Module rootkit 

Userland LD_PRELOAD rootkit forensic indicators.

Sources:

• Father rootkit source code and README (github.com/mav8557/Father): https://github.com/mav8557/Father
• MITRE ATT&CK T1574.006 — Dynamic Linker Hijacking (LD_PRELOAD abuse): https://attack.mitre.org/techniques/T1574/006/
• MITRE ATT&CK T1548.001 — Setuid and Setgid / GID manipulation: https://attack.mitre.org/techniques/T1548/001/

Modules

father

Father rootkit (github.com/mav8557/Father) forensic indicators.

Constants

KNOWN_LD_PRELOAD_ROOTKITS

Known Linux userland LD_PRELOAD rootkit library name substrings.

Functions

is_known_rootkit_lib

Returns true if filename matches a known LD_PRELOAD rootkit library name (case-insensitive substring match).

is_rootkit_gid

Returns true if gid matches a known rootkit magic GID.