ShadowGuard Persistence Artifacts

Georg Lauenstein@gsec

•updated Feb 6, 2026•3•0•63

Detects the creation of files or directories containing the string 'swsecret', which is a hard-coded artifact used by the ShadowGuard eBPF rootkit for concealment.