Module heuristics 

Pure heuristic classifiers for Linux forensic artifacts.

This module consolidates all classify_* functions from the individual walker modules into one discoverable, collectively-testable location.

Each function is a pure heuristic: it takes only primitive values and returns bool or a tuple — no ObjectReader dependency.

The original walker modules re-export every symbol from here so all existing call sites continue to compile unchanged.

Functions

classify_afinfo_hook

Classify whether a network protocol handler function pointer has been hooked.

classify_bpf_program

Classify whether a BPF program type/name combination is suspicious.

classify_capabilities

Classify whether a non-root process holds suspicious Linux capabilities.

classify_cgroup

Classify whether a cgroup path indicates a container runtime.

classify_container_escape

Classify whether a process indicator suggests a container escape attempt.

classify_deleted_exe

Classify whether a process running from a deleted executable is suspicious.

classify_ebpf_map

Classify whether an eBPF map is suspicious.

classify_ftrace_hook

Classify whether an ftrace function pointer is outside the kernel text range.

classify_futex

Classify whether a futex entry is suspicious.

classify_hidden_dentry

Classify whether a dentry is hidden or suspicious.

classify_idt_entry

Classify whether an IDT handler address has been hooked.

classify_io_uring

Classify whether an io_uring submission is suspicious.

classify_iomem

Classify whether an /proc/iomem region entry is suspicious.

classify_kernel_timer

Classify whether a kernel timer callback is outside the kernel text range.

classify_kmsg

Classify whether a kernel log message matches known suspicious patterns.

classify_kthread

Classify whether a kernel thread entry looks suspicious.

classify_ld_preload

Classify whether an LD_PRELOAD value references a suspicious library path.

classify_library

Classify whether a mapped library path is suspicious.

classify_memfd

Classify whether a memfd_create file is suspicious.

classify_module_visibility

Classify whether a kernel module is hidden by cross-referencing three views.

classify_mount

Classify whether a mount entry is suspicious.

classify_notifier

Classify whether a keyboard notifier callback is outside the kernel text range.

classify_oom_victim

Classify whether an OOM-killed process is suspicious.

classify_pam_hook

Classify whether a PAM library path is suspicious.

classify_perf_event

Classify whether a perf_event is suspicious.

classify_psaux

Classify whether process auxiliary state is suspicious.

classify_ptrace

Classify whether a ptrace relationship is suspicious.

classify_raw_socket

Classify whether a raw socket is suspicious.

classify_shared_creds

Classify whether shared struct cred pointers indicate credential theft.

classify_signal_handler

Classify whether a signal handler configuration is suspicious.

classify_systemd_unit

Classify whether a systemd unit is suspicious.

classify_tmpfs_file

Classify whether a tmpfs file is suspicious.

classify_unix_socket

Classify whether a Unix domain socket is suspicious.

classify_zombie_orphan

Classify whether a zombie or orphan process is suspicious.