Hunting Rootkits with eBPF: Detecting Linux Syscall Hooking

This blog describes how eBPF and the Tracee tool can detect kernel-level syscall hooking used by the Diamorphine rootkit (attributed to TeamTNT), covering eBPF fundamentals, how attackers manipulate syscall tables and kernel functions, the kernel core_text memory boundary concept for distinguishing original kernel code from module-inserted code, and a concrete Tracee-derived-event implementation that triggers from userland to check syscall addresses and flag hooked syscalls such as getdents/getdents64 and a modified kill used for covert communication.