unhookinglinuxedrs-matheuzsecurity2025

Unhooking Linux EDRs

by matheuz

https://github.com/MatheuZSecurity/UnhookingLinuxEdr

Notes
insmod
dmesg
EDR
Linux
LKM
Trend Micro
Trend Micro Deep Security
CrowdStrike Falcon
CrowdStrike
eBPF
machine learning
hooks
module_init(), module_exit()
printk
/proc/modules
/sys/module directory
cleanup_module alias
/proc/kallsyms
EDR, rootkits prevent module unloading with rmmod
linked list
tmhook module
bmsensor module

---