rexihttps://github.com/IOCsec/ringreaper
https://matheuzsecurity.github.io/hacking/evading-linux-edrs-with-io-uring/
https://www.linkedin.com/in/mathsalves/
(#fridayfreakout)
instead of invoking standard functions like read, write, recv, send, or connect, #RingReaper employs io_uring primitives (e.g., io_uring_prep_*) to execute equivalent operations asynchronously, and so can bypass hook-based detection while limiting visibility of malicious activity in telemetry.
Frank đŠī¸đĒâĩđĩđŋđ