Understanding How mkdir API Hook Leads to LKM Rootkits in Linux

Nov 13, 2024 · 10 min read · Introduction Adrishya is a Linux kernel module that leverages advanced kernel hooking techniques, specifically using ftrace (the Linux kernel’s function tracer) to hook into the mkdir system call. The module is designed to block directory creation at...