THE ART OF LINUX KERNEL ROOTKITS

Summary from the TLDR InfoSec newsletter

This comprehensive guide to Loadable Kernel Module (LKM) rootkits begins by introducing how modern rootkits work and the different hooking techniques used. The guide then explains detection techniques utilizing the filesystem, proofs, logs, and eBPF Tracepoints. Finally, the guide concludes with some advanced techniques for defenders to expose or render rootkits useless as well as some advanced techniques for attackers to establish persistence or defend against LKM rootkits hunters.