execmon
is an advanced process execution monitoring utility for linux.
The project consists of a kernel module and a user mode utility. The kernel module tracks new process executions, or precisely, intercepts the execve
syscall.
Whenever the kernel intercepts a new execution, it notifies the user immediately about it.
In the past, hooking syscalls in the Linux kernel was an easier task, however, in newer kernels, assembly stubs were added to the syscalls.
execmon
overcomes this obstacle, patching the kernel on the fly. For this purpose I used the open source project Udis86.
make
insmod
)Kfir Shtober (Kfiros) 2016