You can find a lot of primers with some Google-fu on writing Linux rootkits. Unfortunately most of them are outdated and have techniques that just don't work anymore. This talk will be specifically focused on writing a kernel mod rootkit on a modern Linux Kernel (the latest version of Linux Mint to be exact). It will specifically focus on hooking syscalls and how to do so in a simple, reproducible way. For this talk I'll be releasing a simple, but effective kernel mod rootkit and instructions on how to modify it for your own needs.