Whitepaper called Encrypted Linux x86-64 Loadable Kernel Modules (ELKM). The aim is to protect kernel-based rootkits and implants against observation by EndpointDetection and Response (EDR) software and to neutralize the effects of recovery by disk forensics tooling.
8c1624c7c34043b6adcf6bf8d40dacba0d70f69ac41bf3bb91c707f4c800f332