This report details the taxonomy, evolution, and hooking techniques of Linux rootkits. It highlights the shift from userland and LKM-based rootkits to advanced evasive techniques leveraging eBPF and io_uring, which challenge traditional EDR visibility and kernel hardening measures.