Closed gcmoreira closed 1 week ago
eve-mem
commented
1 week ago Hey @gcmoreira :wave:
Super cool! I can see this coming in handy.
Given it's using lsmod and pslist do you think it's worth adding those in as plugin requirements? Just to save future versions breaking things?
I think the test samples used in the automatic checking are too old to for you to make a test case for this plugin. Is there any use in me making a sample to test against?
Great work as always.
gcmoreira
commented
1 week ago Hey @eve-mem @ikelos you're absolutely right, I missed those. Thanks for the review. It should be all set now.
@eve-mem re: new samples for testing, it's something we are planning to do once we resolve how to manage the ISF files for that same purpose. At that time, we may need some help, since it's expected that, as soon as we add the new samples, some of the current plugins may not pass the tests against both newer and older kernel versions.
This PR adds a new Linux plugin to enumerate kernel threads (kthreads), including their function start addresses and, where available, the associated module and symbol names.
This helps to identify malicious code executed by a kernel module --which may no longer be running-- but persisted its malicious behavior through a kthread.
This functionality is supported starting from kernel 5.8. In earlier kernels, obtaining the kthread function start address is much more complex and requires significantly more effort.
Kernel 5.8.0-53
Kernel 6.8.0