matheuzsecurity.github.ioadded August 2026
0xMatheuZ6 Jul 2026
Standard EDR evasion is avoidance. Anonymous mmap instead of a file, direct syscalls to skip libc hooks, memfd_create so fanotify never sees a path. Stay out of what the EDR is watching.
0xMatheuZ3 Jun 2026
Research scope: This is security research on Trend Micro Deep Security Agent on Linux. The finding is not remote code execution and it is not a persistent kill switch.
0xMatheuZ9 Feb 2026
Stealthy Kernel Rootkit: https://github.com/MatheuZSecurity/Singularity Rootkit Researchers: https://discord.gg/66N5ZQppU7 Introduction Linux security tooling has leaned heavily into eBPF.
0xMatheuZ9 Nov 2025
Challenge Description In this challenge, we’re given access to a Linux virtual machine (VM) running Ubuntu. The objective is to exploit a custom kernel module to retrieve a hidden flag.
0xMatheuZ4 Jul 2025
Full source: https://github.com/MatheuZSecurity/RingReaper Table of Contents Introduction Each year, new security solutions emerge to protect Linux systems against increasingly sophisticated...
0xMatheuZ21 Jun 2025
This article explores a technique to bypass Userland based hooks, such as those implemented via LD_PRELOAD by leveraging io_uring, a modern Linux kernel interface for asynchronous I/O.
0xMatheuZ14 May 2025
Introduction In this post, I’m going to get into a really cool topic, which is how to bypass the hooks used by LD_PRELOAD rootkits, a technique that is effective against most, if not all, of them.
0xMatheuZ13 Apr 2025
Hijacking GCC with LD_PRELOAD Introduction If you’ve ever wondered how it’s possible to inject malicious code into binaries without touching the source code, and using only standard Linux tools...
0xMatheuZ27 Dec 2024
Hello! Welcome to this post! Well, I have a server that is focused on rootkit research, both for Linux and Windows, feel free to come and participate in our community. What is Ftrace?
0xMatheuZ27 Nov 2024
Hello! Welcome to this post! Well, I have a group that is focused on rootkit research, both for Linux and Windows, feel free to come and participate in our community. What is LD_PRELOAD Rootkit?
0xMatheuZ26 Aug 2024
Hello everyone, welcome to this post where I will cover the easiest way on how to detect and remove LKM KoviD rootkit. But first of all, we need to understand how the KoviD works. What is KoviD?
0xMatheuZ16 Feb 2024
Hello everyone, welcome to this post, where I will cover the topic “Linux Threat Hunting Persistence”.
7%