ShadowGuard Rootkit Management Commands

Ethan Andrews@eandrews

•updated Feb 6, 2026•2•0•31

Detects the use of non-standard signals with the 'kill' command, which are used to manage the ShadowGuard eBPF rootkit's process hiding capabilities. Signal -900 is used for allow-listing a PID, and -901 is used to remove a PID from the allow-list.