Singularity Linux Kernel Rootkit with klogctl Detection Evasion
## Overview of Singularity Linux Kernel Rootkit
Overview of Singularity Linux Kernel Rootkit
Singularity is a Linux Kernel Module (LKM) rootkit designed to evade detection on systems running modern 6.x Linux kernels. It introduces log-evasion capabilities that prevent detection through traditional kernel logging interfaces such as klogctl .
Singularity employs deep kernel hooking and advanced log sanitization methods to remain undetected on compromised systems. It operates entirely in kernel space using ftrace-based syscall and function hooking, compatible with kernels like 6.8.0-79-generic and 6.12.
The rootkit features real-time filtering of sensitive strings and indicators from various log sources, including /proc/kmsg , /var/log/kern.log , syslog , auth.log , /proc/kallsyms , and kernel tracing paths such as /sys/kernel/debug/tracing/* .
Singularity hides itself once loaded and cannot be unloaded without a system reboot, effectively neutralizing common incident response and detection workflows. Sensitive identifiers are stripped from logs before they reach user space, hindering detection by tools that rely on dmesg , journalctl , or klogctl .
Singularity is a Linux Kernel Module (LKM) rootkit designed to evade detection on systems running modern 6.x Linux kernels.
The rootkit provides comprehensive process hiding from /proc , ps , top , htop , etc., and conceals network connections and ports from monitoring tools like ss and netstat . It supports privilege escalation via environment variables or signals, with customizable settings to evade detection.
Singularity intercepts eBPF-related syscalls, blocking the loading of tracing and monitoring programs. It disrupts observability mechanisms by targeting tools such as Tracee, bpftrace, and bpftool.
Singularity increases the complexity of detection for Linux kernel-level threats by preventing visibility through standard logging channels and disrupting audit and telemetry paths. Although not perfectly undetectable, it highlights the need for advanced detection strategies that go beyond user-space logs and traditional tools.
For cybersecurity professionals, Singularity serves as a reminder of the evolving nature of threats targeting Linux systems, underscoring the importance of comprehensive security measures.
Based on reporting by GBHackers.