The Linux Evasion Stack: Breaking All Three EDR Pillars with io_uring and ELF Packing

The Linux Evasion Stack: Breaking All Three EDR Pillars with io_uring and ELF Packing

Speakers: Massimo Bertocchi

Conference: Area41

YouTube: https://www.youtube.com/watch?v=C4UNZBnQxx8

Overview

In this compelling talk, "The Linux Evasion Stack," Massimo Bertocchi, a specialist in threat hunting and attack engineering, unveils advanced techniques to bypass the full spectrum of Linux Endpoint Detection and Response (EDR) solutions. Bertocchi argues that despite the proliferation of security tools, the EDR remains the primary target for attackers. His research systematically dissects the core mechanisms of Linux EDRs—static analysis, execution visibility, and dynamic analysis—and demonstrates how novel approaches, particularly leveraging the io_uring kernel interface and sophisticated ELF packing, can render these defenses ineffective.

The presentation challenges the prevailing assumption that EDRs provide comprehensive visibility into endpoint activities. Bertocchi's work highlights critical blind spots in contemporary Linux EDRs, showcasing how an attacker can achieve code execution and perform malicious operations, such as file encryption, without generating detectable telemetry. This talk is crucial for both offensive and defensive security professionals, offering a deep dive into the technical intricacies of EDR evasion and providing actionable insights for bolstering Linux endpoint security.

Bertocchi's methodology is grounded in an "offensive mindset for blue teamers" and an understanding of "defensive tool limitations for red teamers." He demonstrates how an attacker's patience and focus on achieving execution, contrasted with a defender's need for efficiency and low false positives, create exploitable asymmetries. The talk culminates in the introduction of "Armless," an open-source packer designed to incorporate these evasion techniques, effectively creating unique, undetectable malicious payloads.

Background

▶ Watch: EDR's reliance on detection telemetry (2:20)

Endpoint Detection and Response (EDR) systems are foundational to modern cybersecurity, continuously monitoring endpoints for malicious activity. At their core, EDRs collect vast amounts of telemetry—data about system processes, file operations, network connections, and more. This telemetry then feeds into various detection engines, including custom rules, out-of-the-box signatures, and machine learning models, ultimately triggering alerts, automating responses, or integrating with other security operations tools. Bertocchi emphasizes that the entire EDR ecosystem hinges on this initial data collection; if telemetry can be suppressed or manipulated, the subsequent detection and response mechanisms fail.

In the Linux environment, EDR telemetry typically falls into three primary categories, or "pillars":

1. Static Analysis: This involves examining a binary without executing it. Techniques include hash matching against known indicators of compromise (IOCs), string matching (e.g., using YARA rules to identify specific patterns or shell commands), and analysis by antivirus engines or cloud-based sandboxes. The goal here is to identify known malicious artifacts before they run.
2. Execution Visibility: Once a binary executes, EDRs monitor its actions on the system. This includes process invocation details (parent-child relationships), memory allocations, and file system operations. Linux EDRs typically achieve this through userland hooks (e.g., intercepting libc function calls) and kernel-level hooks or eBPF (extended Berkeley Packet Filter) probes, which provide deeper insights into system calls.
3. Dynamic Analysis: This pillar focuses on the behavioral aspects of a running process, observing its interactions with other processes, its network communications, and its overall patterns of activity. Machine learning often plays a significant role here, identifying anomalous behavior that might indicate a novel threat.

A "forgotten pillar," as Bertocchi terms it, is the behavioral analysis that occurs after initial code execution has been achieved. While the first three pillars aim to prevent or detect the initial compromise, an attacker who has bypassed these still needs to avoid detection for post-exploitation activities, such as brute-forcing credentials or connecting to command-and-control (C2) infrastructure.

Prior work in evasion often focused on simple techniques. For static analysis, methods like stripping binaries of debug symbols or increasing file size to bypass sandbox analysis have shown some success. Elastic's research, for instance, demonstrated that stripping could reduce detection rates for rootkits from 36% to 19% and 29% to 6% in some cases. However, these methods are often insufficient against more sophisticated EDRs. For execution visibility, bypassing userland hooks is relatively straightforward via direct syscalls, but kernel-level hooks, particularly eBPF, present a more significant challenge. The core problem Bertocchi addresses is finding a way to operate on a Linux system with code execution without triggering any of these EDR telemetry collection points.

