Linux Rootkit Abuses Elastic trusted_pids eBPF Map to Bypass Module Load Detection
Brief
A new technique was demonstrated that evades Elastic Defend in the Singularity Linux rootkit by suppressing telemetry from the product’s kernel-module load monitoring.
The research documented by matheuzsecurity shows how a rootkit loader can abuse Elastic’s trusted_pids eBPF map to prevent a module-load event from being generated while a malicious Linux kernel module is inserted.
Elastic Defend has used a BPF-based module_load event since approximately version 8.
- In version 9.
- 0, Elastic added a taint_flags field to the event and introduced a corresponding EQL rule, “Kernel Module Loaded with Tainting Flags.”
Linux Rootkit Abuses Elastic trusted_pids eBPF Map
The field is collected from the kernel module’s taint state after its initialization routine runs, helping defenders identify unsigned, externally built, or otherwise tainted modules.