Bypass Record
Disable or Modify Tools × Elastic Defend
A publicly-reported instance of Disable or Modify Tools bypassing Elastic Defend, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
The Singularity rootkit suppresses eBPF module-load telemetry that Elastic Defend relies on to detect kernel module loads. By hiding the module load event, the rootkit avoids triggering detection mechanisms, effectively bypassing the endpoint security agent's visibility into kernel-level activities.
Detection & mitigation
Monitor for anomalies in eBPF telemetry, such as missing module-load events or tampering with eBPF programs. Deploy integrity checks on eBPF programs and use kernel-level auditing to detect rootkit presence.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.