Key Findings

▶ Watch: EDR detection on memory write operations (9:30)

Massimo Bertocchi's research yielded several critical findings that collectively demonstrate a comprehensive strategy for evading Linux EDRs:

1. Effective Static Analysis Evasion through Packing: Simple yet robust packing techniques, such as RC4 encryption combined with a sandbox evasion timer, dramatically reduce static detection rates. A Metasploit implant, when processed by Bertocchi's packer, saw its VirusTotal detection rate plummet from 36 detections to just 2. This highlights the effectiveness of encrypting the payload and delaying execution to bypass automated sandbox analysis.
2. memfd_create as a Detection Chokepoint: The memfd_create syscall, which allows for the creation of anonymous, memory-backed files, is a common technique used by packers to decrypt and execute payloads in memory. While it offers an opportunity for EDR detection, its legitimate use in various system processes (e.g., containerization) makes it a challenging target for reliable, low-false-positive EDR rules.
3. Bypassing Userland Hooks with Direct Syscalls: As expected, userland hooks (e.g., within libc) can be readily bypassed by implementing direct syscalls. This technique involves manually constructing the syscall arguments and invoking the kernel directly, circumventing the library functions that EDRs often instrument.
4. io_uring as a Major Kernel-Level EDR Blind Spot: The most significant finding is the exploitation of the io_uring kernel interface (introduced in Linux kernel 5.1). Bertocchi discovered that EDRs largely fail to hook or monitor io_uring operations. This allows attackers to perform file system read/write operations (and potentially other I/O-intensive tasks) directly through the kernel, bypassing both eBPF hooks and other kernel-level monitoring mechanisms that EDRs typically rely on. His proof-of-concept ransomware, "Armful," successfully encrypted 203 files without any EDR detection.
5. Combining Evasion Techniques for Comprehensive Bypass: By integrating ELF packing, direct syscalls, and io_uring abuse, Bertocchi demonstrated that it's possible to bypass all three EDR telemetry pillars. The resulting payload can decrypt itself in memory, write malicious content to memory-backed files (or directly to disk via io_uring), and execute without triggering EDR alerts related to static analysis or execution visibility.
6. Noise Generation and Operational Shuffling Defeat Behavioral Analysis: To counter dynamic analysis and behavioral detection, Bertocchi introduced the concept of noise generation and shuffling operations within the loader. By introducing seemingly benign or random I/O operations and reordering the payload decryption/execution steps, each compiled binary becomes unique. This makes it impossible to create reliable YARA patterns for the loader itself and obscures the malicious decryption-allocation-execution sequence from behavioral engines.
7. Resource Constraints and False Positives Limit EDR Effectiveness: A recurring theme is that EDR vendors are constrained by the need for efficiency and low false positives. Deeply hooking every possible kernel interface or aggressively flagging memfd_create can lead to system instability or excessive alerts, making customers complain. This creates an inherent advantage for attackers, who prioritize execution over efficiency.

Technical Deep Dive

▶ Watch: Introducing io_uring to bypass kernel hooks (11:30)

Bertocchi's evasion strategy targets each EDR pillar with specific technical countermeasures, culminating in a multi-layered approach.

Evading Static Analysis

The initial challenge is to prevent the EDR from identifying the malicious binary before execution. Traditional methods like stripping symbols or using obfuscators are often insufficient. Bertocchi's approach leverages:

• Payload Encryption: The entire malicious payload is encrypted, typically using a simple algorithm like RC4. This renders the binary's contents unintelligible to static analysis tools, preventing hash matching or YARA pattern detection on the raw payload.
• Sandbox Evasion Timer: Many cloud sandboxes execute samples for a limited time. By introducing a delay (e.g., 20 minutes) before the decryption and execution process begins, the packer can outlast the sandbox's analysis window. This prevents the sandbox from observing the true malicious behavior and generating telemetry. Bertocchi notes that for an attacker, efficiency is not a primary concern; as long as the payload eventually runs, it's successful.
• Increased File Size: While not the primary focus of his packer, Bertocchi mentions that some EDRs (e.g., one specific provider) will not send files over a certain size to their cloud sandbox, effectively reducing telemetry.

