Results for “linux-kernel”

Acquires Linux memory using the LiME kernel module and analyzes the image with Volatility 3 to extract processes, network connections, bash history, kernel modules, and injected code for incident response.

Analyzes malicious Linux ELF binaries including botnets, cryptominers, ransomware, and rootkits targeting servers, containers, and cloud infrastructure. Covers static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM ELF samples.

Configure and run CodeQL code scanning through GitHub Actions workflows or the standalone CLI for security analysis.

Detect and analyze Linux persistence mechanisms including crontab entries, systemd service units, LD_PRELOAD hijacking, bashrc modifications, and authorized_keys backdoors using auditd and file integrity monitoring.

Authorized reverse engineering of custom binary protocols, Protobuf/gRPC, WebSocket frames, and PCAP-driven protocol recovery with structured workflow and tooling.

Detect privilege escalation attempts including token manipulation, UAC bypass, unquoted service paths, kernel exploits, and sudo/doas abuse across Windows and Linux.