MatheuZ
Red Team Operator, Offensive Security Researcher, and Pentester
Linux-focused offensive security research: evasion, rootkits, telemetry bypass, and post-exploitation write-ups.
Writing
- 2026-09-06 · 5 minFileless ELF Execution via O_TMPFILE
O_TMPFILE + execveat(AT_EMPTY_PATH) is a way to execute an ELF binary that never touches disk as a named file. The running process shows up as /tmp/#N (deleted) in telemetry. No directory entry is ever created, no path ever exists, and the technique works on any kernel since 3.19. Elastic Security Labs published FENIX alongside their fileless execution research, covering 15 techniques across every major backing store. It’s the most complete public coverage matrix for this category. This combination isn’t in it.
- 2026-08-31 · 6 minSingularity Rootkit: Evading Elastic Defend Module Load Detection
Rootkit Researchers: https://discord.gg/66N5ZQppU7 Singularity Rootkit: https://github.com/MatheuZSecurity/Singularity Elastic Defend has shipped a BPF-based module load event since around 8.14. With 9.5.0, that event gained a taint_flags field, and PR #6588 added the EQL detection rule that queries it. The older syslog rule from 2023 is still active and fires independently. Between the two, loading an unsigned or out-of-tree module without any evasion generates alerts from both paths. So there are two problems to deal with: the YARA scan on the .ko file, and the BPF hook on module load.
- 2026-07-06 · 9 minBPF Map Poisoning: Attacking Falco from the Inside
Standard EDR evasion is avoidance. Anonymous mmap instead of a file, direct syscalls to skip libc hooks, memfd_create so fanotify never sees a path. Stay out of what the EDR is watching. BPF Map Poisoning does the opposite: walk into the EDR and rewrite its monitoring state directly. Everything here was tested against Falco. The technique is possible in any eBPF-based sensor that stores monitoring state in BPF maps without security_bpf_map enforcement.
- 2026-06-03 · 24 minTrend Micro Deep Security Agent Research: Forcing bmhook/tmhook Reloads to Open a Protection Bypass Window
Research scope: This is security research on Trend Micro Deep Security Agent on Linux. The finding is not remote code execution and it is not a persistent kill switch. It is a forced security-control gap. A local unprivileged event storm can make the agent unload and reload its own behavior-monitoring kernel modules. During that window, protection behavior changes, and an artifact that was normally blocked was written to disk successfully.
- 2026-02-09 · 16 minBreaking eBPF Security: How Kernel Rootkits Blind Observability Tools
Stealthy Kernel Rootkit: https://github.com/MatheuZSecurity/Singularity Rootkit Researchers: https://discord.gg/66N5ZQppU7 Me: https://www.linkedin.com/in/mathsalves/ Introduction Linux security tooling has leaned heavily into eBPF. Projects like Falco, Tracee, and Tetragon made kernel-level telemetry feel like a step change: richer context, low overhead, and visibility that’s difficult to evade from user space. But that promise quietly depends on a threat model: the kernel is assumed to be a trustworthy observer. This article explores what happens when that assumption breaks, specifically, when an attacker can execute code in the kernel (e.g., via a loaded module). In that world, the most valuable targets aren’t the eBPF programs themselves, but the plumbing around them: iterators, event delivery paths (ring buffer / perf buffer), perf submission, and map operations that turn kernel activity into user-space signals.