Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Unhide is a Linux command-line forensic utility that checks for processes or listening ports missing from ordinary system listings. It compares different views of process and network state; a discrepancy is a reason to investigate, not proof that a rootkit or other compromise is present. Its documentation specifically warns that one test can produce false positives on newer Linux kernels.

What Unhide checks

Unhide looks for mismatches between ways Linux exposes running processes. Its project documentation describes six main process-detection approaches:

  • Compare entries in /proc with the output of /bin/ps.
  • Compare ps output with a walk through procfs.
  • Compare information from ps with information obtained through system calls.
  • Brute-force the process ID (PID) space to look for processes not otherwise listed.
  • Use a reverse check: verify processes and threads reported by ps against procfs and system calls.
  • Combine checks in a quicker mode.

These comparisons are useful because a process concealed from one reporting path may still appear through another. The project notes that some methods are specific to unhide-linux. The [project README](https://github.com/YJesus/Unhide) describes the methods and implementation.

Unhide-tcp checks listening ports

The separate unhide-tcp utility checks for TCP or UDP listening ports that do not appear in ss or netstat listings. It uses brute-force checks and probing, according to the [Unhide project](https://github.com/YJesus/Unhide). A port discrepancy is a finding to investigate, not a verdict about why the listing differs.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
#1 Best Overall
Sale
Nicpro Mechanical Carpenter Pencils for Construction (Black, Red) With Case| Deep Hole Marker Pencil Set Includes Sharpener and 26 Refills, Comfortable Grip, Heavy Duty Woodworking Tools for Architect
  • Valued Carpenter Pencil Set: You will get 2 pcs solid carpenter pencils with 26 piece 2.8 mm refills, 1 replaceable sharpener, 1 plastic storage box.The complete carpenter pencils combination allows you to finish your work faster and more easily
  • Deep Hole Marker Pencil: The deep-hole construction pencils adopts 45mm elongated tip design, which is more convenient to mark in the small hole or in other tight areas that other carpenter markers cannot reach
  • Carpenter Pencils with Sharpener: The sharpener is screwed into the top of the work pencil, which won't get lost either. Built-in pencil sharpener that keep the lead with pointed and smooth to Improves line of sight in fine work
  • Stronger Solid Lead: This work pencil is matched with a 2.8 mm thick lead , which is much thicker and stronger during the drawing process of construction work, it will not break or damage easily
  • Marks on Various Surfaces: 3 colors solid construction pencil can marks on various surfaces,such as metal, plastic, wood, paper etc. Ideals for woodworkers, contractors, craftsmen, builders, merchants and masons

Choosing a process-check mode

The Debian manual documents these examples for unhide-linux. They differ in speed and breadth; use the deeper mode when you need more checks and can allow more time.

Mode Command What to expect
Quick unhide quick The project says this technique is about 20 times faster than checks 1, 2, and 3, while warning it may produce more false positives. This is the project’s comparison, not an independent benchmark.
Standard example unhide sys proc Runs the sys and proc test groups shown in the manual.
Deeper example unhide -m -d sys procall brute reverse Runs the listed sys, procall, brute, and reverse groups with the manual’s additional options.

The [Debian Unhide manual](https://manpages.debian.org/unstable/unhide/unhide-linux.8.en.html) provides these command examples. Exact behavior and available modes can depend on the installed build, so check that manual or the help output for your version before relying on a command.

Rank #2
Sale
DEWALT 20V MAX Cordless Drill and Impact Driver, Power Tool Combo Kit , Includes 2 Batteries, Charger and Bag (DCK240C2)
  • Ergonomically Designed: Work in tight areas with a compact design that gets into tough spots
  • Compact and Lightweight: Both tools are designed to fit into difficult to reach spaces. The 1/4" impact driver has a length of 5.55 in. and weighs just 2.8 lbs, while the 1/2" drill/driver measures only 7.5 in. and weighs 3.6 lbs
  • Both the DEWALT impact driver and electric drill driver feature integrated LED work lights with a convenient 20-second delay, ensuring enhanced visibility in dimly lit or challenging work areas
  • One-Handed Loading - Keep one hand free with a 1/4 in. hex chuck that accepts 1 in. bit tips
  • Power drill cordless with 1/2" single sleeve ratcheting chuck provides tight bit gripping strength, making bit changes faster and more secure

Install and run Unhide

Unhide is Linux-oriented software. The project says root privileges are required to run both unhide-linux and unhide-tcp. On Kali, the documented package installation command is sudo apt install unhide; the Kali page also lists unhide-gui as an optional package. Kali identifies its documented Linux build as version 20240509, for Linux 2.6 or later. That version information is specific to Kali’s page and should not be assumed for other distributions.

  1. Use your distribution’s current package instructions. For Kali, run sudo apt install unhide as documented by [Kali Linux Tools](https://www.kali.org/tools/unhide/).
  2. Run the command with root privileges, for example sudo unhide quick for the documented quick mode.
  3. Check the output and exit status, then investigate any reported discrepancy against other system information and the applicable kernel caveats.

