Researchers Develop Linux Rootkit That Evades Elastic EDR Protections

Security researchers have unveiled a sophisticated Linux rootkit, named Singularity, capable of bypassing Elastic Security’s advanced detection mechanisms, illustrating critical gaps in endpoint detection and response systems. The researchers report that Elastic Security’s endpoint detection framework typically triggers more than 26 alerts when confronted with standard rootkit implementations.

According to Elastic Security, the rootkit employs four primary evasion techniques: string obfuscation at compile time to fragment sensitive strings like “GPL” and “kallsyms_lookup_name”; intelligent symbol name randomization to replace predictable names with kernel-like generic prefixes; module fragmentation where the compiled object is split into encrypted chunks reassembled

in memory via memfd_create to avoid on-disk analysis; and ftrace helper obfuscation by renaming monitoring functions while preserving functionality. The rootkit also uses direct syscalls via inline assembly to bypass libc wrappers that detection tools monitor, and it hides executing processes using signal-based hiding to defeat behavioural analysis tools.

Dissection of the techniques shows that static pattern matching, YARA rules and behavioural monitoring can be systematically evaded, underscoring the need for deeper memory forensics and cross-layer detection approaches.