Detecting Linux Rootkits: Know Where To Look In User-Space
Where
Talks
hack.lu 2026
Duration
—
Shows where Linux rootkits can hide in user-space and how to look for them.
Summary
No summary yet — watch the video above, or open it on YouTube.
Related talks
Talks·28 min
Hilko Bengen
Explains how Linux detection and response can work with auditd-based logging and open tooling instead of a commercial EDR.
linuxthreat-detectionincident-response+2
Talks·45 min
Colson Wilhoit
Shows how behavior-based rules catch macOS threats that signatures and ML models miss, using real C2 tradecraft examples.
threat-detectiondetectiondefensive-security+2
Breaking Ground·39 min
David McDonald
Shows how tree-sitter syntax queries can detect and unwrap obfuscated PowerShell before it runs, via a custom AMSI provider.
malware-analysisthreat-detectiondefensive-security+2