A comprehensive reference covering Linux rootkit techniques from userland to kernel space. Topics include LD_PRELOAD-based userland rootkits (Azazel, Symbiote, Orbit, Bedevil, BEURK), LKM rootkits (Diamorphine, Reptile, Syslogk, Adore-ng), eBPF-based rootkits, and kernel hooking methods (Kprobes, Uprobes, Tracepoints, syscall table modification, ftrace, VFS manipulation). Detection strategies are covered including tainted kernel checks, bpftool, kprobe inspection, and tools like rkhunter, chkrootkit, and Tracee. Hardening recommendations include disabling unprivileged eBPF and using kernel_lockdown. Real-world malware examples (TeamTNT, Winnti, HiddenWasp, perfctl) are cited throughout.
Table of contents
[X] A (Short) History of Linux Rootkits[X] Current LandscapeUserspace vs. Kernelspace[X] Application-Level Rootkits[X] Overview of Userland Rootkits[X] LD_PRELOAD[X] Analysis of Userland Rootkits[X] Overview of Kernelspace Rootkits[X] /dev/mem[X] Loadable Kernel Modules (LKM)[X] eBPF[X] Hooking: Using Kprobes[X] Hooking: Using Uprobe[X] Hooking: Tracepoints[X] Syscall table modification[X] ftrace[X] VFS (Virtual File System) manipulation[X] Detection Strategies for Linux RootkitsLook for unexpected kprobes loaded:Monitoring[X] Overview of Tools[X] Hardening[X] What else?[X] References599 Impressions