Hooked on Linux: Rootkit Taxonomy, Hooking Techniques and Tradecraft

Key Takeaways

• Linux rootkits have evolved from userland shared objects to Loadable Kernel Modules (LKMs), eBPF, and emerging io_uring-based implementations.
• Modern rootkits increasingly abuse legitimate kernel frameworks like ftrace, kprobes, and eBPF to install stealthy hooks without traditional module loading.
• Linux kernel 6.9 introduced architectural changes to syscall dispatching that broke traditional sys_call_table hooking, though new techniques like FlipSwitch can bypass this.
• The io_uring asynchronous I/O interface is emerging as a powerful evasion technique, allowing attackers to batch operations and bypass per-syscall EDR monitoring.

Affected Systems

• Linux (various kernel versions including pre-2.6, 4.8+, 5.1+, 6.9+)
• Containers and Kubernetes
• IoT devices
• Production servers

Vulnerabilities (CVEs)

• CVE-2022-0847

Attack Chain

Attackers gain initial access and deploy a loader component, which may escalate privileges using vulnerabilities like CVE-2022-0847 (Dirty Pipe). The loader wipes execution evidence from bash_history and syslog, then establishes persistence via systemd, cron, or udev. Finally, the core rootkit payload is executed, utilizing techniques like LKM injection, eBPF programs, or io_uring to hook kernel functions, hide processes, and maintain stealthy control.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

The article focuses on rootkit theory and hooking techniques; detection engineering and specific rules will be covered in part two of the series.

Detection Engineering Assessment

EDR Visibility: Medium — Traditional EDRs can detect LKM loading and basic syscall hooking, but advanced rootkits using eBPF, io_uring, or inline patching often bypass standard per-syscall telemetry. Network Visibility: Low — Rootkits actively hide network sockets and connections from userland tools like netstat and lsof. Detection Difficulty: Hard — Rootkits operate at the highest privilege levels, subverting the very APIs and structures that security tools rely on for visibility.

Required Log Sources

• Kernel Audit Logs
• eBPF Telemetry
• File Integrity Monitoring (FIM)
• Process Execution Logs

Hunting Hypotheses

Hypothesis	Telemetry	ATT&CK Stage	FP Risk
Look for unexpected or unauthorized eBPF programs being loaded into the kernel.	eBPF subsystem logs, auditd	Persistence/Evasion	Medium (legitimate tracing/monitoring tools use eBPF)
Identify anomalous io_uring activity, such as unusually large batches of metadata operations bypassing standard syscalls.	io_uring_enter syscall monitoring	Evasion	High (high-performance applications legitimately use io_uring)
Monitor for unexpected kprobes registered in the kernel debug filesystem.	/sys/kernel/debug/kprobes/list	Evasion	Low (production systems rarely have dynamic kprobes added outside of specific debugging sessions)

Control Gaps

• Syscall-based EDR monitoring (bypassed by io_uring)
• Userland integrity checks (bypassed by kernel-level hooks)

Key Behavioral Indicators

• Mismatches between on-disk libraries and in-memory imports
• Altered GOT/PLT entries
• Unexpected LD_PRELOAD or LD_AUDIT environment variables
• Hidden modules not listed in /proc/modules

False Positive Assessment

• Low

Recommendations

Immediate Mitigation

• Review /sys/kernel/debug/kprobes/list for unauthorized kprobes.
• Check for suspicious LD_PRELOAD or LD_AUDIT environment variables across active sessions.

Infrastructure Hardening

• Enable Secure Boot to enforce kernel module signing.
• Implement Linux Security Modules (LSMs) like SELinux or AppArmor.
• Restrict CAP_BPF and CAP_SYS_ADMIN capabilities to prevent unauthorized eBPF program loading.
• Enable CONFIG_STRICT_KERNEL_RWX to enforce read-only kernel memory pages.

User Protection

• Deploy File Integrity Monitoring (FIM) on critical configuration files like /etc/profile and .bashrc.

Security Awareness

• Educate operations teams on the risks of outdated IoT kernels and unmonitored headless production servers.

MITRE ATT&CK Mapping

• T1014 - Rootkit
• T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking
• T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions
• T1068 - Exploitation for Privilege Escalation
• T1070.002 - Indicator Removal: Clear Linux or Mac System Logs
• T1070.003 - Indicator Removal: Clear Command History
• T1543.002 - Create or Modify System Process: Systemd Service
• T1053.003 - Scheduled Task/Job: Cron
• T1562.001 - Impair Defenses: Disable or Modify Tools

Additional IOCs

• File Paths:
  • /etc/profile - Global profile file targeted for userland rootkit persistence.
  • .bashrc - User profile file targeted for userland rootkit persistence.
  • .profile - User profile file targeted for userland rootkit persistence.
• Command Lines:
  • Purpose: Load malicious kernel modules into memory | Tools: insmod, modprobe | Stage: Execution/Persistence | insmod <module.ko>
  • Purpose: Load and attach eBPF programs to kernel tracepoints or LSM hooks | Tools: bpftool, tc | Stage: Execution/Evasion | bpftool prog load
• Other:
  • LD_AUDIT - Environment variable abused for dynamic linker hijacking.