bcoles/rootkit-signal-hunterDetect Linux rootkits which use signals to elevate process privileges.
Detect Linux rootkits which use signals to elevate process privileges.
Some rootkits install signal handlers which listen for specific signals to elevate privileges. This tool can identify these rootkits by sending signals and observing UID switching to root. Optionally spawns a root shell.
Tested with:
666)You can download the latest pre-built binaries from the Releases page; or build the latest pre-release version from source:
git clone https://github.com/bcoles/rootkit-signal-hunter && \
cd rootkit-signal-hunter && \
cargo build --release
rootkit-signal-hunter -- [OPTIONS]
--min <MIN>: Minimum signal number (default: 0)--max <MAX>: Maximum signal number (default: 64)-s, --shell: Launch a root shell (if detected)-t, --threads: Number of worker threads (default: 16)-p, --pid: Process ID to send signals to (default: $$)-v, --verbose: Enable verbose output[!NOTE] The
--pidimplementation uses$$to represent the process ID of a newly spawned process. This will fail on non-POSIX compliant shells such as Fish.
Rootkits such as Singularity
and Diamorphine allow privilege
escalation using any process ID and can be trivially detected with default options
(-s spawns a root shell):
rootkit-signal-hunter -s
Rootkits such as KoviD require a specific
process ID to be provided with the -p / --pid flag:
rootkit-signal-hunter -s --pid 666
[!NOTE] This risks terminating the legitimate process with ID
666(if the current user has the necessary permission).
This project is licensed under the MIT License. See the LICENSE file for details.
Shoutout to David Reguera Garcia (Dreg) who implemented similar signal-based detection as part of lsrootkit.
Copyright © 2025, bcoles