Detecting Kernel & eBPF Rootkits with Tracee

open_rootkit.c - Thomas Moussajee. * C Unix Rootkit open. * Make a file forbiden for everyone include root with permission.

chkrootkit & rkhunter: # www.fduran.com. http://www.chkrootkit.org/download/. http://sourceforge.net/projects/rkhunter/. cd /usr/local/src/.

Linux Loadable Kernel Module Rootkit for Linux Kernel 5.x and 6.x on x86_64, hides files, hides process, hides bind shell & reverse shell port.

A Linux kernel module and userland utility pair to detect processes hidden by Linux kernel module (LKM) rootkits.

When loaded, the module starts invisible;. Hide/unhide any process by sending a signal 31;. Sending a signal 63(to any pid) makes the module become ... Diamorphine.c · Diamorphine.h · LICENSE.txt · Issues

PCI Express DIY hacking toolkit for Xilinx SP605. This repository is also home of Hyper-V Backdoor and Boot Backdoor, check readme for links and info.

Universal Linux LKM rootkit, designed to work in any kernel version and both architectures (i686 and x86_64). - juanschallibaum/Nuk3Gh0st.

They have been acquired during the detailed analysis of each rootkit and should aid forensic investigators in the examination of potentially infected systems.

Rootkit根據層級可以分成不同的類型，比較常被提及的是「User Mode Rootkit」和「Kernel Mode Rootkit」，但也有像是Bootkits、Hypervisor level、Firmware ...

Linux Rootkits: New Methods for Kernel 5.7+ · Fancy Bear's a Lumberjack and It's Okay - A Dive into the Kernel Component of Drovorub · Linux Rootkits Part ...