ShadowGuard Rootkit Process Manipulation

Georg Lauenstein@gsec

•updated Feb 6, 2026•1•0•46

Detects the use of custom kill signals (-900, -901) which are used by the ShadowGuard eBPF rootkit to add or remove a process from its allow-list for kernel-level concealment.