If you've been following Linux security, you know that eBPF is a double-edged sword. It's incredible for observability and networking, but it's also the new favorite playground for Linux rootkits. Most open-source security rules try to catch eBPF malware when it loads into the kernel (usually by watching bpftool **or the **bpf() syscall). But I noticed a gap in the Elastic Security detection-rules repository: What about when the malware compiles itself? ** To dodge file hashes and static...