Linux Rootkit Abuses Elastic trusted_pids eBPF Map to Bypass Module Load Detection

A new technique was demonstrated that evades Elastic Defend in the Singularity Linux rootkit by suppressing telemetry from the product’s kernel-module load monitoring. The research documented by matheuzsecurity shows how a rootkit loader can abuse Elastic’s trusted_pids eBPF map to prevent a module-load event from being generated while a malicious...