LIST_POISON1
2025-04-12
LIST_POISON1 and LIST_POISON2 are identifers used in the Linux kernel that are used to overwrite next and prev pointers of linked list nodes after they are removed to help detect and prevent use-after-free bugs and list corruption.
https://lists.kernelnewbies.org/pipermail/kernelnewbies/2016-March/015879.html
Linux Persistence: Modular Software
2025-04-17 DFIR CTF persistence linux persistence apache asterisk
Linux Persistence: Web Shells
2025-04-16 DFIR persistence webshell linux persistence webshell apache nginx PHP
Linux Persistence: Rootkits
2025-04-15 DFIR persistence rootkit LKM linux persistence LKM rootkit LD_PRELOAD kprobe ftrace ld.so hooking
Defanging Linux LKM Rootkits With cleanup_module()
2025-04-05 Linux LKM rootkits EDR hooks incident response Linux LKM rootkit