https://aegrah.github.io/categories/linux.htmlRecent content in Linux on RGROSECHugo -- gohugo.ioenCopyright © Ruben GroenewoudSat, 09 May 2026 12:00:00 +0200https://aegrah.github.io/post/2026-05-09-copy-fail-dirtyfrag-linux-page-bugs-in-the-wild.htmlSat, 09 May 2026 12:00:00 +0200https://aegrah.github.io/post/2026-05-09-copy-fail-dirtyfrag-linux-page-bugs-in-the-wild.html At Elastic Security Labs, together with Eric Forte and Samir Bousseaden, we analyzed the Linux kernel privilege escalation vulnerabilities Copy Fail (CVE-2026-31431), Copy Fail 2, and DirtyFrag. These issues exploit subtle page cache corruption bugs to create reliable paths to root access, using legitimate kernel interfaces such as AF_ALG, splice(), and in DirtyFrag's case, networking stack primitives via AF_NETLINK and AF_RXRPC. Copy Fail has been reported as exploited in the wild and was added to CISA's Known Exploited Vulnerabilities catalog.https://aegrah.github.io/post/2026-04-02-linux-rootkits-2-caught-in-the-act.htmlThu, 02 Apr 2026 12:00:00 +0200https://aegrah.github.io/post/2026-04-02-linux-rootkits-2-caught-in-the-act.html In the second part of our two-part Linux rootkit series at Elastic Security Labs, Remco Sprooten and I turn from theory to detection engineering. We begin by demonstrating why static detection is often unreliable against Linux rootkits—even trivial modifications like stripping binaries or appending a single null byte can significantly degrade VirusTotal detection rates. From there, we cover practical behavioral detection across userland rootkit loading (LD_PRELOAD, /etc/ld.so.preload, dynamic linker configuration), kernel-space LKM loading via init_module/finit_module syscalls, out-of-tree and unsigned module taint signals, kill-signal abuse, eBPF rootkits, io_uring-based evasion, persistence mechanisms, and defense evasion techniques such as masquerading as kernel threads and log cleansing.https://aegrah.github.io/post/2026-03-26-illuminating-voidlink.htmlThu, 26 Mar 2026 12:00:00 +0200https://aegrah.github.io/post/2026-03-26-illuminating-voidlink.html At Elastic Security Labs, Remco Sprooten and I analyzed a data dump containing source code, compiled binaries, and deployment scripts for the kernel rootkit components of VoidLink—a cloud-native Linux malware framework first documented by Check Point Research. The dump revealed a multigenerational rootkit framework actively developed and tested across real targets, spanning CentOS 7 through Ubuntu 22.04. VoidLink's architecture immediately stood out: rather than relying on a single technique, it combines a traditional Loadable Kernel Module with eBPF programs in a hybrid design rarely encountered in the wild.https://aegrah.github.io/post/2026-03-20-teampcp-container-attack-scenario.htmlFri, 20 Mar 2026 12:00:00 +0200https://aegrah.github.io/post/2026-03-20-teampcp-container-attack-scenario.html At Elastic Security Labs, I published a real-world walkthrough of TeamPCP's multi-stage container compromise, demonstrating how Elastic's Defend for Containers (D4C) surfaces runtime signals across each stage of the attack chain. Rather than analyzing isolated techniques in abstraction, we follow the attack as it unfolds inside a containerized environment based on the TeamPCP cloud-native ransomware operation documented by Flare. The scenario spans nearly the entire MITRE ATT&CK lifecycle—from initial execution via curl | bash and Kubernetes environment discovery, through lateral movement via kube.https://aegrah.github.io/post/2026-03-19-getting-started-with-defend-for-containers.htmlThu, 19 Mar 2026 12:00:00 +0200https://aegrah.github.io/post/2026-03-19-getting-started-with-defend-for-containers.html At Elastic Security Labs, I published a comprehensive walkthrough of Elastic's Defend for Containers (D4C) integration, covering Kubernetes-based deployment, BPF-enriched runtime telemetry analysis, and the practical application of policy-driven security controls for containerized Linux environments. Defend for Containers arrived in Elastic Stack 9.3.0 as a runtime security integration that captures process execution and file access events enriched with container and orchestration context. This post provides a practical starting point for detection engineers: how to deploy D4C via Elastic Agent in Kubernetes, how its selector-response policy model works, which fields matter for detection logic (capabilities, interactive execution, container privilege context), and how to enable the pre-built detection ruleset.https://aegrah.github.io/post/2026-03-05-linux-rootkits-1-hooked-on-linux.htmlThu, 05 Mar 2026 12:00:00 +0200https://aegrah.github.io/post/2026-03-05-linux-rootkits-1-hooked-on-linux.html In the first part of our two-part Linux rootkit series at Elastic Security Labs, Remco Sprooten and I explore the theory behind how rootkits work: their taxonomy, evolution, and the hooking techniques they use to subvert the kernel. We