Using the Linux Kernel Module, a rootkit can modify the kernel's syscall table. By doing this, the rootkit can replace a system call to point to a program of its own.
Another technique that a rootkit can use is to delete a log entry on a system so there will be no log entry of the attackers’ activities. Also, to hide the threat actor’s tracks, the rootkit can replace standard Unix programs such as ps in order not to show the processes that the rootkit is running.