Linux Rootkit Flipswitch Poc

Tim Peck@timpeck

•updated Oct 1, 2025•1•1•71

Detects the FlipSwitch Proof-of-Concept (PoC) Linux rootkit. This rootkit is designed to bypass modern Linux kernel (v6.9+) defenses by patching call instructions within the x64_sys_call function, a technique dubbed 'FlipSwitch'.