Detect Linux Rootkit intrusion threats

Background

A rootkit is a malicious program planted by attackers after compromising a server. It is designed to hide itself and maintain persistent access. Rootkits typically exploit low-level operating system mechanisms to evade manual auditing and security software analysis, often involving injection into and tampering with kernel components and drivers.

Security Center rootkit detection solution

Security Center provides a lightweight rootkit detection solution that identifies potential rootkit traces and impacts using forensic methods. This solution consumes minimal server resources and does not affect business stability.

The rootkit detection feature operates based on the universal rootkit principle: all rootkits must hook, tamper with, or hijack kernel-mode functions, including system calls, VFS functions, and lower-level functional functions. The detection feature captures and analyzes critical data from system memory images to determine the presence and attributes of rootkits, identify tampered system functions, infer rootkit behavior, and push detailed alerts to you.

As a forensic scanning technique, this solution periodically detects all implanted and active rootkit kernel modules on target servers. It does not include behavioral detection during the rootkit implantation process. To detect suspected rootkit implantation behavior and kernel module files (.ko files) used for implantation, refer to alert types provided by Security Center, such as "Abnormal Process Behavior," "Malware," and "Persistent Backdoor."

Rootkit detection and notification scope

Security Center Enterprise Edition performs scheduled daily checks for rootkit threats across your assets. When a threat is detected, alert notifications are automatically sent without requiring manual activation or triggering. Users without Enterprise Edition or users for whom no rootkit threats are detected will not receive relevant alerts.

Rootkit alert details

When a rootkit kernel module is detected in your assets, the Security Center console pushes a security alert named Malicious Process (Cloud Detection) - Rootkit Kernel Module with a status of Pending. An example alert is as follows:

The rootkit kernel module is named reptile_module. Its tampered kernel functions include __d_lookup, audit_alloc, filldir, inet_ioctl, ip_rcv, sys_kill, tcp4_seq_show, udp4_seq_show, vfs_read, and others (18 in total). The rootkit characteristic impacts cover signal hijacking or backdoor toggles, file content hiding, privilege escalation, directory or file hiding, network hiding, process hijacking, and process hiding. A Linux rootkit kernel module is sophisticated malicious code implanted into the operating system kernel by attackers. We recommend that you evaluate the situation and migrate your data and business afterward.

The following table describes the alert parameters.

Supported rootkits

The Security Center rootkit detection feature supports detection on 64-bit servers running Linux kernel 2.6.32 or later. For testing, we selected open or open-source Linux LKM rootkits from the actively maintained RootKits-List-Download list on GitHub. Security Center currently supports full detection of all still-effective rootkits from this list.

The complete test list and results are shown in the following table.

Advanced adversarial rootkit detection

Through real-world analysis of cloud servers, we have identified certain adversarial rootkits specifically designed to counter scanning detection based on kernel memory forensics (such as Volatility). Security Center's current detection mechanisms can bypass such obfuscation and countermeasures. Adversarial rootkits typically go beyond hiding modules by further erasing traces such as module headers from the memory data of loaded kernels. In such cases, the detection feature can still locate kernel function tampering and corresponding characteristic impacts, but cannot reconstruct and extract the kernel module name. In this scenario, the alert information you receive is as follows.

The alert title is Malicious Process (Cloud Detection) - Rootkit Kernel Module with a status of Pending. The Rootkit Kernel Module is displayed as (Adversarial Obfuscated). The Kernel Functions Tampered by Rootkit include __d_lookup, audit_alloc, compat_filldir, filldir, find_task_by_vpid, inet_ioctl, tcp4_seq_show, udp4_seq_show, vfs_read, and others. The Rootkit Characteristics and Impact include file content hiding, privilege escalation, directory or file hiding, network hiding, process hijacking, and process hiding.