what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Encrypted Linux x86-64 Loadable Kernel Modules (ELKM)

Posted Aug 18, 2020

Authored by cenobyte | Site github.com

In this paper, the author presents ELKM, a Linux tool that provides a mechanism to securely transport and load encrypted Loadable Kernel Modules (LKM). The aim is to protect kernel-based rootkits and implants against observation by Endpoint Detection and Response (EDR) software and to neutralize the effects of recovery by disk forensics tooling. The tool as well as the whitepaper is provided in this archive.

tags | tool, paper, kernel

systems | linux, unix

SHA-256 | 90f8eb13eaf41b5f53ca0215da59d606b3744835abc350e84c035ce5e337aa31

Download | Favorite | View

Related Files

No related files