Singularity Rootkit Bypasses Elastic Defend eBPF Module Load Detection

A security researcher disclosed that the Singularity Linux rootkit can bypass Elastic Defend by dynamically registering its loader as a trusted process in the agent's BPF map to suppress module-load events, placing generated kernel objects in DKMS-related paths to evade build-path exclusions, obfuscating module source to reduce YARA detections, and hiding modules from standard kernel interfaces; tests on Elastic Defend 9.5.2 demonstrated this evasion and the report recommends hardening protections around BPF maps, correlating module-load telemetry with kernel integrity signals, auditing finit_module and related syscalls, and avoiding blanket exclusions for build paths.