Detecting Linux rootkits: Know where to look in user-space#

Hilko Bengen (CSIRT, transportation and logistics company)

• Why: eBPF-based rootkits are the modern Linux threat you can't ignore if you run eBPF in production (Cilium et al.) — and detecting rootkits that subvert the very observability layer you depend on is a hard, current problem.
• What: A survey of how Linux rootkits hide — subverting the syscall interface, the standard library, or via eBPF probes — plus detection techniques from traditional hunting scripts and a few novel methods, packaged as a modern implementation integrable with live-forensics tooling for at-scale hunts.
• How: Rootkit illusions convince standard tools but not careful observation of system behavior; the approach relies on traces that are structurally hard for a rootkit author to cover, observed from user-space vantage points rather than kernel instrumentation.
• Where applicable: Linux servers and container hosts generally — no specific distro constraint stated. Deliberately user-space, so it works where you can't deploy kernel modules. (from abstract only)