How to catch crypto miners using syscall signatures

This post details the implementation of `seccheck`, a syscall-based abuse detection system integrated into Modal's gVisor runtime. It explains the limitations of metadata analysis for detecting cryptominers and highlights the effectiveness of analyzing program behavior via syscalls. The post describes how gVisor's interception capabilities are leveraged to capture syscall trace data with minimal performance overhead. It outlines the analysis rules, focusing on `execve` syscalls for detecting non-Python subprocesses, and the process of emitting `TaskMessage::SecurityEvent` for server-side decision-making. Future enhancements like memory analysis and NVIDIA control command monitoring are also mentioned.