Linux user-space rootkit detectors, including unhide, can be fully evaded when the rootkit controls the shell, so user-space-only detection is not reliable.
Title resolution pending
1 Pith paper cite this work. Polarity classification is still indexing.
1
Pith paper citing it
fields
cs.CR 1years
2025 1verdicts
CONDITIONAL 1representative citing papers
citing papers explorer
-
User-space library rootkits revisited: Are user-space detection mechanisms futile?
Linux user-space rootkit detectors, including unhide, can be fully evaded when the rootkit controls the shell, so user-space-only detection is not reliable.