[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRpIE83wFpWazn15blKpcGYP7gn3n1p0QPfEpM7ySt2s":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"0679ee93-a3cf-45f8-aea2-836018fdad56","ebpf-rootkits-a-stealthy-new-threat-evading-traditional-linux-defenses","f884e49c-1777-4850-85f7-e027f72f0f01","eBPF Rootkits: A Stealthy New Threat Evading Traditional Linux Defenses","Threat actors are weaponizing eBPF technology to build rootkits that hook directly into kernel functions without loading detectable kernel modules, allowing them to hide processes, network traffic, and malicious activity from conventional security tools. Because eBPF operates within a privileged but nominally legitimate kernel subsystem, many endpoint detection and monitoring solutions fail to flag its misuse. The active sharing of source code and tutorials on underground forums accelerates the proliferation of these techniques, lowering the barrier for less sophisticated actors. Organizations relying solely on traditional rootkit detection methods are now blind to an entire class of threat that is already deployed in the wild via tools like BPFDoor and Symbiote.","**Immediate actions:**\n- Audit all Linux systems for unexpected or unauthorized eBPF programs using tools such as `bpftool prog list` and restrict eBPF privileges via kernel capabilities (`CAP_BPF`, `CAP_SYS_ADMIN`).\n- Deploy or update EDR\u002FXDR solutions that include eBPF-aware detection capabilities and can inspect BPF map contents and hook points.\n\n**Detection measures:**\n- Implement kernel-level integrity monitoring (e.g., Falco, Tetragon) that can observe eBPF program loading events and alert on anomalous kernel hook registrations.\n- Correlate network traffic anomalies with process-level telemetry to identify hidden connections characteristic of BPFDoor-style rootkits.\n- Collect and centralize eBPF-related audit logs (e.g., `bpf()` syscall events via auditd) to establish a baseline and detect deviations.\n\n**Long-term improvements:**\n- Restrict eBPF usage to only approved, documented use cases by enforcing Linux Security Module (LSM) policies such as SELinux or AppArmor that limit who can load eBPF programs.\n- Maintain a current Linux kernel version to benefit from eBPF security hardening patches and reduce the attack surface exposed to privilege escalation needed to deploy rootkits.\n- Conduct regular threat-hunting exercises targeting eBPF abuse indicators, and train security teams on eBPF internals so they can recognize and investigate suspicious activity.",[12,13,14,15,16],"MITRE ATT&CK T1014: Rootkit","MITRE ATT&CK T1543: Create or Modify System Process","CIS Control 10: Malware Defenses (v8)","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","NIST CSF 2.0 DE.CM-01: Networks and network services are monitored to find potentially adverse events",{"MITRE ATT&CK T1014: Rootkit":18,"CIS Control 10: Malware Defenses (v8)":19,"MITRE ATT&CK T1543: Create or Modify System Process":20,"NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity":21,"NIST CSF 2.0 DE.CM-01: Networks and network services are monitored to find potentially adverse events":22},"BPFDoor and Symbiote directly implement rootkit techniques by using eBPF to hide malicious processes and network connections from the operating system and security tools.","CIS Control 10 requires deploying anti-malware tools capable of detecting rootkits; eBPF rootkits evade tools that do not inspect kernel hook points, exposing the gap this control targets.","eBPF rootkits hook kernel functions at a privileged level to persist and manipulate system behaviour, mirroring the persistence and privilege abuse this technique describes.","SI-7 requires monitoring the integrity of software and kernel components, which would surface unauthorized eBPF programs hooking kernel functions.","Continuous monitoring of network activity and kernel-level events is precisely what eBPF rootkits subvert, making this category directly relevant to detecting their hidden communications.","published","2026-11-11T16:21:00.415887+00:00","2026-11-11T16:21:00.402+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Febpf-rootkits-why-underground-actors-are-taking-notice\u002F","ebpf-rootkits-why-underground-actors-are-taking-notice-acc7a2","eBPF Rootkits: Why Underground Actors Are Taking Notice",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",[],[45,49,53],{"slug":46,"name":47,"problem":48},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":50,"name":51,"problem":52},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",{"slug":54,"name":55,"problem":56},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them."]