An advanced technical presentation and research repository detailing the evolution of Linux threat mechanics—moving from userland hooking (LD_PRELOAD) into kernel-space subversion (ftrace), fileless in-memory execution, and modern eBPF offensive primitives.
-
Module 1: Userland Interception & Linker Hijacking
- Mechanics of
/etc/ld.so.preloadand dynamic linking. - Process hiding and network flow redirection.
- Case Study: Symbiote (2022).
- Mechanics of
-
Module 2: Fileless & In-Memory Execution
- Bypassing
noexecmounts withmemfd_createandfexecve. - Anonymous file descriptors and hidden memory mappings.
- Case Study: Kinsing / H2Miner.
- Bypassing
-
Module 3: Ring 0 Kernel Rootkits &
ftraceSubversion- From brittle
sys_call_tablepatching to opcode-safeftracedynamic hooking. - Direct Kernel Object Manipulation (DKOM) for task/module hiding.
- Case Study: Drovorub (APT28).
- From brittle
-
Module 4: eBPF Offensive Primitives
- Leveraging
fentry/fexitfor silent kernel tracing and manipulation. - In-memory authorization bypasses and zero-port network listeners.
- Case Study: BPFDoor (Red Menshen).
- Leveraging
-
Module 5: Defensive Architecture & Hardening
- Telemetry asymmetry and detection engineering.
- Kernel Lockdown mode, module signing, and BPF restrictions.
- Presentation slides, architecture diagrams, and thematic assets.
- Conceptual proof-of-concept snippets and detection logic (e.g., verifying
ftracehooks on kernel syscalls).
- YouTube: Watch the presentation
- Aparat: Watch the presentation
"Every sophisticated Linux implant operates under a fundamental rule of engineering: they must eventually interact with the substrate of the operating system... Everything that has a beginning has an end."
Unless otherwise noted, the material in this repository is dedicated to the public domain under CC0 1.0 Universal.
You are free to copy, modify, distribute, and use it, including commercially, without asking permission. Attribution is appreciated but not required.