Trending repositories for topic rootkit

This page is a result of the ongoing hands-on research around advanced Linux attacks, detection and forensics techniques and tools.

LKM rootkit for Linux Kernels 2.6.x/3.x/4.x/5.x/6.x (x86/x86_64 and ARM64)

Hiding kernel-driver for x86/x64.

Windows Kernel Rootkit in Rust

Linux kernel rootkit

Linux/Windows post-exploitation framework made by linux user

Nidhogg is an all-in-one simple to use windows kernel rootkit.

🇺🇦 Windows driver with usermode interface which can hide processes, file-system and registry objects, protect processes and etc

This page is a result of the ongoing hands-on research around advanced Linux attacks, detection and forensics techniques and tools.

Windows Kernel Rootkit in Rust

Linux kernel rootkit

LKM rootkit for Linux Kernels 2.6.x/3.x/4.x/5.x/6.x (x86/x86_64 and ARM64)

Hiding kernel-driver for x86/x64.

Linux/Windows post-exploitation framework made by linux user

Nidhogg is an all-in-one simple to use windows kernel rootkit.

🇺🇦 Windows driver with usermode interface which can hide processes, file-system and registry objects, protect processes and etc

This page is a result of the ongoing hands-on research around advanced Linux attacks, detection and forensics techniques and tools.

Collection of codes focused on Linux rootkits

Windows Kernel Rootkit in Rust

Linux kernel rootkit

LKM rootkit for Linux Kernels 2.6.x/3.x/4.x/5.x/6.x (x86/x86_64 and ARM64)

Hiding kernel-driver for x86/x64.

PCI Express DIY hacking toolkit for Xilinx SP605. This repository is also home of Hyper-V Backdoor and Boot Backdoor, check readme for links and info

Nidhogg is an all-in-one simple to use windows kernel rootkit.

🇺🇦 Windows driver with usermode interface which can hide processes, file-system and registry objects, protect processes and etc

awesome-linux-rootkits

Linux/Windows post-exploitation framework made by linux user

Fileless ring 3 rootkit with installer and persistence that hides processes, files, network connections, etc.

Experimental Windows x64 Kernel Rootkit with anti-rootkit evasion features.

Black Angel is a Windows 11/10 x64 kernel mode rootkit. Rootkit can be loaded with enabled DSE while maintaining its full functionality.

Cronos is Windows 10/11 x64 ring 0 rootkit. Cronos is able to hide processes, protect and elevate them with token manipulation.

This is the list of all rootkits found so far on github and other sites.

SMM driver/rootkit for platform memory access with R3 <-> R0 <-> R-2 communication.

Rusty Hypervisor - Windows UEFI Blue Pill Type-1 Hypervisor in Rust (Codename: Illusion)

Load your driver like win32k.sys

？什么你说Root？我不到啊 | 致力于编写全面详细的Root教程文档 | 刷机 | 安卓

Collection of codes focused on Linux rootkits

This page is a result of the ongoing hands-on research around advanced Linux attacks, detection and forensics techniques and tools.

Windows Kernel Rootkit in Rust

Linux kernel rootkit

SMM driver/rootkit for platform memory access with R3 <-> R0 <-> R-2 communication.

PCI Express DIY hacking toolkit for Xilinx SP605. This repository is also home of Hyper-V Backdoor and Boot Backdoor, check readme for links and info

Rusty Hypervisor - Windows UEFI Blue Pill Type-1 Hypervisor in Rust (Codename: Illusion)

Load your driver like win32k.sys

Experimental Windows x64 Kernel Rootkit with anti-rootkit evasion features.

Black Angel is a Windows 11/10 x64 kernel mode rootkit. Rootkit can be loaded with enabled DSE while maintaining its full functionality.

LKM rootkit for Linux Kernels 2.6.x/3.x/4.x/5.x/6.x (x86/x86_64 and ARM64)

？什么你说Root？我不到啊 | 致力于编写全面详细的Root教程文档 | 刷机 | 安卓

Hiding kernel-driver for x86/x64.

Cronos is Windows 10/11 x64 ring 0 rootkit. Cronos is able to hide processes, protect and elevate them with token manipulation.

awesome-linux-rootkits

Nidhogg is an all-in-one simple to use windows kernel rootkit.

🇺🇦 Windows driver with usermode interface which can hide processes, file-system and registry objects, protect processes and etc

Linux/Windows post-exploitation framework made by linux user

Fileless ring 3 rootkit with installer and persistence that hides processes, files, network connections, etc.

This is the list of all rootkits found so far on github and other sites.

Collection of codes focused on Linux rootkits

This page is a result of the ongoing hands-on research around advanced Linux attacks, detection and forensics techniques and tools.

LKM rootkit for modern kernels, with DNS C2 and a simple web interface

Linux/Windows post-exploitation framework made by linux user

Windows Kernel Rootkit in Rust

Collection of codes focused on Linux rootkits

Nidhogg is an all-in-one simple to use windows kernel rootkit.

LKM rootkit for Linux Kernels 2.6.x/3.x/4.x/5.x/6.x (x86/x86_64 and ARM64)

Fileless ring 3 rootkit with installer and persistence that hides processes, files, network connections, etc.

Linux kernel rootkit

🇺🇦 Windows driver with usermode interface which can hide processes, file-system and registry objects, protect processes and etc

Now You See Me, Now You Don't

Hiding kernel-driver for x86/x64.

awesome-linux-rootkits

Masonrookit is a tool that makes your malware hidden from the process, from the task manager, all device paths and hides the connection

Dashist CLI framework, batteries included

PCI Express DIY hacking toolkit for Xilinx SP605. This repository is also home of Hyper-V Backdoor and Boot Backdoor, check readme for links and info

A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.

