Detects rootkit presence on compromised systems by identifying hidden processes, hooked system calls, modified kernel structures, and covert network connections using Volatility memory forensics, cross-view detection, and tools like GMER, rkhunter, chkrootkit, and RootkitRevealer. Use when standard tools (Task Manager, netstat, AV/EDR) show nothing abnormal but compromise is suspected.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-rootkit-activitynpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-rootkit-activity -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-rootkit-activity -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/detecting-rootkit-activitygh skill install mukul975/Anthropic-Cybersecurity-Skills detecting-rootkit-activitygit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-rootkit-activity ~/.claude/skills/detecting-rootkit-activity # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-rootkit-activity ~/.agents/skills/detecting-rootkit-activity # Codex, Cursor, Gemini CLI, Copilot, OpenCode