Tech
I wrote a new Elastic detection rule to catch eBPF rootkits compiling on-host 🛡️
If you've been following Linux security, you know that eBPF is a double-edged sword. It's incredible for observability and networking, but it's also the new favorite playground for Linux rootkits.
Most open-source security rules try to catch eBPF malware when it loads into the kernel (usually by watching bpftool **or the **bpf() syscall). But I noticed a gap in the Elastic Security detection-rules repository: What about when the malware compiles itself?
**
To dodge file hashes and static...
Read the full discussion on Dev.to
This article was aggregated from Dev.to. Click to join the conversation.
View on Dev.to