A disclosed bypass tied to the Singularity Linux rootkit shows how module-load visibility, not just files or processes, can become the first thing attackers try to silence.