The combination of encryption and a sandbox timer proved highly effective, reducing VirusTotal detections for a Metasploit implant from 36 to just 2.

Evading Execution Visibility

This pillar is broken down into two main sub-targets: userland hooks and kernel-level hooks.

Bypassing Userland Hooks with Direct Syscalls

EDRs often instrument userland libraries, particularly libc, to intercept common syscalls like read(), write(), open(), and execve(). To bypass these hooks, Bertocchi employs direct syscalls:

1. Avoid libc: Instead of calling the standard library functions, the attacker directly invokes the kernel's syscall interface.
2. Register Manipulation: The specific syscall number and its arguments are loaded into designated CPU registers (e.g., rax for the syscall number, rdi, rsi, rdx for arguments on x86-64).
3. SVC 0 (or syscall instruction): On ARM64 architectures, the SVC #0 instruction (Supervisor Call) is used to transition from user mode to kernel mode, triggering the syscall. On x86-64, the syscall instruction serves the same purpose. This direct invocation bypasses any hooks placed on libc functions.

Evading Kernel-Level Hooks (eBPF and Tracepoints) with io_uring

Kernel-level hooks, particularly those implemented with eBPF, are more challenging as they operate closer to the kernel. EDRs use these to monitor syscall entry/exit points, kernel functions, and tracepoints. Bertocchi's key insight here is the exploitation of io_uring.

• What is io_uring? Introduced in Linux kernel 5.1, io_uring is a modern asynchronous I/O interface designed for high-performance I/O operations. It works by establishing a ring buffer (a shared memory region) between user space and kernel space. User applications submit I/O requests (e.g., read, write, open) to a Submission Queue (SQ), and the kernel processes these requests and places the results in a Completion Queue (CQ). This significantly reduces the overhead of context switching and individual syscalls, especially for applications performing many I/O operations.
• Why EDRs Miss It: Crucially, io_uring was not initially designed with security monitoring in mind, and EDR vendors have been slow to implement hooks for its specific syscalls (e.g., io_uring_setup, io_uring_enter). Bertocchi's enumeration of eBPF hooks and tracepoints revealed that io_uring operations were largely unmonitored. When a process uses io_uring to perform a file write, the EDR's eBPF hooks on write() or pwrite() might not be triggered because the io_uring interface handles the actual kernel-level I/O.
• Linux Security Module (LSM) Limitation: Bertocchi notes that while the Linux Security Module (LSM) framework (e.g., SELinux, AppArmor) offers very deep kernel integration, EDR vendors typically avoid implementing their primary detection logic there. The reason is simple: if an EDR's LSM module has a bug, it can crash the entire system, leading to severe operational disruption and customer complaints. This pushes EDRs to rely on higher-level hooks (tracepoints, Kprobes) that are less prone to system instability. This reluctance creates another blind spot that io_uring can exploit.

By using io_uring, an attacker can perform file operations, such as creating, reading, and writing files, without generating the expected telemetry that EDRs rely on.

Evading Dynamic Analysis

Even if static analysis and execution visibility are bypassed, a sequence of suspicious actions (e.g., decrypting a binary, allocating memory, writing to a memory file, then executing it) might still trigger behavioral alerts. To counter this, Bertocchi introduces:

• Noise Generation: The loader performs a series of seemingly benign or irrelevant operations (e.g., reading random files, performing unnecessary calculations, waiting) before and during the payload decryption/execution phase. This "noise" helps obscure the malicious sequence, making it harder for behavioral engines to identify the true intent.
• Shuffling Operations: The order of operations within the loader (decryption, memory allocation, writing, execution, noise generation) is randomized for each compilation. This ensures that every generated payload has a unique execution flow, preventing the creation of static behavioral signatures or YARA rules that target the loader's execution pattern. This "polymorphic" loader ensures that "every execution is basically unique."

