Zombie Ant Farming: Practical Tips for Playing Hide and Seek with Linux EDRs

## Overview

Dmitri Shmitz (red team operator, x4x4) presented practical EDR evasion techniques for Linux. Context: Linux runs 90% of cloud infrastructure; attackers must target Linux to reach data; endpoint detection/response (EDR) on Linux fragmented and less mature than Windows. Red team challenge: drop onto Linux system, discover unknown detection capabilities, establish persistence while evading automated behavioral analysis and threat hunting. EDR strategy: analyze system binary behavior, construct attack narrative, block malicious patterns. Counter-strategy options: (1) attack EDR itself (disable, blind, degrade logging) or (2) target execution behavior (confuse detection via alternative execution methods, bypass signatures, maintain persistence through obfuscation). Talk focus: viable path for Linux malware development while contending with EDR constraints.

## Offensive Primitives and ELF Manipulation Techniques

**ELF Format Exploitation**: Linux uses ELF (Executable and Linkable Format) as executable format; contains linking sections (metadata), execution sections (runtime), and ELF sections (.init_array, .fini_array) that execute before/after main() regardless of program intent. Attack strategy: inject malware into ELF sections executed automatically; preload dynamic libraries into system binaries without understanding target binary functionality; use weak references (compiler feature) to load optional functions without crashing if libraries missing (enables sandbox detection or EDR evasion by not loading if defenses detected).

**Library Preloading and Process Manipulation**: LD_PRELOAD (Linux dynamic loading facility) allows hooking functions in running binaries by detour-redirecting function calls to attacker-controlled library before executing original function. Generic hooking: preload malware into any system executable (e.g., /bin/ls, /bin/bash) without knowing target's API; exploit parent-child process relationships to introspect child process state. Payload assembly techniques: (1) .init_array sections load code before main, (2) pre-constructors execute code automatically, (3) weak references split functionality across chained libraries (EDR sees only partial payload in memory), (4) signal handlers interrupt execution flow confusing EDR timeline analysis (division-by-zero error with signal handler recovery breaks behavioral story EDR constructs).

**Memory Obfuscation Strategies**: Weak reference chains distribute payload across multiple preloaded libraries—when EDR introspects process memory, each library appears independently without obvious malicious correlation. Weak references enable conditional loading based on runtime checks (e.g., detect sandbox/EDR presence before loading functionality). Environmental variable manipulation: LD_PRELOAD, LD_LIBRARY_PATH, malware configuration stored in environment rather than command-line arguments (avoiding argument inspection). Loader manipulation: replace default Linux loader (ld.so) with custom loader embedded in ELF interpreter section; bypasses EDR instrumentation of standard loader path.

## Zombie Ant Farming: Cross-Process Memory Execution

**Memory-Based Payload Brokering**: memfd_create syscall (kernel 3.7+) creates anonymous file descriptors for in-memory file creation; enables executing ELF binaries directly from memory without touching disk (defeats disk-based malware scanning). Process relationship exploitation: parent process creates zombie_ant_farm broker holding payload in memory; child processes (LD_PRELOAD instrumented system binaries) use proc file descriptors to reference parent's memory space, fetching malware via memory address instead of disk path. Cross-process memory sharing: child preloader queries parent for payload descriptor, maps parent's memory into own address space, executes malware code from parent's memory while parent/child maintain separate execution contexts.

**Payload Delivery and Reflection**: Reflection via multiple VM environments (Go language runtime, Python virtual machine) within single process confuses EDR tracing—context switches between VMs require reversing 2000+ runtime functions; EDR cannot follow execution through VM boundaries. Static compilation of interpreter inside preloaded library (e.g., statically-linked Python interpreter) forces VM-level context switching; EDR introspection loses narrative continuity. Execution flow breaking: chain /bin/ls → busy_box → vi (terminal mode switch) → different TTY context; each hop represents trust boundary making continuous EDR tracking impossible.

## Operational Impact and Defense Implications

**Weaponization Approach**: Uber-preloaders (fully-featured malicious libraries) gain access to all executable functionality without requiring tools on disk. System binary hijacking: transform whitelisted system utilities into malware delivery mechanisms via LD_PRELOAD; executable appears legitimate (trusted binary in system PATH) while harboring preloaded malicious library. Zombie Ant Farming reference: natural phenomenon where parasitic fungus infects carpenter ants, compelling them to climb vegetation via muscle control (without affecting nervous system); similarly, attack hijacks system binary muscles (execution) while maintaining whitelisting appearance.

**EDR Evasion Through Process Relationships**: Linux parent-child relationships enable introspection of child process file descriptors; attacker processes exploit this to discover sibling processes' capabilities, coordinate payload delivery, share memory across process boundaries. Separation of concerns: payload broker (zombie_ant_farm) runs independently from executor; executor (preloaded /bin/ls) cannot easily be correlated with broker, defeating process tree correlation analysis. Practical constraints: disk-based tools still required for initial foothold; in-memory execution solves persistent payload concealment but not initial access (exploit, C2 staging requires disk touch or network delivery).