eBPF Rootkits: Analysis and Detection Strategies

Modern Linux threats are shifting from traditional Loadable Kernel Modules (LKM) to eBPF-based rootkits, which offer superior stealth by operating within the kernel's sanctioned verifier sandbox. Unlike LKMs, eBPF rootkits do not taint the kernel or modify the syscall table, allowing them to remain invisible to standard integrity checks that rely on state-comparison detection.

The technical analysis focuses on the 'Bad-bpf' framework, demonstrating how it hooks syscalls like getdents64 and read via exit tracepoints to hide processes and forge root privileges. By using the bpf_probe_write_user helper function, these rootkits can modify data in user-space memory before it reaches applications like ps or sudo, creating a significant visibility gap for security teams.

For organizations, the business impact is severe: a compromised system may report 100% integrity according to classic tools while actively harboring stealthy persistence and unauthorized root access. SOC teams must shift detection focus from file-based and symbol-based monitoring to BPF-specific telemetry, auditing the bpf() syscall, and monitoring the /sys/fs/bpf filesystem for pinned objects.