Detection and Removal of the Syslogk Rootkit in a Linux Environment

MITRE Techniques

• [T1014] Rootkit – Syslogk hides processes, network sockets, files, and its own module by modifying kernel behavior to avoid detection. (‘Syslogk rootkit that operates in this manner’ / ‘hides the LKM by removing its own module node’)
• [T1055] Process Injection – The rootkit alters execution flow by patching kernel API prologues so attacker-defined code runs first. (‘directly patches the prologue (OP code section) of an API function’ / ‘ensure that a function defined by the threat actor is executed first’)
• [T1012] Query Registry / System Information Discovery – It uses `/proc/kallsyms` to find kernel symbol addresses before hooking functions. (‘The address of a specific function is identified through the kernel symbol table (/proc/kallsyms)’)
• [T1562.001] Disable or Modify Tools – The rootkit disables write protection by setting the CR0 Write Protect bit to 0 and changing page permissions to tamper with kernel memory. (‘To disable memory write protection, the Write Protect bit in the CR0 register … is set to 0’)
• [T1574.004] Hijack Execution Flow: Server Software Component – It hooks kernel functions such as `proc_root_readdir`, `tcp4_seq_show`, and `readdir` to redirect control to attacker-defined functions. (‘the address of a function defined by the threat actor’ / ‘changing the `readdir` pointer in the VFS table’)
• [T1036] Masquerading – The rootkit conceals named artifacts such as `was_sys_relay` and `was-patch` to make malicious activity harder to notice. (‘If the process name is “was_sys_relay”’ / ‘contains the string “was-patch,” the corresponding entry is not returned’)
• [T1564.001] Hide Artifacts: Hidden Files and Directories – It removes file and directory entries from directory listings to hide them from users. (‘the corresponding entry is not returned, thereby concealing it’)
• [T1564.002] Hide Artifacts: Hidden Users and Groups – It hides processes from standard process listings by filtering `/proc` output. (‘If this function is called while hooked’ / ‘the entry is not returned to conceal it’)
• [T1564.004] Hide Artifacts: NTFS File Attributes – Not applicable to NTFS specifically, but the broader behavior of concealing kernel objects through module list and sysfs manipulation is described here as artifact hiding. (‘removes its own kobject node from /sys/module’)