{
 "type": "excalidraw",
 "version": 2,
 "source": "https://excalidraw.com",
 "elements": [
  {
   "id": "r1860188207",
   "type": "rectangle",
   "x": 40,
   "y": 120,
   "width": 190,
   "height": 64,
   "angle": 0,
   "strokeColor": "#2f6db5",
   "backgroundColor": "#eef4fb",
   "fillStyle": "solid",
   "strokeWidth": 2,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": {
    "type": 3
   },
   "seed": 1869138974,
   "versionNonce": 796403933,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false
  },
  {
   "id": "t1009643847",
   "type": "text",
   "x": 50,
   "y": 128,
   "width": 53.900000000000006,
   "height": 17.5,
   "angle": 0,
   "strokeColor": "#111111",
   "backgroundColor": "transparent",
   "fillStyle": "solid",
   "strokeWidth": 1,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": null,
   "seed": 369937194,
   "versionNonce": 1026153522,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false,
   "text": "process",
   "fontSize": 14,
   "fontFamily": 1,
   "textAlign": "left",
   "verticalAlign": "top",
   "containerId": null,
   "originalText": "process",
   "lineHeight": 1.25,
   "baseline": 14
  },
  {
   "id": "t1662403032",
   "type": "text",
   "x": 50,
   "y": 148,
   "width": 139.15,
   "height": 13.75,
   "angle": 0,
   "strokeColor": "#555555",
   "backgroundColor": "transparent",
   "fillStyle": "solid",
   "strokeWidth": 1,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": null,
   "seed": 1313907364,
   "versionNonce": 877841365,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false,
   "text": "execve(/tmp/forbidden\u2026)",
   "fontSize": 11,
   "fontFamily": 1,
   "textAlign": "left",
   "verticalAlign": "top",
   "containerId": null,
   "originalText": "execve(/tmp/forbidden\u2026)",
   "lineHeight": 1.25,
   "baseline": 11
  },
  {
   "id": "r1327332546",
   "type": "rectangle",
   "x": 310,
   "y": 110,
   "width": 230,
   "height": 80,
   "angle": 0,
   "strokeColor": "#e8870c",
   "backgroundColor": "#fff8ef",
   "fillStyle": "solid",
   "strokeWidth": 2,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": {
    "type": 3
   },
   "seed": 1321327562,
   "versionNonce": 806019245,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false
  },
  {
   "id": "t165124890",
   "type": "text",
   "x": 320,
   "y": 118,
   "width": 77.0,
   "height": 17.5,
   "angle": 0,
   "strokeColor": "#111111",
   "backgroundColor": "transparent",
   "fillStyle": "solid",
   "strokeWidth": 1,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": null,
   "seed": 929554377,
   "versionNonce": 257870874,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false,
   "text": "tracepoint",
   "fontSize": 14,
   "fontFamily": 1,
   "textAlign": "left",
   "verticalAlign": "top",
   "containerId": null,
   "originalText": "tracepoint",
   "lineHeight": 1.25,
   "baseline": 14
  },
  {
   "id": "t1098245010",
   "type": "text",
   "x": 320,
   "y": 138,
   "width": 96.80000000000001,
   "height": 13.75,
   "angle": 0,
   "strokeColor": "#555555",
   "backgroundColor": "transparent",
   "fillStyle": "solid",
   "strokeWidth": 1,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": null,
   "seed": 527410412,
   "versionNonce": 1172950963,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false,
   "text": "sys_enter_execve",
   "fontSize": 11,
   "fontFamily": 1,
   "textAlign": "left",
   "verticalAlign": "top",
   "containerId": null,
   "originalText": "sys_enter_execve",
   "lineHeight": 1.25,
   "baseline": 11
  },
  {
   "id": "r663862981",
   "type": "rectangle",
   "x": 610,
   "y": 62,
   "width": 230,
   "height": 56,
   "angle": 0,
   "strokeColor": "#111111",
   "backgroundColor": "#ffffff",
   "fillStyle": "solid",
   "strokeWidth": 2,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": {
    "type": 3
   },
   "seed": 1139023827,
   "versionNonce": 50338109,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false
  },
  {
   "id": "t1464340403",
   "type": "text",
   "x": 620,
   "y": 70,
   "width": 130.9,
   "height": 17.5,
   "angle": 0,
   "strokeColor": "#111111",
   "backgroundColor": "transparent",
