MatheuZ
Red Team Operator, Offensive Security Researcher, and Pentester
Linux-focused offensive security research: evasion, rootkits, telemetry bypass, and post-exploitation write-ups.
Writing
- 2026-09-09 · 6 minFileless ELF Execution via Kernel Keyring
Hello guys! So I wanted to show a technique for executing an ELF payload without ever touching the filesystem and without calling execve. The trick is the Linux kernel keyring, and it’s a bit different from what most people do for fileless execution, so lets go. The issue with the usual approaches like memfd_create or O_TMPFILE is that even though there’s no directory entry, you still end up with a file descriptor sitting in /proc/self/fd/ and an inode somewhere on a real filesystem. What if we skip all that? That’s where the keyring comes in.
- 2026-09-06 · 5 minFileless ELF Execution via O_TMPFILE
Hello guys! So today I want to show a way to execute an ELF payload that never touches disk as a named file. No memfd_create, no /memfd: prefix anywhere in telemetry. The trick is O_TMPFILE combined with execveat(AT_EMPTY_PATH), and it works on any kernel since 3.19. The issue with memfd_create is that it leaves a very specific fingerprint: process.executable shows /memfd:name (deleted), the backing device is 00:01 (the kernel’s internal anonymous tmpfs), and the syscall number is 319. Elastic, Falco, and basically every modern EDR have signatures for exactly that combination. O_TMPFILE takes a completely different path through the kernel and produces none of those artifacts.
- 2026-08-31 · 6 minSingularity Rootkit: Evading Elastic Defend Module Load Detection
Rootkit Researchers: https://discord.gg/66N5ZQppU7 Singularity Rootkit: https://github.com/MatheuZSecurity/Singularity Elastic Defend has shipped a BPF-based module load event since around 8.14. With 9.5.0, that event gained a taint_flags field, and PR #6588 added the EQL detection rule that queries it. The older syslog rule from 2023 is still active and fires independently. Between the two, loading an unsigned or out-of-tree module without any evasion generates alerts from both paths. So there are two problems to deal with: the YARA scan on the .ko file, and the BPF hook on module load.
- 2026-07-06 · 9 minBPF Map Poisoning: Attacking Falco from the Inside
Standard EDR evasion is avoidance. Anonymous mmap instead of a file, direct syscalls to skip libc hooks, memfd_create so fanotify never sees a path. Stay out of what the EDR is watching. BPF Map Poisoning does the opposite: walk into the EDR and rewrite its monitoring state directly. Everything here was tested against Falco. The technique is possible in any eBPF-based sensor that stores monitoring state in BPF maps without security_bpf_map enforcement.
- 2026-06-03 · 24 minTrend Micro Deep Security Agent Research: Forcing bmhook/tmhook Reloads to Open a Protection Bypass Window
Research scope: This is security research on Trend Micro Deep Security Agent on Linux. The finding is not remote code execution and it is not a persistent kill switch. It is a forced security-control gap. A local unprivileged event storm can make the agent unload and reload its own behavior-monitoring kernel modules. During that window, protection behavior changes, and an artifact that was normally blocked was written to disk successfully.