What is an LKM rootkit?

An LKM rootkit is a rootkit delivered as a Linux loadable kernel module. Once loaded, it runs with full kernel privilege and can hide processes, files, ports, and itself.

It hides by unlinking its entry from the kernel’s module list, so lsmod no longer shows it, while /sys/module often still does. Known families include Diamorphine and Reptile.

Detection involves comparing /proc/modules against /sys/module, looking for hidden PIDs by probing /proc/ directly, and watching for init_module and finit_module syscalls with eBPF. Kernel lockdown, Secure Boot module signing, and disabling module loading after boot limit the attack.