Imperius: Exposing Hidden Linux Kernel Rootkits for Security Teams

A new tool called Imperius has emerged, designed to detect and expose Linux Kernel Module (LKM) rootkits by forcing them to become visible in system monitoring tools like lsmod. Developed as part of ongoing research into rootkit behavior, Imperius targets rootkits that use stealth techniques to evade traditional detection methods. This tool is particularly relevant for security teams looking to validate evasion techniques or uncover persistent threats in their environments.

Key Takeaways for Security Leaders

Imperius provides a novel approach to rootkit detection by exploiting a critical weakness in many LKM rootkits: their ability to toggle visibility. Key insights include:

Functionality: The tool locates and reactivates hidden rootkit modules by retrieving their memory addresses, either via /sys/kernel/tracing/available_filter_functions_addrs (kernel 6.5+) or kernel memory scanning.
Use Case: Red teams can validate rootkit evasion techniques, while blue teams gain a tool to uncover persistent threats that may evade traditional monitoring.
Limitations: Some methods require kernel 6.5 or later, though memory scanning offers a fallback for older systems.

Technical Deep Dive: How Imperius Works

Imperius exploits the visibility toggle feature found in many LKM rootkits. For instance, rootkits like Diamorphine include functions such as show_module to hide or reappear in system listings. The tool operates in two primary phases:

Locating the Rootkit’s Critical Function: For kernels ≥6.5, it parses /sys/kernel/tracing/available_filter_functions_addrs to find the address of show_module (or equivalent). Older kernels require memory scanning for signatures linked to the rootkit’s functions.
Forcing Visibility: Once located, Imperius calls the rootkit’s show_module function, forcing it to reappear in lsmod and enabling removal via rmmod.

Proof of Concept

A referenced Python script, ModTracer, demonstrates similar logic for hunting hidden modules. Imperius could integrate memory scanning as shown in this simplified example:

import fcntl  # For low-level memory operations (simplified)
def scan_kernel_memory(pid, signature):
    with open(f"/proc/{pid}/mem", "rb") as mem:
        return mem.read().find(signature)  # Simplified for illustration

Relevance to Security Teams

Imperius has distinct applications for different security roles:

Red Teams: Validate rootkit resilience against detection tools and verify stealth persistence mechanisms during post-exploitation.
Blue Teams & Researchers: Address detection gaps where rootkits hiding from lsmod may evade EDR/XDR tools. The tool also aids in analyzing rootkit behavior in controlled environments.
System Administrators: Use Imperius to expose and unload malicious modules, and consider upgrading to kernel 6.5+ for enhanced tracing support.

Mitigation Strategies

Attack Vector	Defense
Hidden LKM rootkits	Monitor `/proc/modules` for discrepancies with `lsmod`
Kernel function hijacking	Restrict `CAP_SYS_MODULE` capabilities
Memory manipulation	Enable kernel lockdown mode (if supported)

Conclusion

Imperius highlights the ongoing cat-and-mouse game in rootkit detection. While it offers a way to expose some stealth techniques, rootkit authors may adapt. Proactive monitoring and kernel hardening remain critical. Future research may reveal broader techniques for rootkit neutralization.