The project also provides static-build instructions. It explains that Unhide is built statically because host libraries may be compromised and to avoid being misled by PRELINKing; see the [project README](https://github.com/YJesus/Unhide). Building from source is an alternative to distribution packages, not a requirement for ordinary package installation.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #3
Sale
Push to Unlock,Katerk 6pcs 1/4 inch Hex Shank Aluminum Alloy Screwdriver Bit Holder Light-Weight Quick-Change Extension Bar Keychain Drill Screw Adapter Portable,Black Carabiner,Tool Gifts for Men
  • 【Great Compatibility】This Katerk 1/4 inch hex shank bit holder is specifically designed for 1/4 inch hex shank drill bits. It's compatible with most 1/4 fast hex handles, hex sockets, various electric screwdrivers, and handheld screwdrivers. The bit holder makes it a valuable addition for any handyman.
  • 【Secure and Safe】Built with a secure backup nut design, each drill bit holder securely locks onto your bits, ensuring they stay firmly in place. Additionally, our bit holder incorporates a high-quality steel ball rolling design that holds up to several kilograms of weight, ensuring your various drill bits don't fall off.
  • 【Easy One-Handed Operation】The bit holder for impact driver allows you to change bits single-handedly, simplifying your workflow. Its multi-color design further allows for quick identification of the drill bit you need.
  • 【Compact and Convenient】Thanks to its compact size, this 1/4 inch bit holder is easy to carry around. The bit holder allows for easy attachment to various tools, making this a convenient addition to your construction accessories. The Katerk bit holder is cast from high-quality alloy material, promising a long product lifespan. Despite its rugged strength, the bit holder remains lightweight, making it portable.
  • 【Cool Christmas Gift For Men Stocking Stuffers】 This screwdriver bit holder, driver bit holder, impact bit holder, can be given as a gift to your loved one, especially for anyone involved in construction or electrical work. It's a must-have for stocking stuffers for men and women, tools gifts for dad, tech gadgets for men, gifts for dad, gifts for him, gifts for husband, gifts for boyfriend, cool gadgets for men, and cool gifts for dad.

How to interpret a finding

The manual defines exit status 0 as OK and 1 as indicating that a hidden or fake thread was found. Treat the status as a report from the tool, not as a diagnosis of malware. Confirm what was reported and investigate with other appropriate system checks.

Sysinfo can produce false positives

The Debian manual warns that the sysinfo test may report false positives on Linux kernels newer than 2.6.33. It cites scheduler optimization, cgroups, and systemd as possible factors, and says PREEMPT-RT can amplify the problem. A sysinfo alert on an affected system therefore does not establish that a rootkit is present. Review the [manual’s caveat](https://manpages.debian.org/unstable/unhide/unhide-linux.8.en.html) alongside the exact test output and system context.

Rank #4
2 Pack Carpenter Pencils Mechanical Pencils with 12 Refills, (2 Colors)
  • Long Nib and Deep Hole Marker: Our mechanical carpenter pencil with 45mm nib is designed for easy marking of deep holes or narrow areas. These construction pencils are the great choice for woodworking tools, construction tools, carpenter tools, contractor tools, wood carpentry tools and architect tools
  • Extra Refills in 2 Colors for Versatile Marking: The construction mechanical pencil comes with 12 extra 2.8mm refills, including 6 red and 6 black refills. The black refill is suitable for light surfaces, while the red wax is perfect for dark surfaces. Our carpenter mechanical pencil makes sure that you'll have an ample supply for extended use
  • Built-in Sharpener: Our construction pencil comes with a built-in sharpener to ensure the mechanical pencil tip is always sharp and ready for use. Never buy an extra pencil sharpener again. A great tool for any woodworker pencil, contractor pencils. The refill can easily be extended or retracted with a simple click of the pencils mechanical, allowing you to work more efficiently and accurately
  • Portable Clip Design: Our deep hole construction pencil features a portable clip design, easy to carry and attach to your pocket or tool box, so that you can keep the carpenter pencils mechanical close at hand, making it a convenient tool to have on the go. Great gifts choice for carpenters
  • Stronger Pencil Lead: The black refills are made of lead, sturdy and smooth. The red refills are made of wax, clear and light. These marking pencils are much thicker and stronger than normal pencils during the marking process of construction work, suitable for various surfaces, such as glasses, metal, boards, floors, walls, furniture, etc. The written marks can be easily wiped with a wet paper towel when needed

Use discrepancies as leads

Unhide’s value is in comparing multiple views of process or port state. A mismatch may warrant follow-up, but the tool’s documentation does not make every mismatch proof of concealment or compromise. Consider the test that produced the result, its known limitations, and whether independent checks corroborate it.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

What Unhide is—and is not

The Debian manual describes Unhide as “a forensic tool to find processes hidden by rootkits, Linux kernel modules or by other techniques.” It is a diagnostic utility for Linux, not a standalone malware verdict. Its methods can expose inconsistencies in system listings; interpreting those inconsistencies requires attention to the operating system, test mode, and documented false-positive conditions.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Best Value
Milwaukee 48-22-3104 Inkzall Point Marker, Fine, Black, 4-Pack
  • Milwaukee Ink all Fine Point Marker, Black, 4 Per Pack
  • 4 per pack Features Clog Resistant Marker Tip Writes through Dusty, Wet and Oily Surfaces Durable Marker Tip for Writing on Concrete, OSB and Rough Surfaces
  • Clog resistant tip writes on dusty, wet and oily surfaces and is optimized for rough surfaces such as OSB, cinderblock and concrete
  • Hard hat clip- attaches for easy access
  • Quick dry time with reduced smearing and marking

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.