MatheuZ

github.com/MatheuZSecurit…

Hey guys, I posted a really cool zine in pure TXT about Unhooking Linux EDR, attacking the cleanup_module function, to be able to remove any hook from an EDR for example. Feel free to read.

Singularity LKM rootkit evading LiME and Volatility 3

My rootkit hooks walk_system_ram_res so LiME never copies its physical pages and vol3 found nothing

CheckFtrace crashes on a poisoned page and pstree, psscan, pslist all come back empty for hidden proc. hidden_modules too.

Fileless ELF execution via the Linux kernel keyring

Stored an ELF in kernel slab memory via the keyring and ran it with a direct jump. There is no execve, no fd and no inode anywhere.

matheuzsecurity.github.io/hacking/linux-…

#fileless #malware #linux #keyring

Wrote a post on fileless ELF execution via O_TMPFILE + execveat(AT_EMPTY_PATH). No memfd_create, no named file, no dentry ever created. Process shows up as /tmp/#220 (deleted) in telemetry. Works since kernel 3.19.

matheuzsecurity.github.io/hacking/filele…

#linux #redteam #edr #fileless #kernel