Top Tweets for #RootKits

MatheuZ @MatheuzSecurity

16 days ago

Kernel Rootkit is a new Telegram community for Linux/Windows rootkit research, ring0/ring3, stealth, defense, forensics and reverse engineering. Join us, share knowledge and collaborate. https://t.co/pZNOWPT2FF #rootkits #security #windows #linux #cyber #malware #forensics

4

305

53

286

33K

MatheuZ @MatheuzSecurity

3 months ago

Singularity rootkit becomes invisible to memory dumps and also invisible to detectors based on eBPF / Tracepoints. https://t.co/MKRjVgBROo #linux #rootkits #malware #ebpf #cybersecurity

3

98

34

71

6K

MatheuZ @MatheuzSecurity

4 months ago

Linux Rootkit Competition — tmp.out #5 Rootkits may target userland, kernel space, or use hybrid approaches. Categories: * Stealth / Detection Evasion * Persistence * Complexity * Obfuscation * Novelty / Ingenuity #linux #rootkits #tmpout

MatheuzSecurity's tweet photo. Linux Rootkit Competition — tmp.out #5

Rootkits may target userland, kernel space, or use hybrid approaches.

Categories:

* Stealth / Detection Evasion
* Persistence
* Complexity
* Obfuscation
* Novelty / Ingenuity

#linux #rootkits #tmpout https://t.co/EzoupOOBjI

1

124

33

70

8K

MatheuZ @MatheuzSecurity

4 months ago

Singularity rootkit bypassing AVML/LiME (memory dump evasion modules) #linux #rootkits

MatheuzSecurity's tweet photo. Singularity rootkit bypassing AVML/LiME (memory dump evasion modules)

#linux #rootkits https://t.co/0y8nAMJlKX

1

41

6

11

2K

MatheuZ @MatheuzSecurity

4 months ago

New post of Stealthy Singularity Rootkit Singularity in a brief commit will intercepts the scheduler and OOM reporting paths used by Magic SysRq, closing the gaps that leave rootkits like Kovid and diamorphine exposes. https://t.co/vR3GmwkOcd #Linux #rootkits #infosec

MatheuzSecurity's tweet photo. New post of Stealthy Singularity Rootkit

Singularity in a brief commit will intercepts the scheduler and OOM reporting paths used by Magic SysRq, closing the gaps that leave rootkits like Kovid and diamorphine exposes.

https://t.co/vR3GmwkOcd

#Linux #rootkits #infosec https://t.co/uYz4KZaiee

0

55

14

26

7K

MatheuZ @MatheuzSecurity

5 months ago

Compile-as-a-Service: build LKM rootkit Singularity in the cloud without GCC or kernel headers. Just run a script, send your kernel info, get a ready .ko file back. Lowering the bar for kernel malware deployment. https://t.co/IrNB94ddkk #linux #malware #evasion #rootkits

MatheuzSecurity's tweet photo. Compile-as-a-Service: build LKM rootkit Singularity in the cloud without GCC or kernel headers. Just run a script, send your kernel info, get a ready .ko file back. Lowering the bar for kernel malware deployment.

https://t.co/IrNB94ddkk

#linux #malware #evasion #rootkits https://t.co/siXht4iSWI

0

59

13

33

6K

MatheuZ @MatheuzSecurity

5 months ago

Demo Stealth Singularity Rootkit bypassing Falco and tracee eBPF security tools. https://t.co/0Ass1B8N9Y #linux #rootkits #malware #evasion #ebpf

0

35

8

15

4K

MatheuZ @MatheuzSecurity

5 months ago

Stealthy Singularity rootkit new update Defeats LKRG and eBPF security tools (Bypass working on the date it was committed) https://t.co/2aclctOdwd #linux #rootkits #malware #evasion #ebpf #bypass

1

56

21

38

6K

MatheuZ @MatheuzSecurity

5 months ago

Singularity rootkit: bypassing LKRG in the next commit, I will also remove the eBPF block (-EPERM), now bypassing Falco, tracee, ghostscan, and other hidden process scanners based on eBPF (initial test version) src: https://t.co/MKRjVgBROo #linux #rootkits #malware #evasion

MatheuzSecurity's tweet photo. Singularity rootkit: bypassing LKRG in the next commit, I will also remove the eBPF block (-EPERM), now bypassing Falco, tracee, ghostscan, and other hidden process scanners based on eBPF (initial test version)

src: https://t.co/MKRjVgBROo

#linux #rootkits #malware #evasion https://t.co/bjn96kJEGv

0

129

25

66

8K

MatheuZ @MatheuzSecurity

5 months ago

Next updates for singularity rootkit is remove init / finit_module hooking and add new LKRG Bypass hook for hidden process. src: https://t.co/MKRjVgBROo #linux #rootkits #kernel #cybersecurity #malware

