KLINT

Summary from the TLDR InfoSec newsletter

Klint is a single-binary, zero-dependency incident response scanner written in C++23 that detects hidden kernel modules, rootkits, compromised syscall tables, and eBPF-based persistence mechanisms across 8 self-registering scanners. The tool cross-references multiple kernel data sources — including /proc/kcore, /proc/kallsyms, MSRs, and cgroup task files — to identify inconsistencies indicative of tampering, with structured JSON output and meaningful exit codes designed for CI pipeline integration. Builds as a fully static binary for rapid deployment via SCP into compromised environments during live incident response.