Cheat sheet to detect and remove linux kernel rootkit

Webshell && Backdoor Collection

windows kernel security development

LKM rootkit for modern kernels, with DNS C2 and a simple web interface

Collection of codes focused on Linux rootkits

Masonrookit is a tool that makes your malware hidden from the process, from the task manager, all device paths and hides the connection

This page is a result of the ongoing hands-on research around advanced Linux attacks, detection and forensics techniques and tools.

Cheat sheet to detect and remove linux kernel rootkit

AttackMate is an attack orchestration tool that executes full attack-chains based on playbooks.

Windows Kernel Rootkit in Rust

Linux kernel rootkit

Dashist CLI framework, batteries included

In-Memory Rootkit For Linux

silent syscall hooking without modifying sys_call_table/handlers via patching exception handler

Make an Linux Kernel rootkit visible again.

A rootkit for Android.

SMM driver/rootkit for platform memory access with R3 <-> R0 <-> R-2 communication.

It's a kernel-based keylogger for Windows x86/x64.

Linux/Windows post-exploitation framework made by linux user

Plus Edition of KernelSU_Action. Use Github Action to build kernels with KernelSU. Supports all kernel versions theoretically.

A programmable and rootkit-like Windows remote access tool.

Stuxnet extracted binaries by reversing & Stuxnet Rootkit Analysis

LD_PRELOAD Rootkit

Windows Kernel Rootkit in Rust

SMM driver/rootkit for platform memory access with R3 <-> R0 <-> R-2 communication.

ModTracer Finds Hidden Linux Kernel Rootkits and then make visible again.

LKM rootkit for modern kernels, with DNS C2 and a simple web interface

Collection of codes focused on Linux rootkits

A rootkit for Android.

Make an Linux Kernel rootkit visible again.

Stuxnet extracted binaries by reversing & Stuxnet Rootkit Analysis

NidhoggScript is a tool to generate "script" file that allows execution of multiple commands for Nidhogg

Weaponizing the Linux Kernel (Hide Files/PID, SSH backdoors, SSL Sniffer, ...) by poking around eBPF/XDP

Cheat sheet to detect and remove linux kernel rootkit

Masonrookit is a tool that makes your malware hidden from the process, from the task manager, all device paths and hides the connection

Nidhogg is an all-in-one simple to use windows kernel rootkit.

Experimental Windows x64 Kernel Rootkit with anti-rootkit evasion features.

LKM rootkit for Linux Kernels 2.6.x/3.x/4.x/5.x/6.x (x86/x86_64 and ARM64)

Windows Kernel Rootkit in Rust

Fileless ring 3 rootkit with installer and persistence that hides processes, files, network connections, etc.

🇺🇦 Windows driver with usermode interface which can hide processes, file-system and registry objects, protect processes and etc

Hiding kernel-driver for x86/x64.

Now You See Me, Now You Don't

Linux/Windows post-exploitation framework made by linux user

Rusty Hypervisor - Windows UEFI Blue Pill Type-1 Hypervisor in Rust (Codename: Illusion)

awesome-linux-rootkits

Webshell && Backdoor Collection

A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.

A x64 Windows Rootkit using SSDT or Hypervisor hook

ebpfkit is a rootkit powered by eBPF

Linux kernel rootkit

Rusty Hypervisor - Windows Kernel Blue Pill Type-2 Hypervisor in Rust (Codename: Matrix)

PoCs for Kernelmode rootkit techniques research.

？什么你说Root？我不到啊 | 致力于编写全面详细的Root教程文档 | 刷机 | 安卓

This page is a result of the ongoing hands-on research around advanced Linux attacks, detection and forensics techniques and tools.

Windows Kernel Rootkit in Rust

ModTracer Finds Hidden Linux Kernel Rootkits and then make visible again.

Make an Linux Kernel rootkit visible again.

Cheat sheet to detect and remove linux kernel rootkit

SMM driver/rootkit for platform memory access with R3 <-> R0 <-> R-2 communication.

AttackMate is an attack orchestration tool that executes full attack-chains based on playbooks.

NidhoggScript is a tool to generate "script" file that allows execution of multiple commands for Nidhogg

Experimental Windows x64 Kernel Rootkit with anti-rootkit evasion features.

Plus Edition of KernelSU_Action. Use Github Action to build kernels with KernelSU. Supports all kernel versions theoretically.

Collection of codes focused on Linux rootkits

This page is a result of the ongoing hands-on research around advanced Linux attacks, detection and forensics techniques and tools.

Rusty Hypervisor - Windows Kernel Blue Pill Type-2 Hypervisor in Rust (Codename: Matrix)

Linux kernel rootkit

Expanding Kernel Lazy Importer

Dashist CLI framework, batteries included

PoCs for Kernelmode rootkit techniques research.

stuxnet Source & Binaries. (+PLC ROOTKIT) ONLY FOR ACADEMICAL RESEARCH AND EDUCATIONAL PURPOSES! Includes: Source files, Binaries, PLC Samples,Fanny Added in another repo.

Now You See Me, Now You Don't

Stuxnet is an extremely sophisticated computer worm that exploits multiple previously unknown Windows zero-day vulnerabilities to infect computers and spread. Its purpose was not just to infect PCs bu...

POC Ring3 Windows Rootkit (x86 / x64) - Hide processes and files