Unhide is a command-line forensic utility that detects processes and TCP/UDP ports concealed by rootkits, malicious kernel modules or other techniques. It is designed to identify discrepancies between what the operating system reports and what is actually running.
Rootkits may hide processes from standard administrative tools such as ps, making malicious activity difficult to detect. Unhide uses several independent techniques to examine process information, looking for inconsistencies that could indicate attempts to conceal activity.
The toolkit also includes unhide-tcp, which searches for hidden network ports. Unhide is intended for security investigations and system auditing rather than malware removal. Some tests can produce false positives, so suspicious results should be investigated further.
This is free and open source software.
Key Features
- Detect processes hidden by rootkits, Linux kernel modules and other concealment techniques.
- Compare process information from /proc with the output of the ps command.
- Walk the procfs filesystem to identify processes that are not reported by standard process listings.
- Use system calls to detect discrepancies in reported process information.
- Exhaustive PID-space scanning to identify processes hidden from conventional enumeration methods.
- Reverse scanning to check whether threads reported by ps are also visible through kernel interfaces.
- Quick scanning mode combines multiple detection techniques with reduced execution time.
- Optional double-checking during brute-force tests to reduce false positives.
- Unhide-tcp identifies hidden listening TCP and UDP ports by comparing port probes with ss or netstat output.
- Fast network scanning mode for systems with large numbers of open ports.
- Display additional information about suspicious ports using fuser and lsof.
- Unhide_rb provides an alternative, lightweight process detection implementation.
- POSIX implementation for older Linux kernels and other Unix-like operating systems.
- Verbose output and optional log files for examining and recording scan results.
- Supports combining detection tests for more comprehensive forensic investigations.
- Cross-platform support – the POSIX implementation also supports BSD and Solaris alongside Linux.
Website: github.com/YJesus/Unhide
Support:
Developer: Yago Jesus, Patrick Gouin
License: GNU General Public License v3.0
Unhide is written in C. Learn C with our recommended free books and free tutorials.
Related Software
| Anti-Malware Tools | |
|---|---|
| ClamAV | Antivirus engine for detecting trojans, viruses, malware and other threats |
| YARA-X | Re-incarnation of YARA |
| YARA | Pattern matching swiss knife for malware researchers |
| Maltrail | Malicious traffic detection system |
| ClamTk | Graphical frontend for ClamAV |
| LMD | Malware scanner focusing on threats faced in shared hosted environments |
| phpMussel | PHP-based anti-virus anti-trojan anti-malware solution |
| Raspirus | Lightweight signature-based malware scanner |
| FastFinder | Fast suspicious file finder |
| chkrootkit | Locally checks for signs of a rootkit |
| Unhide | Forensic tool to find hidden processes and TCP/UDP ports |
| Atomdrift Scan | Malware and supply chain scanner for software security |
| paranoya | Malware scanner using indicators of compromise and YARA rules |
| decloaker | Security tool for revealing objects concealed by malware |
| Lenspect | Lightweight security threat scanner |
Read our verdict in the software roundup.
 LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software.We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README. |
Please read our Comment Policy before commenting.