Linux Kernel Memory Forensics: Detecting Loadable Kernel Module (LKM) Rootkits with Volatility 3
Live response tools executed on a compromised Linux host cannot be trusted when a ring-0 Loadable Kernel Module (LKM) or eBPF rootkit hooks getdents64(), tcp4_seq_show(), or …