Hooked on Linux: Rootkit Taxonomy, Hooking Techniques and Tradecraft — Elastic Security Labs

This report reveals how Linux rootkits have rapidly evolved from basic userland hijacking to sophisticated kernel-level implants using eBPF and io_uring, employing increasingly advanced hooking techniques to evade detection and maintain stealthy persistence in modern infrastructure.