   "fillStyle": "solid",
   "strokeWidth": 1,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": null,
   "seed": 1267776213,
   "versionNonce": 1433102117,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false,
   "text": "filename matches?",
   "fontSize": 14,
   "fontFamily": 1,
   "textAlign": "left",
   "verticalAlign": "top",
   "containerId": null,
   "originalText": "filename matches?",
   "lineHeight": 1.25,
   "baseline": 14
  },
  {
   "id": "t694078808",
   "type": "text",
   "x": 620,
   "y": 90,
   "width": 72.60000000000001,
   "height": 13.75,
   "angle": 0,
   "strokeColor": "#555555",
   "backgroundColor": "transparent",
   "fillStyle": "solid",
   "strokeWidth": 1,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": null,
   "seed": 262003182,
   "versionNonce": 558619908,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false,
   "text": "prefix \u2192 yes",
   "fontSize": 11,
   "fontFamily": 1,
   "textAlign": "left",
   "verticalAlign": "top",
   "containerId": null,
   "originalText": "prefix \u2192 yes",
   "lineHeight": 1.25,
   "baseline": 11
  },
  {
   "id": "r659109005",
   "type": "rectangle",
   "x": 610,
   "y": 160,
   "width": 230,
   "height": 62,
   "angle": 0,
   "strokeColor": "#111111",
   "backgroundColor": "#111111",
   "fillStyle": "solid",
   "strokeWidth": 2,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": {
    "type": 3
   },
   "seed": 1285022997,
   "versionNonce": 540942275,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false
  },
  {
   "id": "t963006465",
   "type": "text",
   "x": 620,
   "y": 168,
   "width": 184.8,
   "height": 17.5,
   "angle": 0,
   "strokeColor": "#ffffff",
   "backgroundColor": "transparent",
   "fillStyle": "solid",
   "strokeWidth": 1,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": null,
   "seed": 598583802,
   "versionNonce": 994611709,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false,
   "text": "bpf_send_signal(SIGKILL)",
   "fontSize": 14,
   "fontFamily": 1,
   "textAlign": "left",
   "verticalAlign": "top",
   "containerId": null,
   "originalText": "bpf_send_signal(SIGKILL)",
   "lineHeight": 1.25,
   "baseline": 14
  },
  {
   "id": "t1675840370",
   "type": "text",
   "x": 620,
   "y": 188,
   "width": 145.20000000000002,
   "height": 13.75,
   "angle": 0,
   "strokeColor": "#555555",
   "backgroundColor": "transparent",
   "fillStyle": "solid",
   "strokeWidth": 1,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": null,
   "seed": 354776480,
   "versionNonce": 584610554,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false,
   "text": "process dies before exec",
   "fontSize": 11,
   "fontFamily": 1,
   "textAlign": "left",
   "verticalAlign": "top",
   "containerId": null,
   "originalText": "process dies before exec",
   "lineHeight": 1.25,
   "baseline": 11
  },
  {
   "id": "a68989018",
   "type": "arrow",
   "x": 230,
   "y": 152,
   "width": 80,
   "height": 0,
   "angle": 0,
   "strokeColor": "#555555",
   "backgroundColor": "transparent",
   "fillStyle": "solid",
   "strokeWidth": 2,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": {
    "type": 2
   },
   "seed": 684509286,
   "versionNonce": 1381982829,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false,
   "points": [
    [
     0,
     0
    ],
    [
     80,
     0
    ]
   ],
   "lastCommittedPoint": null,
   "startBinding": null,
   "endBinding": null,
   "startArrowhead": null,
   "endArrowhead": "arrow"
  },
  {
   "id": "t1561188006",
   "type": "text",
   "x": 270.0,
   "y": 138.0,
   "width": 40,
   "height": 13.75,
   "angle": 0,
   "strokeColor": "#555555",
   "backgroundColor": "transparent",
   "fillStyle": "solid",
   "strokeWidth": 1,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": null,
   "seed": 456316154,
   "versionNonce": 781826076,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false,
   "text": "exec",
   "fontSize": 11,
   "fontFamily": 1,
   "textAlign": "left",
   "verticalAlign": "top",
   "containerId": null,
   "originalText": "exec",
   "lineHeight": 1.25,
   "baseline": 11
  },
  {
   "id": "a1262376458",
