Detection Primitives for eBPF Rootkits

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://securitylabs.datadoghq.com/articles/detection-primitives-for-ebpf-rootkits
• Blog Title: Detection Primitives for eBPF Rootkits
• Suggested Section: Linux Hardening > Post-Exploitation > Linux Post-Exploitation > eBPF Rootkit Stealth, Anti-Debugging, and Detection

🎯 Content Summary

Overview

The article analyzes three Linux eBPF rootkit techniques observed in VoidLink, LinkPro, and malware associated with the Atomic Arch campaign. No CVE is involved: the malware repurposes legitimate eBPF helpers intended for debugging, fault injection, and process control. The techniques manipulate the Netlink data parsed by ss, falsify eBPF object enumeration performed by bpftool/libbpf, and kill processes attempting to attach through 🔧 Technical Details

Length-field manipulation to hide structured records: When a trusted tool receives a contiguous, length-delimited response from the kernel, an eBPF program can capture the destination user-space buffer at syscall entry and modify it at syscall return. To hide record B between A and C, increase A.length by the aligned physical size of B. A parser that advances using the supplied length jumps directly to C. If the new length remains within the buffer's remaining bytes, bounds validation succeeds and the hidden record is silently skipped. VoidLink applies this to Netlink inet_diag_msg data using a kprobe/kretprobe pair on __sys_recvmsg and bpf_probe_write_user().

Iterator truncation through injected end-of-list errors: Monitor enumeration commands on syscall entry, correlate them by pid_tgid, inspect the returned object ID on the return path, and injec...

🤖 Agent Actions

Plan:

1. Map Linux post-exploitation and eBPF documentation, then inspect at least five relevant pages.
2. Check for overlap and verify the techniques against primary research/official kernel documentation.
3. Update the single best existing page, normalize its references if needed, and validate the diff and Markdown structure.
   Repository review is complete: the best fit is the existing Linux Post-Exploitation page, which already covers BPF backdoors and has a numbered references section. The current Useful Linux Commands page only provides baseline bpftool enumeration, so the new material is not redundant and should remain in one file.
   Plan update: overlap checking and source verification are complete. I’ll now add one self-contained section before the existing references, append the four sources in original-research-first order, then run structural and diff checks.
   Validation found the source/reference structure intact. I also corrected a wording ambiguity in the ptrace filter and removed an extra blank line; the final check will build the book if the local mdBook toolchain is available.
   Updated src/linux-hardening/post-exploitation/linux-post-exploitation/README.md.

Added:

• Netlink length-field manipulation hiding ss records.
• BPF enumeration truncation via bpf_override_return(-ENOENT).
• ptrace anti-debugging using bpf_send_signal(SIGKILL).
• Trusted BPF_PROG_LOAD helper fingerprinting and detection rules.
• Numbered citations to the original research and Datadog analysis.

Validation passed for diff formatting, Markdown fences, citation numbering, and forbidden sources. mdbook was unavailable locally, so a full build was not run.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://securitylabs.datadoghq.com/articles/detection-primitives-for-ebpf-rootkits

Content Categories: Based on the analysis, this content was categorized under "Linux Hardening > Post-Exploitation > Linux Post-Exploitation > eBPF Rootkit Stealth, Anti-Debugging, and Detection".

Repository Maintenance:

• MD Files Formatting: 1029 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0