Updated Date: 07/07/2026
Customizing Web-RootKit detection
The Web-RootKit detection malware check is performed only on URLs where this malware check is enabled.
The BIG-IP system checks a default list of functions for tampering when it performs the Web-Rootkit detection malware check. Customize Web-RootKit detection if you want to add or remove functions from this default list.
-
On the Main tab, click Security > Fraud Protection Service > Anti-Fraud Profiles.
The Anti-Fraud Profiles screen opens.
-
From the list of profiles, select the relevant profile.
The Anti-Fraud Profile Properties screen opens.
-
In the Anti-Fraud Configuration area, click Malware Detection > General Settings.
-
Click Advanced in the Malware Detection area of the screen.
-
In the Web-RootKit Detection for these additional functions field, add names of functions that you want the system to check for tampering when the Web-RootKit detection malware check is performed.
The added functions must be native browser functions and must include the full path. For example, to add the function
addEventListener, typedocument.addEventListener. -
In the Ignore Web-RootKit Detection for these functions field, add names of functions that you want the system to ignore when the Web-RootKit detection malware check is performed.
The functions you add in this field must be functions that appear on the default list of functions. The system will check these functions for tampering if they are not listed here.
-
Click Save.
The anti-fraud profile is updated with the changes you made.