BPF Map Poisoning: Attacking Falco from the Inside
Rewriting Falco's BPF map state from userspace to suppress syscall monitoring without touching the eBPF program.
0xMatheuZ
Recent content on 0xMatheuZ
Latest posts
Trend Micro Deep Security Agent Research: Forcing bmhook/tmhook Reloads to Open a Protection Bypass Window
Security research on a local event-storm condition that makes Trend Micro Deep Security Agent unload and reload bmhook/tmhook, creating a repeatable protection bypass window.
Breaking eBPF Security: How Kernel Rootkits Blind Observability Tools
Deep technical analysis of bypassing eBPF-based security solutions through kernel-level hooks targeting BPF iterators, ringbuffers, and perf events
Ioctl Secrets Writeup
Solving an easy reversing challenge from rootkit researchers.
Evading Elastic Security: Linux Rootkit Detection Bypass
Bypassing YARA rules and behavioral detection through symbol randomization, module fragmentation, XOR encoding, and ICMP reverse shell staging
Red Team Tactics: Evading EDR on Linux with io_uring
Learn how to bypass modern defenses with io_uring
breaking ld_preload rootkit hooks
I miss you
Bypassing LD_PRELOAD Rootkits Is Easy
Learn how to bypass LD_PRELOAD rootkits.
ElfDoor-gcc
Hijacking GCC via LD_PRELOAD.
Detecting rootkits based on ftrace hooking.
Learn how to detect rootkit based on ftrace hooking.
How detect a LD_PRELOAD rootkit and hide from ldd & /proc
Learn how to detect and hide a LD_PRELOAD rootkit from ldd, /proc/pid/maps, etc.
A simple way to detect and remove LKM rootkit KoviD (Outdated)
Learn a simple way on how to detect and remove Kovid rootkit.
Linux Threat Hunting Persistence
Learn about persistence in Linux and how to hunt