Обнаружение Linux-руткитов в дампах памяти

★ 8.4 · security

analyzing-linux-kernel-rootkits is a Claude Code skill that detects kernel-level rootkits in Linux memory dumps using Volatility3 plugins and cross-view discrepancy analysis. It runs linux.check_syscall, linux.lsmod, linux.hidden_modules, and linux.check_idt to identify hooked syscalls, hidden LKMs, and tampered function pointers in physical memory acquired via LiME or AVML. Module lists from /proc/modules, lsmod, and /sys/module are compared to surface modules hidden from any single view, while rkhunter and chkrootkit scan for known rootkit signatures and SHA-256 mismatches in system binaries. The final JSON report covers syscall hooks, hidden processes, modified IDT entries, concealed network connections, and rkhunter findings. Designed for digital forensics analysts and SOC teams investigating ring-0 Linux compromises, it maps to MITRE ATT&CK T1014, T1547.006, and T1564.001.