trace the progression from early userland shared object rootkits through LKM-based implants, eBPF rootkits, and emerging io_uring-based evasion. The publication covers rootkit loader and payload components, kernel hooking techniques including IDT hooking, syscall table patching, inline hooking, VFS hooking, ftrace and kprobes abuse, the KHOOK framework, userspace LD_PRELOAD interposition, and eBPF program attachment.https://aegrah.github.io/post/2025-04-01-outlaw-linux-malware.htmlTue, 01 Apr 2025 12:00:00 +0200https://aegrah.github.io/post/2025-04-01-outlaw-linux-malware.html At Elastic Security Labs, Remco Sprooten and I analyzed OUTLAW, a persistent yet unsophisticated auto-propagating coinminer package that remains active across multiple versions despite lacking advanced evasion techniques. It leverages simple but impactful tactics such as SSH brute-forcing, SSH key and cron-based persistence, and manually modified commodity miners and IRC channels. We deployed a honeypot to observe the attackers in action, revealing both automated propagation and manual post-compromise activity—including real-time command entry and even typos from the operator.https://aegrah.github.io/post/2024-12-12-declawing-pumakit.htmlThu, 12 Dec 2024 12:00:00 +0200https://aegrah.github.io/post/2024-12-12-declawing-pumakit.html At Elastic Security Labs, we uncovered PUMAKIT, a sophisticated multi-stage Linux malware with advanced rootkit capabilities. Initially identified through routine threat hunting on VirusTotal, PUMAKIT consists of a dropper (cron), two memory-resident executables, an LKM rootkit module, and a userland shared object (SO) rootkit. The rootkit, internally named PUMA by its authors, employs ftrace to hook 18 syscalls and multiple kernel functions, enabling stealthy privilege escalation, file and process hiding, and anti-debugging measures.https://aegrah.github.io/post/2024-11-15-falco-workload-protection.htmlFri, 15 Nov 2024 12:00:00 +0200https://aegrah.github.io/post/2024-11-15-falco-workload-protection.html At Elastic, we recognize the critical need for securing containerized applications in Kubernetes and cloud environments. To enhance runtime security, we’ve integrated Falco—an open-source cloud-native security tool—directly with Elastic Security. Falco leverages Linux kernel events and plugins to detect abnormal behavior, security threats, and compliance violations across hosts, containers, and Kubernetes clusters. Building on our recent expansion of cloud security protections using CNCF open-source tools, this research details how the Falco and Elastic Security integration strengthens threat detection at the edge.https://aegrah.github.io/post/2024-09-28-cups-overflow.htmlSat, 28 Sep 2024 12:00:00 +0200https://aegrah.github.io/post/2024-09-28-cups-overflow.html At Elastic Security Labs, we analyzed a critical set of vulnerabilities in the CUPS printing system, disclosed by security researcher Simone Margaritelli (@evilsocket) on September 26, 2024. These flaws, affecting CUPS versions ≤ 2.0.1, enable unauthenticated remote attackers to achieve remote code execution (RCE) via the Internet Printing Protocol (IPP) and mDNS, exploiting UDP port 631. Key weaknesses include input validation flaws in cups-browsed, libcupsfilters, and libppd, as well as the long-unpatched foomatic-rip filter.https://aegrah.github.io/post/2024-09-27-betting-on-bots-ref6138.htmlFri, 27 Sep 2024 12:00:00 +0200https://aegrah.github.io/post/2024-09-27-betting-on-bots-ref6138.html At Elastic Security Labs, we uncovered a sophisticated Linux malware campaign exploiting Apache2 servers since March 2024. Attackers used multiple malware families, including KAIJI (DDoS) and RUDEDEVIL (crypto miner), along with custom tools for persistence and control. They leveraged C2 channels disguised as kernel processes, Telegram bots, and cron jobs. The investigation suggests a potential Bitcoin/XMR mining scheme tied to gambling APIs, hinting at money laundering. Continuous malware development was observed through a file share hosting fresh KAIJI samples.https://aegrah.github.io/post/2023-07-31-an-elastic-approach-to-large-scale-dynamic-malware-analysis.htmlMon, 31 Jul 2023 12:00:00 +0200https://aegrah.github.io/post/2023-07-31-an-elastic-approach-to-large-scale-dynamic-malware-analysis.html This research delves into large-scale malware analysis conducted by Elastic Security Labs, highlighting how Elastic ingest pipelines were used to filter out benign and duplicate data during dynamic malware analysis. By leveraging these pipelines, we efficiently managed vast datasets, enabling us to focus on identifying malicious behaviors. The study also explores different types of ingest pipelines, their applications, and provides a step-by-step workflow for implementing them, including automation scripts. Finally, we present our findings and discuss how others can replicate this workflow to achieve similar results.