Detection primitives for eBPF rootkits
We analyze how VoidLink, LinkPro, and Atomic Arch abuse eBPF helpers to hide from defenders, and show how to detect them at load time, before they can act.
Summary from Datadog Security Labs.
Explained
The technology and terms in this story. Learn more