The Armless Packer

All these concepts are integrated into Armless, an open-source packer supporting both ARM64 and x86-64 architectures. Key features of Armless include:

• Triple-Layer Encryption: Ensures robust static analysis evasion.
• Noise Operations in Loader: Obfuscates malicious activity from dynamic analysis.
• Anti-Debugging Capabilities: Prevents analysts from easily inspecting the payload.
• Memory Wiping: Ensures that once the payload has executed, its remnants are wiped from memory, hindering post-mortem analysis.
• io_uring Integration: Leverages the unhooked kernel interface for critical file operations.
• Shuffled Operations: Guarantees a unique loader signature for each compilation, defeating YARA and behavioral patterns.

Bertocchi also briefly mentions extending similar reflective loader and packing techniques to macOS, noting that the platform's less mature security tooling and expertise make it an even more efficient target for attackers.

Demo / Proof of Concept

▶ Watch: Armless: the comprehensive Linux evasion packer (17:00)

Massimo Bertocchi presented several compelling demonstrations and proof-of-concepts (POCs) to validate his evasion techniques:

1. Metasploit Packer with Sandbox Evasion:

• Concept: To demonstrate evasion of static analysis, Bertocchi created a packer that encrypts a standard Metasploit implant. This packer also incorporates an RC4 encryption algorithm and a simple sandbox evasion timer (a delay mechanism).
• Demonstration: Before packing, the Metasploit implant registered 36 detections on VirusTotal. After being processed by the packer, the same implant showed a dramatic reduction to just 2 detections. This stark difference effectively showcased how basic packing combined with a delay can severely cripple static and automated sandbox analysis. The key here was that the encrypted payload, by delaying its malicious behavior, avoided analysis by time-limited sandboxes.

1. io_uring Ransomware POC ("Armful"):

• Concept: To prove that io_uring could bypass kernel-level EDR hooks for file operations, Bertocchi developed a small ransomware POC, named "Armful." This tool was designed to encrypt files on a Linux system, specifically targeting file inodes or parts of the file system, thereby rendering them inaccessible. The critical aspect was that all file I/O operations were performed using the io_uring interface.
• Demonstration: When executed on a system with an EDR, Armful successfully encrypted 203 files without triggering any EDR alerts or generating any telemetry. The EDR remained completely blind to the file encryption activity, demonstrating a significant blind spot in its execution visibility. This POC directly validated the hypothesis that io_uring provides an unmonitored channel for performing privileged file system actions.

1. Armful with Armless Assembly (Unique Binary Generation):

• Concept: Building on the io_uring ransomware, Bertocchi discussed how to combine it with the advanced features of his "Armless" packer. The goal was to create a truly unique and undetectable malicious binary.
• Demonstration (conceptual): While not explicitly run as a live demo, Bertocchi explained that by applying the Armless packing techniques (triple-layer encryption, noise generation, shuffled operations) to Armful, each compiled instance of the ransomware would have a different signature. This would prevent the creation of static YARA patterns or hash-based detections for the Armful payload, even if a sample were eventually obtained. This demonstrates the final layer of evasion, making it extremely difficult for defenders to create reliable signatures for the loader itself.

These demonstrations provided concrete evidence that the proposed evasion techniques are not merely theoretical but practically effective against modern EDR solutions.

Defensive Implications

▶ Watch: Post-execution and macOS evasion techniques (18:50)

Massimo Bertocchi's research presents significant challenges for defenders and EDR vendors, highlighting critical areas that require immediate attention:

