MatheuZ
Red Team Operator, Offensive Security Researcher, and Pentester
Linux-focused offensive security research: evasion, rootkits, telemetry bypass, and post-exploitation write-ups.
Writing
- 2026-09-09 · 7 minFileless ELF Execution via Kernel Keyring
Hello guys! So I wanted to show a technique for executing an ELF payload without ever touching the filesystem and without calling execve, the userland exec part is not new, the trick is using the Linux kernel keyring for staging, which is a bit different from what most people do for fileless execution, so lets go. The issue with the usual approaches like memfd_create or O_TMPFILE is that even though there’s no directory entry, you still end up with a file descriptor sitting in /proc/self/fd/ and an inode somewhere on a real filesystem. The keyring skips both.
- 2026-09-06 · 5 minFileless ELF Execution via O_TMPFILE
Hello guys! So today I want to show a way to execute an ELF payload that never touches disk as a named file. No memfd_create, no /memfd: prefix anywhere in telemetry. The trick is O_TMPFILE combined with execveat(AT_EMPTY_PATH), and it works on any kernel since 3.19. The issue with memfd_create is that it leaves a very specific fingerprint: process.executable shows /memfd:name (deleted), the backing device is 00:01 (the kernel’s internal anonymous tmpfs), and the syscall number is 319. Elastic, Falco, and basically every modern EDR have signatures for exactly that combination. O_TMPFILE takes a completely different path through the kernel and produces none of those artifacts.
- 2026-08-31 · 6 minSingularity Rootkit: Evading Elastic Defend Module Load Detection
Rootkit Researchers: https://discord.gg/66N5ZQppU7 Singularity Rootkit: https://github.com/MatheuZSecurity/Singularity Elastic Defend has shipped a BPF-based module load event since around 8.14. With 9.5.0, that event gained a taint_flags field, and PR #6588 added the EQL detection rule that queries it. The older syslog rule from 2023 is still active and fires independently. Between the two, loading an unsigned or out-of-tree module without any evasion generates alerts from both paths. So there are two problems to deal with: the YARA scan on the .ko file, and the BPF hook on module load.
- 2026-07-06 · 9 minBPF Map Poisoning: Attacking Falco from the Inside
Standard EDR evasion is avoidance. Anonymous mmap instead of a file, direct syscalls to skip libc hooks, memfd_create so fanotify never sees a path. Stay out of what the EDR is watching. BPF Map Poisoning does the opposite: walk into the EDR and rewrite its monitoring state directly. Everything here was tested against Falco. The technique is possible in any eBPF-based sensor that stores monitoring state in BPF maps without security_bpf_map enforcement.
- 2026-06-03 · 24 minTrend Micro Deep Security Agent Research: Forcing bmhook/tmhook Reloads to Open a Protection Bypass Window
Research scope: This is security research on Trend Micro Deep Security Agent on Linux. The finding is not remote code execution and it is not a persistent kill switch. It is a forced security-control gap. A local unprivileged event storm can make the agent unload and reload its own behavior-monitoring kernel modules. During that window, protection behavior changes, and an artifact that was normally blocked was written to disk successfully.