Add nursery rules for Linux kernel rootkit techniques

[aryanyk]

Fixes #998

Description

This PR adds two new nursery rules for detecting Linux kernel rootkit techniques.

The first rule detects privilege escalation patterns commonly used in Linux kernel rootkits where elevated credentials are created using prepare_kernel_cred and applied via commit_creds.

The second rule detects registration of Netfilter hooks through nf_register_net_hook or nf_register_hook, which can be used by kernel modules to intercept or modify network traffic.

Both rules target Linux kernel module behavior that may indicate rootkit activity.

Rules Added

1. escalate privileges via commit_creds on Linux
   Detects the use of the prepare_kernel_cred → commit_creds API pattern frequently used by kernel rootkits to escalate privileges.

2. register Netfilter hook on Linux
   Detects the registration of Netfilter hooks (nf_register_net_hook or nf_register_hook) that may be used to inspect or manipulate packet flow.

Testing

The rules were validated using the capa linting utilities.

Commands used:

python ../capa/scripts/lint.py -t "escalate privileges via commit_creds on Linux" -v .
python ../capa/scripts/lint.py -t "register Netfilter hook on Linux" -v .

Both rules pass lint checks.
Examples are not included yet, so the rules remain in the nursery directory.

References

• https://inferi.club/post/the-art-of-linux-kernel-rootkits
• https://www.kernel.org/doc/html/latest/security/credentials.html
• https://www.kernel.org/doc/html/latest/networking/netfilter.html

AI Usage

AI tools were used to assist with drafting rule descriptions and refining rule structure. All rule logic and validation steps were reviewed and tested manually.

[mike-hunhoff]

Thanks @aryanyk , I've left comments for your review.

[aryanyk]

Thanks for the clarification. I will explain it based on my understanding .

For commit_creds : using commit_creds in many linux kernel rootkits the module first prepares a new credential structure calling prepare_kernel_cred(NULL) and after calling commit_creds to set. This essentially gives the current process root credentials. I mapped it to ATT&CK T1068 since the end state is privilege escalation within the kernel.

For Netfilter : A Netfilter hook is an interface that provides a way to inspect or modify packets that's traversing down the networking stack, registering a netfilter hook allows kernel modules to do just that. This is sometimes used by malicious modules to hide traffic or manipulate how endpoints behave on the network such that this can interfere with monitoring or defensive controls, which I mapped to T1562.

@mike-hunhoff please let me know if this reasoning looks correct or if you’d prefer a different mapping.