Linux kernel rootkit techniques

[mike-hunhoff]

https://inferi.club/post/the-art-of-linux-kernel-rootkits

[dhruvak001]

Some of the rule ideas I thought of is:

1. Detect rootkits that intercept readdir to hide processes by filtering /proc entries.
2. Identify rootkits that manipulate VFS functions (e.g., vfs_readdir, filldir) to hide files.
3. Detect rootkits that use Netfilter hooks (e.g., nf_register_net_hook) to intercept/modify packets.
4. Detect modification of the system call table (sys_call_table) to redirect syscalls.
5. Identify rootkits that hide their presence by unlinking from the kernel module list.
6. Detect rootkits that escalate privileges by modifying struct cred (e.g., UID/GID overwrite).
7. Detect rootkits that capture keystrokes by intercepting input handlers (e.g., input_register_handler).

[hafizfarhad]

Hi @mike-hunhoff , I have gone through the mentioned blog post and it covers so many techniques like ftrace, kprobes/kretprobes, and eBPF hooks. It also discusses some other approaches other than direct hooking i.e like hidden module entries, modifications in sysfs/procfs, and logs manipulations.

I would be grateful if you could please give me a starting point.

Thank you.

[mike-hunhoff]

@dhruvak001 @hafizfarhad we've had the most success with capa rules that leverage api, number, and string features. I'd recommend picking technique(s) that could be matched by one or more of these features.

[hafizfarhad]

Got It! Thank you so much @mike-hunhoff

[dhruvak001]

@mike-hunhoff According to me 5. Unlinking a module from the kernel’s module list to avoid detection and 6. Modifying struct cred to escalate privileges (e.g., root UID), would be good to start with for capa rules?

[mike-hunhoff]

@mike-hunhoff According to me 5. Unlinking a module from the kernel’s module list to avoid detection and 6. Modifying struct cred to escalate privileges (e.g., root UID), would be good to start with for capa rules?

Those sound reasonable to me, although, based on your description here these rules will require offset features so you'll need a good example file to use as a guide for your rule development.

[aryanyk]

Hi @mike-hunhoff, I’d like to continue work on this issue.

I noticed the previous PR (#1039) attempted Netfilter hook detection but was closed due to inactivity. I’d like to revisit the Linux rootkit rules and follow the workflow you mentioned (including providing an example sample in the capa-testfiles repository).

My plan is to start with one or two techniques that should be detectable using API/string features, for example:

• privilege escalation via prepare_kernel_cred → commit_creds
• Netfilter hook registration via nf_register_net_hook

I’ll verify which features are extracted using scripts/show-features.py and then build rules based on those features. If I have a suitable example .ko sample, I’ll also submit it to the capa-testfiles repo as suggested.

Does this approach sound reasonable as a starting point?

[mike-hunhoff]

Hi @mike-hunhoff, I’d like to continue work on this issue.

I noticed the previous PR (#1039) attempted Netfilter hook detection but was closed due to inactivity. I’d like to revisit the Linux rootkit rules and follow the workflow you mentioned (including providing an example sample in the capa-testfiles repository).

My plan is to start with one or two techniques that should be detectable using API/string features, for example:

• privilege escalation via prepare_kernel_cred → commit_creds
• Netfilter hook registration via nf_register_net_hook

I’ll verify which features are extracted using scripts/show-features.py and then build rules based on those features. If I have a suitable example .ko sample, I’ll also submit it to the capa-testfiles repo as suggested.

Does this approach sound reasonable as a starting point?

Sure thing.

[aryanyk]

Hi @mike-hunhoff

, I’ve opened a PR that adds two new Linux kernel rootkit detection rules for capa:

• Privilege escalation via prepare_kernel_cred → commit_creds
• Netfilter hook registration via nf_register_net_hook / nf_register_hook

Both rules are currently placed in the nursery directory since example samples are not yet available.

PR: #1136

Feedback or suggestions are welcome.