nerdexam
GIAC

GCIH · Question #138

Which of the following Linux rootkits allows an attacker to hide files, processes, and network connections? Each correct answer represents a complete solution. Choose all that apply.

The correct answer is A. Phalanx2 B. Beastkit C. Adore D. Knark. All four tools are established Linux kernel-level rootkits that use system call hooking or binary replacement to hide files, processes, and network connections from the operating system.

Malware Analysis & Advanced Persistent Threats

Question

Which of the following Linux rootkits allows an attacker to hide files, processes, and network connections? Each correct answer represents a complete solution. Choose all that apply.

Options

  • APhalanx2
  • BBeastkit
  • CAdore
  • DKnark

How the community answered

(30 responses)
  • A
    100% (30)

Why each option

All four tools are established Linux kernel-level rootkits that use system call hooking or binary replacement to hide files, processes, and network connections from the operating system.

APhalanx2Correct

Phalanx2 is a Linux kernel rootkit that hooks system calls to conceal attacker-controlled files, directories, processes, and network connections from administrators and security tools.

BBeastkitCorrect

Beastkit is a Linux rootkit that replaces system binaries and patches kernel functions to hide the attacker's files, processes, and active connections from the OS.

CAdoreCorrect

Adore is a loadable kernel module (LKM) rootkit for Linux that intercepts system calls to hide files, processes, and network connections while maintaining persistent attacker access.

DKnarkCorrect

Knark is a classic Linux LKM rootkit that hooks kernel system calls to hide files, processes, and network connections, and can also redirect process execution to attacker-controlled binaries.

Concept tested: Linux kernel rootkit examples and stealth capabilities

Source: https://www.cisa.gov/sites/default/files/publications/Malware_and_Rootkit_Awareness_0.pdf

Topics

#Linux rootkits#Phalanx2#Adore#Knark

Community Discussion

No community discussion yet for this question.

Full GCIH Practice