Rootkit × Elastic Security EDR

Researchers developed a proof-of-concept Linux rootkit named Singularity that bypasses Elastic Security's EDR detection.

The rootkit evades Elastic Security EDR by: 1) compile-time string obfuscation to defeat YARA signatures; 2) randomizing symbol names to mimic legitimate kernel functions; 3) fragmenting and encrypting the module, reassembling in memory via memfd_create to avoid on-disk scanning; 4) renaming ftrace helper functions to avoid detection; 5) using direct syscalls via inline assembly to bypass libc monitoring; and 6) writing reverse shell payloads to disk scripts with clean command lines.

Monitor kernel integrity using tools that detect unauthorized kernel module loading and changes to system call tables. Implement defense-in-depth with kernel integrity monitoring and behavioral analysis that does not rely solely on signature-based detection.