Linux Loadable Kernel Module (LKM) based rootkit (ring-0), capable of hiding itself, processes/implants, rmmod proof, has ability to bypass infamous rkhunter antirootkit.
Hiding rootkit from being revealed to usermode program via /sys/module/ directory, using syscall interception or any other methods (calling APIs or any other things).
Hiding rootkit from being revealed to usermode program via
/sys/module/directory, using syscall interception or any other methods (calling APIs or any other things).