How to use the Linux Kernel Rootkit Analysis agent skill

What the skill makes the agent do

Kernel rootkits run at the lowest privilege level of the operating system and change kernel data structures to hide processes, files, network connections and kernel modules from ordinary tools. The skill gives the agent a checklist for finding these changes. It runs Volatility3 Linux plugins against a memory image to look for hooked system calls, hidden kernel modules and modified interrupt table entries.

For a running system, the agent uses rkhunter and chkrootkit to check for known rootkit signatures, suspicious files and modified system binaries. It also compares module lists from /proc/modules, lsmod and /sys/module to find modules that appear in one view but not another. The result is a structured report.

• Finds syscall table hooks with linux.check_syscall
• Lists modules and looks for hidden ones with linux.lsmod and linux.hidden_modules
• Checks interrupt descriptor table entries with linux.check_idt
• Cross-checks /proc, /sys and kernel data on a live system
• Summarizes findings in a JSON report

What you need before you start

The skill assumes you already have a few things in place. It does not acquire evidence for you from scratch, and it needs the right kernel symbol file to read a memory image correctly.

• Python 3
• Volatility3, installed with pip install volatility3
• A Linux symbol table (ISF) that matches the target kernel version
• A Linux memory dump captured with LiME, AVML or /proc/kcore
• rkhunter and chkrootkit for live system scanning
• Root or sudo privileges for live scanning and memory acquisition
• A reference known-good kernel image for comparison

How to install the skill

Download the ZIP for this skill from this page and unzip it. For a personal setup, place the folder in ~/.claude/skills/. To scope it to one project, place it in that project's .claude/skills/ folder. In the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.

After installing, confirm the folder contains SKILL.md, scripts/agent.py and references/api-reference.md. The agent reads SKILL.md to learn the procedure and loads the other files when it needs them.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project
• Claude apps: Settings → Capabilities → Skills, then upload

How to trigger the skill with natural requests

You do not need to type a command to use the skill. Describe the situation in plain language and mention the artifacts you have. The agent should match the request to the skill's description, which covers Linux kernel rootkits, Volatility3, rkhunter and /proc versus /sys discrepancies.

Be specific about the evidence. Say where the memory image is, which kernel it came from, and whether you can run live checks. This helps the agent choose between memory analysis and live scanning.

• Analyze the memory dump at /evidence/server01.lime for kernel rootkits and list any hooked syscalls.
• This Ubuntu server may be compromised. Check it for hidden kernel modules and compare /proc/modules with /sys/module.
• Run rkhunter and chkrootkit on this host and summarize anything that looks like a kernel-level rootkit.
• Using Volatility3, check the IDT and hidden modules in this AVML capture and write a structured report.

Example: what the output looks like

The skill's example report shows the kind of structured output to expect. It lists hooked syscalls with expected and current addresses, module counts from lsmod and the kernel object list, hidden processes, IDT status, rkhunter results and any suspicious network connections, followed by a summary with a risk level.

Treat this example as illustrative. The addresses, process IDs and IP addresses in it are sample values from the skill's documentation, not findings from your system.

Check the output before you act on it

Detection logic and example output can produce false positives. A finding such as a hooked syscall or a modified binary is a lead to investigate, not proof of compromise. Have an experienced analyst review the results, and compare them against a known-good kernel image where you can.

Several parts of the skill run scripts and use the network. The package includes scripts/agent.py and the example invokes system tools such as rkhunter and chkrootkit. Read the script before running it, and run it only on systems you are authorized to examine. Live scanning and memory acquisition require root or sudo, so use an isolated analysis machine where possible.

• Do not run against production systems without authorization
• Review scripts/agent.py before execution
• Treat findings as leads and verify them manually
• Keep the memory image unchanged as evidence

Tips for better results

Match the symbol table to the exact kernel version of the memory image. The skill's prerequisites call for an ISF that matches the target kernel, and a mismatch is a likely cause of unreliable plugin output. Capture memory before you reboot or shut down the machine, since a reboot discards volatile data.

Ask for JSON output when you plan to feed results into other tools. The Volatility3 reference includes a JSON option for plugins such as check_syscall.

• Capture memory before rebooting
• Confirm the kernel version and symbol table match
• Ask for the JSON report for downstream tooling
• Compare results against a known-good kernel image