PinnedMatheuZ@MatheuzSecurityApr 2, 2025github.com/MatheuZSecurit… Hey guys, I posted a really cool zine in pure TXT about Unhooking Linux EDR, attacking the cleanup_module function, to be able to remove any hook from an EDR for example. Feel free to read.54718115K
MatheuZ@MatheuzSecuritySep 9Fileless ELF execution via the Linux kernel keyring Stored an ELF in kernel slab memory via the keyring and ran it with a direct jump. There is no execve, no fd and no inode anywhere. matheuzsecurity.github.io/hacking/linux-… #fileless #malware #linux #keyringFileless ELF Execution via Kernel KeyringFrom matheuzsecurity.github.io34216313K
MatheuZ@MatheuzSecuritySep 7Wrote a post on fileless ELF execution via O_TMPFILE + execveat(AT_EMPTY_PATH). No memfd_create, no named file, no dentry ever created. Process shows up as /tmp/#220 (deleted) in telemetry. Works since kernel 3.19. matheuzsecurity.github.io/hacking/filele… #linux #redteam #edr #fileless #kernelFileless ELF Execution via O_TMPFILEFrom matheuzsecurity.github.io1411278.6K
MatheuZ@MatheuzSecuritySep 1How Singularity rootkit loads clean with 0 alerts, source obfuscation for YARA, trusted_pids map insertion to silence the BPF event, and /var/lib/dkms/ to skip the .ko creation rule. matheuzsecurity.github.io/hacking/elasti… #Linux #rootkits #edr #eBPF #RedTeam14523.2K