0xMatheuZ

Using the Linux kernel keyring to stage an ELF in slab memory and execute it via userland exec, skipping execve and the filesystem entirely.

O_TMPFILE creates anonymous inodes on real filesystems with no directory entry.

Elastic Defend 9.5 added taint_flags to the module_load BPF event and a new detection rule on top of it.

Rewriting Falco's BPF map state from userspace to suppress syscall monitoring without touching the eBPF program.

Security research on a local event-storm condition that makes Trend Micro Deep Security Agent unload and reload bmhook/tmhook, creating a repeatable protection bypass window.

Deep technical analysis of bypassing eBPF-based security solutions through kernel-level hooks targeting BPF iterators, ringbuffers, and perf events

Solving an easy reversing challenge from rootkit researchers.

Bypassing YARA rules and behavioral detection through symbol randomization, module fragmentation, XOR encoding, and ICMP reverse shell staging

Learn how to bypass modern defenses with io_uring

I miss you

Learn how to bypass LD_PRELOAD rootkits.

Hijacking GCC via LD_PRELOAD.

Learn how to detect rootkit based on ftrace hooking.

Learn how to detect and hide a LD_PRELOAD rootkit from ldd, /proc/pid/maps, etc.

Learn a simple way on how to detect and remove Kovid rootkit.

Learn about persistence in Linux and how to hunt