Unhooking Linux EDRs
by matheuz
https://github.com/MatheuZSecurity/UnhookingLinuxEdr
| Notes |
|---|
| insmod |
| dmesg |
| EDR |
| Linux |
| LKM |
| Trend Micro |
| Trend Micro Deep Security |
| CrowdStrike Falcon |
| CrowdStrike |
| eBPF |
| machine learning |
| hooks |
| module_init(), module_exit() |
| printk |
| /proc/modules |
| /sys/module directory |
| cleanup_module alias |
| /proc/kallsyms |
| EDR, rootkits prevent module unloading with rmmod |
| linked list |
| tmhook module |
| bmsensor module |