https://matheuzsecurity.github.io/tags/elastic/Recent content in Elastic on 0xMatheuZHugo -- gohugo.ioenMon, 31 Aug 2026 00:00:00 -0300https://matheuzsecurity.github.io/hacking/elastic-trusted-pid-bypass/Mon, 31 Aug 2026 00:00:00 -0300https://matheuzsecurity.github.io/hacking/elastic-trusted-pid-bypass/Elastic Defend 9.5 added taint_flags to the module_load BPF event and a new detection rule on top of it. Here is how Singularity loads clean: source obfuscation for YARA, trusted_pids insertion for the BPF hook, and OBF_OUT=/var/lib/dkms for the .ko creation rule.