Linux kernel rootkit techniques

[mike-hunhoff]

https://inferi.club/post/the-art-of-linux-kernel-rootkits

[dhruvak001]

Some of the rule ideas I thought of is:

1. Detect rootkits that intercept readdir to hide processes by filtering /proc entries.
2. Identify rootkits that manipulate VFS functions (e.g., vfs_readdir, filldir) to hide files.
3. Detect rootkits that use Netfilter hooks (e.g., nf_register_net_hook) to intercept/modify packets.
4. Detect modification of the system call table (sys_call_table) to redirect syscalls.
5. Identify rootkits that hide their presence by unlinking from the kernel module list.
6. Detect rootkits that escalate privileges by modifying struct cred (e.g., UID/GID overwrite).
7. Detect rootkits that capture keystrokes by intercepting input handlers (e.g., input_register_handler).

[hafizfarhad]

Hi @mike-hunhoff , I have gone through the mentioned blog post and it covers so many techniques like ftrace, kprobes/kretprobes, and eBPF hooks. It also discusses some other approaches other than direct hooking i.e like hidden module entries, modifications in sysfs/procfs, and logs manipulations.

I would be grateful if you could please give me a starting point.

Thank you.

[mike-hunhoff]

@dhruvak001 @hafizfarhad we've had the most success with capa rules that leverage api, number, and string features. I'd recommend picking technique(s) that could be matched by one or more of these features.

[hafizfarhad]

Got It! Thank you so much @mike-hunhoff

[dhruvak001]

@mike-hunhoff According to me 5. Unlinking a module from the kernel’s module list to avoid detection and 6. Modifying struct cred to escalate privileges (e.g., root UID), would be good to start with for capa rules?

[mike-hunhoff]

@mike-hunhoff According to me 5. Unlinking a module from the kernel’s module list to avoid detection and 6. Modifying struct cred to escalate privileges (e.g., root UID), would be good to start with for capa rules?

Those sound reasonable to me, although, based on your description here these rules will require offset features so you'll need a good example file to use as a guide for your rule development.