   "type": "arrow",
   "x": 540,
   "y": 140,
   "width": 70,
   "height": 50,
   "angle": 0,
   "strokeColor": "#555555",
   "backgroundColor": "transparent",
   "fillStyle": "solid",
   "strokeWidth": 2,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": {
    "type": 2
   },
   "seed": 1189359119,
   "versionNonce": 645472554,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false,
   "points": [
    [
     0,
     0
    ],
    [
     70,
     -50
    ]
   ],
   "lastCommittedPoint": null,
   "startBinding": null,
   "endBinding": null,
   "startArrowhead": null,
   "endArrowhead": "arrow"
  },
  {
   "id": "t1203490036",
   "type": "text",
   "x": 575.0,
   "y": 101.0,
   "width": 78.65,
   "height": 13.75,
   "angle": 0,
   "strokeColor": "#555555",
   "backgroundColor": "transparent",
   "fillStyle": "solid",
   "strokeWidth": 1,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": null,
   "seed": 1140094654,
   "versionNonce": 1387441346,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false,
   "text": "read filename",
   "fontSize": 11,
   "fontFamily": 1,
   "textAlign": "left",
   "verticalAlign": "top",
   "containerId": null,
   "originalText": "read filename",
   "lineHeight": 1.25,
   "baseline": 11
  },
  {
   "id": "a1563438336",
   "type": "arrow",
   "x": 725,
   "y": 118,
   "width": 0,
   "height": 42,
   "angle": 0,
   "strokeColor": "#b8650a",
   "backgroundColor": "transparent",
   "fillStyle": "solid",
   "strokeWidth": 2,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": {
    "type": 2
   },
   "seed": 956403721,
   "versionNonce": 812762510,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false,
   "points": [
    [
     0,
     0
    ],
    [
     0,
     42
    ]
   ],
   "lastCommittedPoint": null,
   "startBinding": null,
   "endBinding": null,
   "startArrowhead": null,
   "endArrowhead": "arrow"
  },
  {
   "id": "t642974934",
   "type": "text",
   "x": 725.0,
   "y": 125.0,
   "width": 42.35,
   "height": 13.75,
   "angle": 0,
   "strokeColor": "#b8650a",
   "backgroundColor": "transparent",
   "fillStyle": "solid",
   "strokeWidth": 1,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": null,
   "seed": 544700362,
   "versionNonce": 1183510131,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false,
   "text": "matched",
   "fontSize": 11,
   "fontFamily": 1,
   "textAlign": "left",
   "verticalAlign": "top",
   "containerId": null,
   "originalText": "matched",
   "lineHeight": 1.25,
   "baseline": 11
  },
  {
   "id": "t986816121",
   "type": "text",
   "x": 440,
   "y": 24,
   "width": 484.00000000000006,
   "height": 13.75,
   "angle": 0,
   "strokeColor": "#b8650a",
   "backgroundColor": "transparent",
   "fillStyle": "solid",
   "strokeWidth": 1,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": null,
   "seed": 1089821302,
   "versionNonce": 639080273,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false,
   "text": "react, don't just watch: kill the process the moment it execs a forbidden binary",
   "fontSize": 11,
   "fontFamily": 1,
   "textAlign": "left",
   "verticalAlign": "top",
   "containerId": null,
   "originalText": "react, don't just watch: kill the process the moment it execs a forbidden binary",
   "lineHeight": 1.25,
   "baseline": 11
  },
  {
   "id": "t77667086",
   "type": "text",
   "x": 440,
   "y": 274,
   "width": 375.1,
   "height": 13.75,
   "angle": 0,
   "strokeColor": "#888888",
   "backgroundColor": "transparent",
   "fillStyle": "solid",
   "strokeWidth": 1,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": null,
   "seed": 1140387468,
   "versionNonce": 1071715538,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false,
   "text": "a 'signal program' \u2014 lab-only offense that illuminates defense",
   "fontSize": 11,
   "fontFamily": 1,
   "textAlign": "left",
   "verticalAlign": "top",
   "containerId": null,
   "originalText": "a 'signal program' \u2014 lab-only offense that illuminates defense",
   "lineHeight": 1.25,
   "baseline": 11
  }
 ],
 "appState": {
  "viewBackgroundColor": "#ffffff",
  "gridSize": null
 },
 "files": {}
}