Find bdvl LD_PRELOAD rootkit with YARA.
Tag: rootkit
100 Days of YARA – Day 50: libprocesshider
I have encountered libprocesshider being used in the wild. This is a userland rootkit that abuses LD_PRELOAD to hide processes. https://github.com/gianlucaborello/libprocesshider This library is simple; under 100 lines of C code. This rule matched on a malicious libprocesshider library found on a honeypot system. rule libprocesshider { meta: description = "libprocesshider userland rootkit" strings: $ …
DMFR SECURITY 