Linux rootkit evolution and detection strategies
We will focus on 3 main categories and ways to detect them. Since there are some others, the ones presented are easy to study as there are publicly available code on Github.
Categories are: 1. LD_PRELOAD – Dynamic library highjacking, 2. LKM – loadable kernel module, 3. eBPF.
The idea of this detection is to see how using built-in linux tools, and some of-the-shelf public resources we can detect specific 'cloaking' techniques used by those rootkits. Another objective is to demonstrate why relying on behavior detection in much more better than outdated signature style detection (eg. Yara and Sigma).
We are using Ubuntu 20.04 Server image, as it is best fit for both older and newer rootkits targeting specific kernel versions.