I found this small rootkit source code implemented as a Linux kernel module.https://github.com/mfontanini/Programs-Scripts/tree/master/rootkitBasically, as you can see, it changes the file_operations structure from the file inode and overwrite the readdir function to hide itself from ls and lsmod.In that case, how would be possible to detect this rootkit?
How to detect rootkit linux kernel module based?
linux;kernel