Hooked on Linux: Rootkit Detection Engineering
ID: 310a1d7a-f8a5-51e5-b40c-0fd13c51090b
STIX ID: report--310a1d7a-f8a5-51e5-b40c-0fd13c51090b
Feed Name: Elastic Security Labs
Threat Score
This report (Part II) examines detection engineering for Linux rootkits, showing that simple binary modifications defeat static signatures and detailing practical dynamic detection methods across userland and kernel space — including LKM loading, eBPF and io_uring monitoring, persistence vectors, and defense-evasion techniques — accompanied by concrete Auditd/EDR detection rules and telemetry guidance.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.