https://github.com/AsafEitani/rootkit_plugins

https://github.com/AsafEitani/rootkit_plugins

Last synced: 3 months ago
JSON representation

• Host: GitHub
• URL: https://github.com/AsafEitani/rootkit_plugins
• Owner: AsafEitani
• Created: 2022-12-21T11:43:57.000Z (about 2 years ago)
• Default Branch: main
• Last Pushed: 2022-12-24T12:51:01.000Z (about 2 years ago)
• Last Synced: 2024-05-21T09:15:07.775Z (8 months ago)
• Language: Python
• Size: 39.1 KB
• Stars: 4
• Watchers: 1
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• awesome-volatility - rootkit - plugins that detect advanced rootkit hooking methods. (Volatility 3 / Plugins)

README

        
## Volatility3 rootkit plugins




### Project Description

This repo contains a set of Volatility3 plugins that detect advanced rootkit hooking methods.

[A full (but readable) explanation of plugin details can be found in the contest submission document](docs/contest_submission.md)

### Plugins

- **`check_seqops`** - The `check_seqops` plugin is used to detect hooking on network seq_operations structs. Sequnece operations hooking is performed by kernel rootkits to avoid detection of network related activity.

- **`check_fops`** - The `check_fops` plugin is used to detect hooking on file_operations structs. File operations hooking is performed by kernel rootkits to avoid detection of file system related activity. Mostly used to hide files, directories and processes from the procfs.

- **`fileless`** - The `fileless` plugin is used to detect processes that were created from a temporary file (like /dev/shm/ or memfd:) or that their executable file was deleted after the process creation. This technique is often used to avoid detection of disk scanning security solutions and to avoid further investigation of the executable malware.

### ✔️ Prerequisites:

- Python 3

- Volatility 3

Install on Linux using these commands:

```bash

apt install python3

# clone from repo

git clone https://github.com/volatilityfoundation/volatility3.git

# or install as a module

pip3 install volatility3

```

### ⚙ Installation

All plugins are located in the `plugins` folder. Copy them to your Volatility 3 directory under `volatility3/volatility3/framework/plugins/linux`.

Some other framework extensions are required. They are located under `volatility3_changes`, and are organized in the same directory structure as their location within Volatility 3. Simply copy them to the same location (overwrite existing files if needed).