Member-only story
eBPF-Based Kernel Rootkits: Unmasking Stealth Persistence & Detection Primitives
How modern Linux malware leverages the BPF virtual machine for socket manipulation and telemetry evasion, and how EDRs detect it.
The In-Kernel Boundary: By shifting execution from loadable kernel modules (LKMs) directly into the eBPF JIT compiler, modern rootkits execute inside trusted kernel space without touching disk or registering standard module hooks.
Traditional Linux rootkits relied heavily on loading custom Loadable Kernel Modules (LKMs) or hooking the sys_call_table. Modern kernel-hardening mechanisms—such as strict module signing and Kernel Address Space Layout Randomization (KASLR)—have made legacy LKM rootkits increasingly easy for Endpoint Detection and Response (EDR) platforms to flag.
Enter eBPF (Extended Berkeley Packet Filter). Originally designed for high-performance packet filtering and observability, eBPF allows sandboxed programs to execute directly within the Linux kernel.
However, threat actors now weaponize helper functions like bpf_probe_write_user() to modify process memory on the fly, conceal active network connections, and suppress EDR telemetry before it ever leaves kernel memory.