1. Enhanced io_uring Monitoring: EDR vendors must prioritize implementing robust monitoring for the io_uring kernel interface. This means developing eBPF programs or kernel modules that specifically hook io_uring_setup, io_uring_enter, and related syscalls, as well as analyzing the commands submitted to the Submission Queue (SQ). Failure to do so leaves a wide-open channel for attackers to perform unmonitored file system operations, network I/O, and other kernel-level actions.
2. Sophisticated memfd_create Detection: While memfd_create is used legitimately, EDRs need more intelligent detection logic around its usage. This could involve correlating memfd_create calls with subsequent suspicious activities, such as writing executable content to the memory file, changing memory protections (e.g., mprotect to PROT_EXEC), and then executing from that memory region. Contextual analysis, rather than blanket blocking, is key to minimizing false positives.
3. Improved Behavioral Analysis for Loader Stages: EDRs must evolve their behavioral engines to detect the sequence of actions associated with advanced packers, even if individual steps are obscured. This includes recognizing the pattern of decryption, memory allocation, and execution, especially when followed by suspicious I/O (even if via io_uring). Noise generation makes this harder, but machine learning models trained on diverse polymorphic samples could potentially identify anomalous sequences.
4. Addressing Direct Syscall Bypass: While direct syscalls are a known evasion technique, EDRs need to ensure their kernel-level telemetry collection is resilient. This means relying less on userland libc hooks and more on robust kernel-level instrumentation (e.g., eBPF on syscall entry/exit points) that cannot be bypassed by simply avoiding libc.
5. Consideration of Resource Overhead vs. Security: EDR vendors face a constant trade-off between comprehensive security and system performance. Bertocchi highlights that attackers don't care about efficiency, but EDRs must. This implies that security teams need to understand these limitations and potentially accept a higher resource footprint for critical endpoints or explore alternative kernel hardening techniques.
6. Kernel Hardening and Security Modules: Defenders should explore kernel hardening options beyond traditional EDRs. This could include using Linux Security Modules (LSMs) like AppArmor or SELinux to restrict io_uring usage to trusted applications or to enforce stricter policies on memory execution. While EDR vendors avoid LSMs due to risk, organizations might consider custom LSM policies for high-value assets.
7. Threat Hunting for Anomalous Kernel Activity: Security operations centers (SOCs) and threat hunters should actively look for signs of io_uring activity in their kernel logs (if available and configured) or through specialized tooling that can monitor this interface. Similarly, detecting direct syscalls might require analyzing process memory for unusual instruction sequences or monitoring for syscall numbers invoked without corresponding libc calls.
8. Awareness of Polymorphic Loaders: The concept of shuffling operations to generate unique loaders means that traditional signature-based detection (hashes, YARA) for the loader itself becomes ineffective. Defenders must shift focus to behavioral indicators of compromise (BIOCs) and anomaly detection rather than relying solely on static signatures.

In summary, Bertocchi's work is a wake-up call for Linux EDRs, urging them to move beyond easily bypassed hooks and embrace deeper, more resilient kernel monitoring, while also balancing the need for performance and low false positives.

Key Takeaways

• Linux EDRs rely on three pillars: static analysis, execution visibility (userland and kernel hooks), and dynamic/behavioral analysis to detect threats.
• Advanced ELF packing with encryption and sandbox evasion timers can drastically reduce static detection rates, making payloads almost invisible to initial scans.
• The io_uring kernel interface (Linux 5.1+) represents a significant blind spot for current EDRs, allowing attackers to perform unmonitored file system operations and bypass both eBPF and traditional kernel hooks.
• Direct syscalls are an effective method to bypass userland EDR hooks by interacting directly with the kernel, circumventing instrumented library functions.
• Noise generation and shuffling operations within a polymorphic loader can defeat behavioral analysis and prevent the creation of reliable YARA patterns, making each attack unique.
• EDR vendors' constraints (performance, low false positives, system stability concerns with deep kernel hooks) create exploitable gaps that attackers can leverage with focused, patient offensive techniques.

About the Speaker(s)

Massimo Bertocchi is an accomplished professional specializing in threat hunting and attack engineering. He brings a unique perspective to cybersecurity, stemming from his belief that blue teamers benefit from an offensive mindset to anticipate threats, while red teamers must understand the limitations and blind spots of defensive tools. Bertocchi holds two master's degrees and multiple certifications, demonstrating a strong academic and practical foundation in both offensive and defensive security disciplines. He is passionate about the intersection of these two areas. All projects discussed in his presentation, including the Armless packer and Armful ransomware, are open source and available on his GitHub, reflecting his commitment to community knowledge sharing. Beyond cybersecurity, Massimo also enjoys talking about windsurfing and basketball.