Linux user-space rootkit detectors, including unhide, can be fully evaded when the rootkit controls the shell, so user-space-only detection is not reliable.
Linux on-the-fly kernel patching without lkm,
1 Pith paper cite this work. Polarity classification is still indexing.
1
Pith paper citing it
citation-role summary
background 1
citation-polarity summary
fields
cs.CR 1years
2025 1verdicts
CONDITIONAL 1roles
background 1polarities
unclear 1representative citing papers
citing papers explorer
-
User-space library rootkits revisited: Are user-space detection mechanisms futile?
Linux user-space rootkit detectors, including unhide, can be fully evaded when the rootkit controls the shell, so user-space-only detection is not reliable.