Blog
Writing from Open Stealth on rootkit detection, training environments, Linux security tooling, and defensive engineering.
Topics
Featured article
OpenStealth uses a controlled research module to turn kernel behavior into validation workflows, product checks, and training material for defenders.
Defense Engineering
OpenStealth sits between adversarial kernel research and defensive implementation. The research module is not the finished product. It is the raw material for building checks, validating coverage, and teaching teams what meaningful Linux evidence actually looks like.
Read featured articleArchive
Notes on Linux defense, training delivery, research artifacts, and how low-level tooling should work in practice.
Slides do not teach kernel work. Students need a stable VM, preflight checks, and enough guidance to recover from mistakes without losing momentum.
Publishing a controlled research module gives defenders and vendors something concrete to inspect, test against, and reason about.
A rootkit alert is not enough. Analysts need the evidence path: what was inspected, what diverged, and why the result matters.
