Add nursery rules for Linux kernel rootkit techniques

[aryanyk]

Fixes #998

Description

This PR adds two new nursery rules for detecting Linux kernel rootkit techniques.

The first rule detects privilege escalation patterns commonly used in Linux kernel rootkits where elevated credentials are created using prepare_kernel_cred and applied via commit_creds.

The second rule detects registration of Netfilter hooks through nf_register_net_hook or nf_register_hook, which can be used by kernel modules to intercept or modify network traffic.

Both rules target Linux kernel module behavior that may indicate rootkit activity.

Rules Added

1. escalate privileges via commit_creds on Linux
   Detects the use of the prepare_kernel_cred → commit_creds API pattern frequently used by kernel rootkits to escalate privileges.

2. register Netfilter hook on Linux
   Detects the registration of Netfilter hooks (nf_register_net_hook or nf_register_hook) that may be used to inspect or manipulate packet flow.

Testing

The rules were validated using the capa linting utilities.

Commands used:

python ../capa/scripts/lint.py -t "escalate privileges via commit_creds on Linux" -v .
python ../capa/scripts/lint.py -t "register Netfilter hook on Linux" -v .

Both rules pass lint checks.
Examples are not included yet, so the rules remain in the nursery directory.

References

• https://inferi.club/post/the-art-of-linux-kernel-rootkits
• https://www.kernel.org/doc/html/latest/security/credentials.html
• https://www.kernel.org/doc/html/latest/networking/netfilter.html

AI Usage

AI tools were used to assist with drafting rule descriptions and refining rule structure. All rule logic and validation steps were reviewed and tested manually.

[mike-hunhoff]

Thanks @aryanyk , I've left comments for your review.

[mike-hunhoff]

Please explain why this is a good fit.

[aryanyk]

Registering Netfilter hooks allows a kernel module to intercept, inspect, or modify network traffic at different stages of the networking stack. Malicious kernel modules and rootkits often use this capability to hide network activity or manipulate packets, which aligns with ATT&CK technique T1562 (Impair Defenses).

[mike-hunhoff]

Please explain how this is a good fit.

[aryanyk]

This technique maps well to ATT&CK T1068 (Exploitation for Privilege Escalation) because Linux kernel rootkits commonly elevate privileges by creating a new credential structure with prepare_kernel_cred and applying it using commit_creds, effectively granting root privileges to the current process.

[williballenthin]

please use your own personal knowledge, analysis and words. we all have access to LLM-based tools, so when we respond to you, we're not asking you to ask the LLM.