Developer submits Elastic detection rule to flag eBPF rootkit compilation on Linux hosts

·1 views

A developer has submitted a pull request to the Elastic Security detection-rules repository addressing a gap in existing eBPF malware detection. While most current rules monitor for eBPF malware at the kernel-loading stage, this new rule targets an earlier phase — when attackers compile eBPF object files directly on a compromised host using the local Clang toolchain. Written in Elastic's Event Query Language (EQL), the rule monitors Linux process executions where Clang is invoked with arguments targeting the BPF backend, including little-endian, big-endian, and full target triple variants. Notably, the rule also captures failed compilation attempts, since Linux still logs execve calls even when Clang exits with a syntax error, helping defenders catch attackers making mistakes in real time. The pull request closes issue #6562 in the Elastic Security open-source repository.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

CSS Positioning Explained: How Static, Relative, Absolute, Fixed and Sticky Work

A senior developer guide published on DEV Community breaks down all five CSS position values using a real-world fashion e-commerce storefront as a practical example. The article explains why common frustrations — such as elements flying off-screen or z-index failing to stack correctly — stem from misunderstanding how browsers calculate coordinates and stacking contexts. It covers key rules, including why static elements ignore offset properties and why position: relative should serve as an anchor rather than a nudging tool. The guide also details how position: absolute removes an element from document flow and searches up the DOM for the nearest non-static ancestor. The tutorial aims to move developers beyond isolated box exercises toward solving real production layout problems.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Deep Linking Now Possible in Power Apps Code Apps via Query String Workaround

Deep linking in Microsoft Power Apps Code Apps was previously considered nearly impossible due to how the platform hosts applications inside an iframe, preventing browser URL updates during navigation. A workaround was identified after developer Diana Birkelbach shared an approach revealing that Power Apps forwards query string parameters from the host page URL into the embedded application. These parameters can be accessed at runtime using the Power Apps context API and mapped to specific React Router routes on startup. Developers can define deterministic route conventions, read the query parameters during app initialization, and navigate to the correct route accordingly. This method also allows generating shareable deep links at runtime, enabling features like 'Open in New Tab' or 'Copy Link' buttons within the app.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How a Minimal Web Components Model Helps AI Coding Agents Work Effectively

A developer series on using @relax.js/core with AI coding agents explains a deliberately concise mental model for working with native Web Components. The approach relies on plain HTMLElement extension, native lifecycle methods, and customElements.define, avoiding base classes or decorators to keep the codebase grep-friendly. A key pitfall highlighted is that type-only imports cause the bundler to skip module execution, leaving custom element tags undefined at runtime. The author also clarifies that marking connectedCallback as async is silently ignored by browsers, so async work must be initiated separately and allowed to update the DOM on completion. The model avoids reactive state entirely, opting for direct DOM updates at the exact point data changes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Codename One Adds Cross-Device Continuity and Native Drag-and-Drop Support

Open-source framework Codename One has introduced two new features this week: cross-device continuity and native drag-and-drop functionality for apps built from a single Java or Kotlin codebase. The continuity feature allows users to seamlessly resume tasks — such as editing a draft — across different devices or screens without losing progress. It works by serializing navigation routes and application state through a StateProvider interface, supporting Apple Handoff, iCloud, and custom application-defined relays. Native drag-and-drop enables content to be shared between applications via the operating system, offering an alternative to copy-paste workflows. Developers are advised to keep state payloads small and avoid storing sensitive credentials, as restored routes identify work but do not bypass authentication checks.

0 comments Read more at DEV Community