# Detection primitives for eBPF rootkits

DevFeed: [Detection primitives for eBPF rootkits](<https://devfeed.tech/articles/detection-primitives-for-ebpf-rootkits-8287.md>)

Original publisher: [Read original article](<https://securitylabs.datadoghq.com/articles/detection-primitives-for-ebpf-rootkits/>)

Author: Lorenzo Susini, Matt Muir

Published: 2026-07-27T00:00:00Z

Content type: article

Language: en

Sources: [Datadog Security Labs](<https://devfeed.tech/sources/datadog-security-labs.md>)

Topics: [eBPF](<https://devfeed.tech/topics/ebpf.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [tracing](<https://devfeed.tech/topics/tracing.md>), [Network](<https://devfeed.tech/topics/network.md>), [Protocol (disambiguation)](<https://devfeed.tech/topics/protocol.md>), [debug](<https://devfeed.tech/topics/debug.md>), [Processes](<https://devfeed.tech/topics/processes.md>)

Tags: [debug](<https://devfeed.tech/tags/debug.md>), [ebpf](<https://devfeed.tech/tags/ebpf.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [linux](<https://devfeed.tech/tags/linux.md>), [malware](<https://devfeed.tech/tags/malware.md>), [payload](<https://devfeed.tech/tags/payload.md>), [processes](<https://devfeed.tech/tags/processes.md>), [tracing](<https://devfeed.tech/tags/tracing.md>)

## AI overview

The article analyzes how Linux malware families use eBPF rootkits and helpers to evade defenses, focusing on detection primitives and VoidLink's method for hiding active connections. It explains how VoidLink manipulates user-space memory and processes socket statistics obtained through Netlink.

## Source excerpt

We analyze how VoidLink, LinkPro, and Atomic Arch abuse eBPF helpers to hide from defenders, and show how to detect them at load time, before they can act.