Detecting and Mitigating io_uring Abuse for Malware Evasion

On April 24, 2025 ARMO published a proof-of-concept called "curing" that uses Linux io_uring to evade many system-call-based security products; Sysdig explains the technique, its limitations (requires prior access and does not hide files/processes), and publishes a "Suspicious io_uring Activity Detected" rule while Falco will add detections using kernel runtime instrumentation; recommendations include layered defenses, cautious seccomp adjustments, and reliance on FANOTIFY-based detections which remain effective.