Phantom Attack: Evading System Call Monitoring

System Call Monitoring in Modern Linux EDRs

Host-based security agents and EDR solutions on Linux monitor system calls (via `ptrace`, auditd, or eBPF) to detect unauthorized reconnaissance, privilege escalation, and lateral movement.

Discovering Inconsistencies in Kernel Tracing Subsystems

Rex Guo and Junyuan Zeng uncover architectural race conditions and state desynchronizations in how the Linux kernel handles traced system calls from unprivileged userland processes.

Executing the Phantom Attack to Blind Sensors

The Phantom Attack allows an attacker without root privileges to execute arbitrary system calls—such as file modification, socket creation, and process execution—while presenting completely benign telemetry to monitoring agents.

Hardening Linux Kernel Tracing Frameworks

The authors propose kernel-level synchronization patches and EDR detection enhancements to mitigate system call spoofing.