Detection and Removal of the Syslogk Rootkit in a Linux Environment
ID: 5444e4d0-37ca-5d3a-ba8d-98f087f19fe4
STIX ID: report--5444e4d0-37ca-5d3a-ba8d-98f087f19fe4
Feed Name: ASEC
Threat Score
**Executive Summary:** This ASEC analysis documents the Syslogk Linux kernel rootkit: it performs inline hooking of proc_root_readdir and tcp4_seq_show to hide processes and TCP sockets, modifies VFS readdir to conceal files containing the string "was-patch", and removes its module and sysfs entries to hide the LKM; the report includes detection/remediation steps (V3 Net for Linux Server) and an MD5 indicator (8433c3f870729889f4b9712e26fe2fc8).
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.