Tyton - Linux Kernel-Mode Rootkit Hunter For 4.4.0-31+

Linux Kernel-Mode Rootkit Hunter for 4.4.0-31+.
For to a greater extent than information, catch Tyton's website.

Detected Attacks

• Hidden Modules
• Syscall Table Hooking
• Network Protocol Hooking
• Netfilter Hooking
• Zeroed Process Inodes
• Process Fops Hooking
• Interrupt Descriptor Table Hooking

Additional Features
Notifications: Users (including myself) practise non actively monitor their journald logs, too therefore a userland notification daemon has been included to monitor journald logs too display them to the user using libnotify. Notifications are enabled subsequently install past times XDG autorun, too therefore if your DM does non accept /etc/xdg/autostart it volition fail.
DKMS: Dynamic Kernel Module Support has been added for Arch too Fedora/CentOS (looking to expand inward the nigh future). DKMS allows the (near) seamless upgrading of Kernel modules during amount upgrades. This is mainly of import for distributions that supply rolling releases or upgrade their amount frequently.

Installing

Dependencies

• Linux Kernel 4.4.0-31 or greater
• Corresponding Linux Kernel Headers
• GCC
• Make
• Libnotify
• Libsystemd
• Package Config
• GTK3

From Source

Ubuntu/Debian/Kali

1. sudo apt install linux-headers-$(uname -r) gcc brand libnotify-dev pkg-config libgtk-3-dev libsystemd-dev
2. git clone https://github.com/nbulischeck/tyton.git
3. cd tyton
4. make
5. sudo insmod tyton.ko

Note: For Ubuntu 14.04, libsystemd-dev is named libsystemd-journal-dev.

Arch

1. sudo pacman -S linux-headers gcc brand libnotify libsystemd pkgconfig gtk3
2. git clone https://github.com/nbulischeck/tyton.git
3. cd tyton
4. make
5. sudo insmod tyton.ko

Note: It's recommended to install Tyton through the AUR too therefore you lot tin give the axe practise goodness from DKMS.

Fedora/CentOS

1. dnf install kernel-devel gcc brand libnotify libnotify-devel systemd-devel gtk3-devel gtk3
2. git clone https://github.com/nbulischeck/tyton.git
3. cd tyton
4. make
5. sudo insmod tyton.ko

Kernel Module Arguments
The amount module tin give the axe endure passed a specific timeout declaration on insertion through the ascendence line.
To practise this, run the ascendence sudo insmod tyton.ko timeout=X where X is the set out of minutes you lot would similar the amount module to hold back earlier executing its scan again.

AUR
Tyton is available on the AUR here.
You tin give the axe install it using the AUR helper of your choice:

• yaourt -S tyton-dkms-git
• yay -S tyton-dkms-git
• pakku -S tyton-dkms-git

Download Tyton