shell function as userland rootkit

shell functions can be used as a crude userland rootkit. Attackers can add functions to the shell with the same name as certain system commands (ls, find, netstat, …) that filter out IoCs related to the attacker.

---