research, at the IT-SECX 2026 conference, in St. Poelten, where she will present Cutting through the noise: real time node-local identification of threats that saves you time and datavolume.
© Constanze Roedig
Abstract
Security Operations Center have the requirement to persist data over long timescales and across system layers in order to allow the future forensic triage of an attack. This prevailing âcollect-everythingâ paradigm leads to excessive costs, low signal-to-noise ratios, and analyst alert fatigue. We propose a digitally sovereign kernel-level anomaly based approach realised by eBPF and signed behavioral profiles (âSoftware Bill of Behaviorâ, SBoB). Our prototype continuously monitors system calls, network traffic, and file operations, detects significant deviations in real time, and triggers event-driven data capture.
This talk will explain how
- pre-correlation allows filtering through millions of false-positives with time-to-verdict in sub-seconds
- expected reduction of data-volume scales with desired precision
- to deal with eBPF blindness
- performance and observability engineering is crucial for robust detections under high loads
For anyone who is tired of alerts.
As well as Reinhard Kugler, Applied Research Consultant at SBA Research, presenting This Build can Break You – Evil Runners and eBPF for Detection.
© Niklas Schnaubelt
Abstract
CI/CD pipelines play an important role in modern software development. From a security perspective, this methodology contributes to more secure products, as automated checks can be applied on every run. Developers define tasks in a metadata file, and the system executes the defined jobs automatically. But what if the build chain itself becomes the security problem, allowing attackers to manipulate artifacts or take control of backend infrastructure? Letâs take a deep dive into âPoisoned Pipeline Executionâ (OWASP CICD-SEC-4).
Builds are typically carried out in multiple steps using Runnersâagents that pick up jobs and execute build instructions. These instructions, such as compiling a program or building a container image, are usually performed inside containers. Containers may provide isolation, but the effectiveness in terms of security strongly depends on the Runnerâs configuration. Attackers can abuse Runners to execute arbitrary commands, leading to information disclosure or privilege escalation. While such attacks are well documented, effective detection mechanisms are often lacking.
Any viable detection method must be independent of the source code, language-agnostic, and container-friendly. The eBPF technology, which enables tracing of kernel-level activity, is well suited for this purpose. In this talk, we explore security vulnerabilities in CI Runners, how they become targets for attackers, and how malicious activities can be detected using eBPF.
About the event
IT Security Community Exchange (IT-SECX) is a conference focused on IT security, bringing together cybersecurity professionals, researchers, technology experts, and industry practitioners to exchange knowledge and discuss current challenges, emerging threats, and innovative approaches to information security.