Skip to content
Get packs

Linux Kernel Rootkit Analysis

Hunts for kernel-level rootkits in Linux memory dumps and live systems using Volatility3 and rkhunter.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

This skill teaches an AI agent how to investigate a Linux machine for stealthy malware that hides at the core of the operating system. The agent works through a set of steps: it looks for hooked system calls, hidden kernel modules, and mismatches between what /proc and /sys report, using Volatility3 on a captured memory image and rkhunter/chkrootkit on a running system. It then summarizes the findings in a structured report.

Great for

  • Incident responders and SOC analysts examining a suspected compromised Linux server
  • Forensic examiners who already have a memory dump (LiME or AVML) and want a structured checklist
  • Security students learning how kernel rootkits are detected

Skip it if

  • Routine system administration or general malware removal, since the skill focuses on forensic detection rather than cleanup
  • Relying on the output as proof of compromise without expert review, because the example report and detection logic can produce false positives and the skill's example script output is illustrative
  • Running it against production systems without authorization, since it executes system tools and a Python script

Try asking

  • “Analyze this Linux memory dump for hooked syscalls and hidden kernel modules using Volatility3”
  • “Compare /proc/modules, lsmod and /sys/module on this server to find hidden modules”
  • “Run rkhunter and chkrootkit on this host and summarize any suspicious findings”
  • “Write a JSON report of kernel-level rootkit indicators from this LiME capture”
Step-by-step guide: how to use Linux Kernel Rootkit AnalysisInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    analyzing-linux-kernel-rootkits.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-linux-kernel-rootkits.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-linux-kernel-rootkits.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Work on a copy of the memory image and keep original evidence hashed and read-only for chain of custody.
  • Use a symbol table that exactly matches the target kernel version, or Volatility3 results will be unreliable.
  • Treat rkhunter and chkrootkit results as leads to verify manually, since signature tools miss novel rootkits and can flag benign changes.

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.