KoviD

KoviD is an open-source Loadable Kernel Module (LKM) designed for educational and defensive security research focused on rootkit techniques within Linux Kernel version 5 and later. It empowers security researchers and system administrators to analyze rootkit behavior, develop detection signatures, and enhance their understanding of kernel-level vulnerabilities through practical demonstrations of real-world threat capabilities. Notable features include support for investigating module concealment, process hiding, and log manipulation, enabling users to test and improve their security monitoring and incident response strategies.