Linux Rootkit Abuses Elastic trusted_pids eBPF Map to Bypass Module Load Detection cyberpress.org