Jacob Gajek
Principal Security Researcher
eSentire
About
Jacob Gajek is Principal Security Researcher at eSentire with 25 years of experience spanning software development, network engineering, advanced security research, malware analysis, and incident response. His current work focuses on endpoint defense, kernel-level reverse engineering, and AI-driven security automation.
Sessions
Reverse Engineering EDR Kernel Drivers with AI
What you will learn:
1. Differentiate between eBPF hook types — tracepoints, kprobes, uprobes, and LSM hooks — and select the right one for a given security monitoring or enforcement use case 2. Build eBPF security programs in Rust using the Aya framework without writing C or depending on BCC 3. Implement LSM BPF hooks (bprm_check_security, socket_connect, security_task_kill) to block threats at the kernel level before syscalls complete 4. Navigate eBPF verifier constraints in practice — stack limits, bounded loops, per-CPU arrays, and kernel struct offset portability across kernel versions 5. Detect fileless malware by tracing memfd_create syscalls and capture TLS plaintext via OpenSSL uprobes without a MITM proxy