Detect kernel-level rootkits in Linux memory dumps using Volatility3 linux plugins (check_syscall, lsmod, hidden_modules), rkhunter system scanning, and /proc vs /sys discrepancy analysis to identify hooked syscalls, hidden kernel modules, and tampered system structures.
安装
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-linux-kernel-rootkitsnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-linux-kernel-rootkits -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-linux-kernel-rootkits -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/analyzing-linux-kernel-rootkitsgh skill install mukul975/Anthropic-Cybersecurity-Skills analyzing-linux-kernel-rootkitsgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/analyzing-linux-kernel-rootkits ~/.claude/skills/analyzing-linux-kernel-rootkits # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/analyzing-linux-kernel-rootkits ~/.agents/skills/analyzing-linux-kernel-rootkits # Codex, Cursor, Gemini CLI, Copilot, OpenCode