kernel-debugging-ftrace-kprobes-kdump
Warn
Audited by Socket on Sep 3, 2026
1 alert found:
AnomalyAnomalyexamples/bad/kgdb_sysctl.sh
LOWAnomalyLOW
examples/bad/kgdb_sysctl.sh
This code fragment performs a privileged, high-impact operation by attempting to set a kernel debugging-related sysctl value (`/proc/sys/kernel/kgdb`) to `1`. While there is no evidence in the fragment of classic malware behaviors (exfiltration, persistence, reverse shells), it is atypical for normal library code and could materially weaken system security if the target knob exists and execution has sufficient privileges. More surrounding context (installation scripts/post-install hooks, calling code, and observed behavior) is needed to confirm malicious intent.
Confidence: 46%Severity: 66%
Audit Metadata