The Shell Game – Non-Root Linux Rootkits (2010) [pdf]

Anyone interested in this topic should also make sure to check out the Procps-ng Audit Report by Qualys Security[1].

[1] https://www.openwall.com/lists/oss-security/2018/05/17/1