MatheuzSecurity's tweet photo. Next updates for singularity rootkit is remove init / finit_module hooking and add new LKRG Bypass hook for hidden process.

src: https://t.co/MKRjVgBROo

#linux #rootkits #kernel #cybersecurity #malware https://t.co/BCDfUq6wgr

3

42

7

14

3K

MatheuZ @MatheuzSecurity

5 months ago

Tested the Singularity rootkit on VirusTotal with basic obfuscation. To my surprise, no engines detected the sample at the time. src: https://t.co/MKRjVgCpDW #rootkits #linux #malware #virustotal #cybersecurity #redteam

MatheuzSecurity's tweet photo. Tested the Singularity rootkit on VirusTotal with basic obfuscation. To my surprise, no engines detected the sample at the time.

src: https://t.co/MKRjVgCpDW

#rootkits #linux #malware #virustotal #cybersecurity #redteam https://t.co/DDsj6q34Ou

2

96

13

54

7K

MatheuZ @MatheuzSecurity

6 months ago

Singularity rootkit now can bypass SELinux enforcing mode without audit logs on ICMP trigger, conntrack/netlink filtering (conntrack, ss, SOCK_DIAG), UDP hiding + setup script https://t.co/MKRjVgBROo #linux #rootkits #malware #evasion #antiforensics

4

135

45

77

9K

MatheuZ @MatheuzSecurity

6 months ago

Singularity rootkit stealthy update: block device output filtering, journalctl -k filtering, cgroup PID filtering, and taskstats netlink blocking to evade forensics and PID enumeration https://t.co/2aclctOLlL #linux #malware #rootkits

MatheuzSecurity's tweet photo. Singularity rootkit stealthy update: block device output filtering, journalctl -k filtering, cgroup PID filtering, and taskstats netlink blocking to evade forensics and PID enumeration

https://t.co/2aclctOLlL

#linux #malware #rootkits https://t.co/VHPyHMUZkU

1

10

3

3

691

MatheuZ @MatheuzSecurity

6 months ago

Singularity rootkit now includes a new feature that prevents detection via klogctl. This is achieved by hooking do_syslog and filtering kernel log output, removing tainted msg that were previously used to detect Singularity. #rootkits #linux #malware https://t.co/MKRjVgCpDW

0

27

8

14

2K

Prof (Dr) JSSodhi @jssodhi

7 months ago

#CyberWhisper #CyberSecurity #Rootkits

jssodhi's tweet photo. #CyberWhisper #CyberSecurity #Rootkits https://t.co/6Hl6JEdUlP

0

3

0

0

15

7 months ago

#CyberWhisper #CyberSecurity #Rootkits

ccfis's tweet photo. #CyberWhisper #CyberSecurity #Rootkits https://t.co/eAFPhOxpOb

0

3

0

0

14

Antonela E. Arenas

@teffyantonelita

7 months ago

Persistencia oscura: cuando tu PC jura lealtad al atacante Servicios falsos, WMI persistence, drivers alterados, hooks en explorer.exe. Una vez instalado, solo el Fuego Valyrio lo saca. #Persistence #MalwareAnalysis #DFIR #Rootkits #RedTeam

1

4

0

0

157

MatheuZ @MatheuzSecurity

7 months ago

New stealthy feature to Singularity Hook netlink_unicast for audit evasion Hidden processes now invisible to auditd, ausearch, and audit subsystem queries. Msg filtered at kernel netlink layer before reaching userspace. #rootkits #linux #rootkit https://t.co/MKRjVgBROo

2

34

11

26

11K

MatheuZ @MatheuzSecurity

8 months ago

Evading Elastic Security - Deep dive into bypassing detections through string obfuscation, symbol randomization, XOR-encoded fragments & behavioral evasion techniques https://t.co/WB3JF52E4l #infosec #redteam #linux #rootkit #elastic #malware #rootkits

0

318

79

221

16K

MatheuZ @MatheuzSecurity

8 months ago

Singularity rootkit update: ICMP reverse shell trigger, which activates a reverse connection through custom ICMP packets. Source: https://t.co/MKRjVgCpDW #linux #rootkits #lkm #singularity #malware #icmp #backdoor #hooking

MatheuzSecurity's tweet photo. Singularity rootkit update: ICMP reverse shell trigger, which activates a reverse connection through custom ICMP packets.

Source: https://t.co/MKRjVgCpDW

#linux #rootkits #lkm #singularity #malware #icmp #backdoor #hooking https://t.co/LBy8K09Bz8

10

384

76

248

24K

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users