[jeffrallen]

Here's an idea for an interesting hack: a piece of kernel resident code that feeds fake data into eBPF so that an eBPF-based antimalware will see nothing bad as the malware goes about it's merry way.

Sandboxes are safe, but are ultimately virtual machines, and virtual machines can be made to live in a world that's not real.