Ring 0 Capstone: Reconstruct the LKM Rootkit

The capstone. A host was rooted at the kernel level and you have the full artifact set under /root/case/: proc_modules.txt (lsmod), sys_module.txt (/sys/module), modules.builtin, dmesg.txt, syscall_table.txt, and dropped_files.txt. One module is the rootkit — it self-unlinked from the module list (gone from lsmod), is unsigned and out-of-tree (the kernel tainted, verification failed), hooks syscalls into its own module memory, and was dropped as a .ko under a hidden directory.

No single artifact names it cleanly — that's the point of the capstone. A cross-view (/sys minus loaded minus built-in) returns TWO candidates: the rootkit AND a phantom (a built-in that the modules.builtin list happens to omit — ordinary noise). Only the rootkit is named in a dmesg taint / verification-failed line, so the intersection of the two is unique. And a legitimate vendor driver is out-of-tree too, but it's SIGNED (dmesg: verification succeeded) and loaded normally — not the rootkit.

Reconstruct the intrusion and record four findings:

1. The rootkit module's name — just the name, one line (/root/case/rootkit.txt).

2. The hooked syscalls — just the names, one per line, only the hooked ones (/root/case/hooked.txt). Which syscalls were hooked differs from host to host, and the table also carries commonly-hooked syscalls that are clean here: the handler address is the evidence.

3. The dropped .ko path — the persistence artifact (/root/case/persistence.txt).

4. A correlation detector (/root/detect.sh) that works from the captured module views (sys_module.txt, proc_modules.txt, modules.builtin, dmesg.txt) and prints the rootkit's bare module name (one name per line) by combining the cross-view with the dmesg taint — and flags neither the phantom nor the vendor driver. Grading runs bash /root/detect.sh, and also re-runs it against a second, unseen host's capture as bash /root/detect.sh <casedir> — so read the files from the directory given as the first argument, defaulting to /root/case (${1:-/root/case}/), not from a hardcoded path or module name. MITRE ATT&CK: T1014, T1547.006, T1562.001, T1053.