corpus.blog
41554 blogs · [ { "id": "01a08cc3-c6a9-72d7-8ff6-9214d1a0b985", "title": "Fileless ELF Execution via Kernel Keyring", "url": "https://matheuzsecurity.github.io/hacking/linux-kernel-keyring-fileless-exec/", "published_at": "2026-09-09T04:00:00+00:00" }, { "id": "01a087a1-7368-7150-97be-f1cfe96e4e74", "title": "Fileless ELF Execution via O_TMPFILE", "url": "https://matheuzsecurity.github.io/hacking/fileless-loader-bypassing-elastic-memfd/", "published_at": "2026-09-06T04:00:00+00:00" }, { "id": "01a087a1-7368-7150-97be-f1cfe9725abd", "title": "Singularity Rootkit: Evading Elastic Defend Module Load Detection", "url": "https://matheuzsecurity.github.io/hacking/elastic-trusted-pid-bypass/", "published_at": "2026-08-31T03:00:00+00:00" }, { "id": "01a087a1-7368-7150-97be-f1cfe9ac2809", "title": "BPF Map Poisoning: Attacking Falco from the Inside", "url": "https://matheuzsecurity.github.io/hacking/bpf-map-poisoning-edr-evasion/", "published_at": "2026-07-06T03:00:00+00:00" }, { "id": "01a087a1-7368-7150-97be-f1cfe9e35c66", "title": "Trend Micro Deep Security Agent Research: Forcing bmhook/tmhook Reloads to Open a Protection Bypass Window", "url": "https://matheuzsecurity.github.io/hacking/trendmicro-bmhook-tmhook-reload-bypass/", "published_at": "2026-06-03T04:00:00+00:00" }, { "id": "01a087a1-7368-7150-97be-f1cfe9f7cdc8", "title": "Breaking eBPF Security: How Kernel Rootkits Blind Observability Tools", "url": "https://matheuzsecurity.github.io/hacking/ebpf-security-tools-hacking/", "published_at": "2026-02-09T15:25:08+00:00" }, { "id": "01a087a1-7368-7150-97be-f1cfea83d685", "title": "Ioctl Secrets Writeup", "url": "https://matheuzsecurity.github.io/hacking/ioctl-secrets/", "published_at": "2025-11-09T17:25:18+00:00" }, { "id": "01a087a1-7368-7150-97be-f1cfeb1755a8", "title": "Evading Elastic Security: Linux Rootkit Detection Bypass", "url": "https://matheuzsecurity.github.io/hacking/bypassing-elastic/", "published_at": "2025-10-30T18:15:09+00:00" }, { "id": "01a087a1-7368-7150-97be-f1cfebe50732", "title": "Red Team Tactics: Evading EDR on Linux with io_uring", "url": "https://matheuzsecurity.github.io/hacking/evading-linux-edrs-with-io-uring/", "published_at": "2025-07-04T14:35:09+00:00" }, { "id": "01a087a1-7368-7150-97be-f1cfecc8e942", "title": "breaking ld_preload rootkit hooks", "url": "https://matheuzsecurity.github.io/hacking/using-io-uring-to-break-linux-rootkits-hooks/", "published_at": "2025-06-21T20:33:03+00:00" }, { "id": "01a087a1-7368-7150-97be-f1cfecd245f2", "title": "Bypassing LD_PRELOAD Rootkits Is Easy", "url": "https://matheuzsecurity.github.io/hacking/bypass-userland-hooks/", "published_at": "2025-05-14T23:42:06+00:00" }, { "id": "01a087a1-7368-7150-97be-f1cfed007535", "title": "ElfDoor-gcc", "url": "https://matheuzsecurity.github.io/hacking/gcc/", "published_at": "2025-04-13T17:14:56+00:00" }, { "id": "01a087a1-7368-7150-97be-f1cfeda6d1c6", "title": "Detecting rootkits based on ftrace hooking.", "url": "https://matheuzsecurity.github.io/hacking/ftrace-rootkit/", "published_at": "2024-12-27T00:46:23+00:00" }, { "id": "01a087a1-7368-7150-97be-f1cfeddf11c4", "title": "How detect a LD_PRELOAD rootkit and hide from ldd & /proc", "url": "https://matheuzsecurity.github.io/hacking/ldpreload-rootkit/", "published_at": "2024-11-27T04:06:42+00:00" }, { "id": "01a087a1-7368-7150-97be-f1cfee0b2204", "title": "A simple way to detect and remove LKM rootkit KoviD (Outdated)", "url": "https://matheuzsecurity.github.io/hacking/a-simple-way-to-detect-and-remove-kovid-lkm-rootkit/", "published_at": "2024-08-26T14:29:01+00:00" }, { "id": "01a087a1-7368-7150-97be-f1cfee380882", "title": "Linux Threat Hunting Persistence", "url": "https://matheuzsecurity.github.io/hacking/linux-threat-hunting-persistence/", "published_at": "2024-02-16T03:00:29+00:00" }, { "id": "01a0bb54-172a-708b-b29d-91c8239b7c9d", "title": "Search", "url": "https://matheuzsecurity.github.io/search/", "published_at": null } ] posts Claim your blog
Back to matheuzsecurity.github.io
Blog · corpus.blog/blogs/matheuzsecurity.github.io/posts

matheuzsecurity.github.io

matheuzsecurity.github.io

2026

Fileless ELF Execution via Kernel Keyringoriginal ↗
9 Sept 2026
Fileless ELF Execution via O_TMPFILEoriginal ↗
6 Sept 2026
Singularity Rootkit: Evading Elastic Defend Module Load Detectionoriginal ↗
31 Aug 2026
BPF Map Poisoning: Attacking Falco from the Insideoriginal ↗
6 Jul 2026
Trend Micro Deep Security Agent Research: Forcing bmhook/tmhook Reloads to Open a Protection Bypass Windoworiginal ↗
3 Jun 2026
Breaking eBPF Security: How Kernel Rootkits Blind Observability Toolsoriginal ↗
9 Feb 2026

2025

Ioctl Secrets Writeuporiginal ↗
9 Nov 2025
Evading Elastic Security: Linux Rootkit Detection Bypassoriginal ↗
30 Oct 2025
Red Team Tactics: Evading EDR on Linux with io_uringoriginal ↗
4 Jul 2025
breaking ld_preload rootkit hooksoriginal ↗
21 Jun 2025
Bypassing LD_PRELOAD Rootkits Is Easyoriginal ↗
14 May 2025
ElfDoor-gccoriginal ↗
13 Apr 2025

2024

Detecting rootkits based on ftrace hooking.original ↗
27 Dec 2024
How detect a LD_PRELOAD rootkit and hide from ldd & /procoriginal ↗
27 Nov 2024
A simple way to detect and remove LKM rootkit KoviD (Outdated)original ↗
26 Aug 2024
Linux Threat Hunting Persistenceoriginal ↗
16 Feb 2024

Undated

Searchoriginal ↗
—