#Rootkit
Showing 28 of 28 repositories tagged #rootkit, ranked by stars
Windows rootkit for Intel x64 with 25+ features, demonstrating rootkit techniques compatible with all Windows 10 and Windows 11 versions.
LKM rootkit for Linux Kernels 2.6.x/3.x/4.x/5.x/6.x (x86/x86_64 and ARM64)
๐บ๐ฆ Windows driver with usermode interface which can hide processes, file-system and registry objects, protect processes and etc
A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.
Linux LD_PRELOAD rootkit (x86 and x86_64 architectures)
ebpfkit is a rootkit powered by eBPF
๏ผไปไนไฝ ่ฏดRoot๏ผๆไธๅฐๅ | ่ดๅไบ็ผๅๅ จ้ข่ฏฆ็ป็Rootๆ็จๆๆกฃ | ๅทๆบ | ๅฎๅ
Red-Team LKM
Rusty Rootkit - Windows Kernel Rookit in Rust (Codename: Eagle)
Jormungandr is a kernel implementation of a COFF loader, allowing kernel developers to load and execute their COFFs in the kernel.
Dashist CLI framework, batteries included
It's a kernel-based keylogger for Windows x86/x64.
A ring0 Loadable Kernel Module (Linux) for latest kernels 6.x
Stuxnet extracted binaries by reversing & Stuxnet Rootkit Analysis
Weaponizing the Linux Kernel (Hide Files/PID, SSH backdoors, SSL Sniffer, ...) by poking around eBPF/XDP
Linux Rootkits (4.x Kernel)
AttackMate is an attack orchestration tool that executes full attack-chains based on playbooks.
NidhoggScript is a tool to generate "script" file that allows execution of multiple commands for Nidhogg
Hanoman is an GUI antivirus engine sigature based detection ๐
fanny.bmp cleaned MALWARE - ONLY FOR ACADEMICAL RESEARCH AND EDUCATIONAL PURPOSES! (incl Metasploit detection Module)
Malware and malicious applications database
Collaborative malware exchange repository.
๐ป Windows 10 Kernel-mode rootkit
Author of Project Adrishya a rootkit which use ftrace mechanism to hook syscall; (write this because God commanded me); work for both x86_64 and arm; CREDIT-(Oleksii Lozovskyi{ilammy})FOUNDER OF FTRACE HOOKING
linux, kernel, rootkit, educational, cybersecurity
๐งMAJOR BUG GRANTS ROOT FOR ALL MAJOR LINUX DISTRIBUTIONS
Kernel-space x86_64 Linux rootkit leveraging kprobes and ftrace for syscall hooking (hiding entries and reverse shell backdoor)
A complete hands-on reference of 46 Windows persistence techniques used by real-world APT groups. Each technique includes MITRE ATT&CK TTP mapping, known threat actor attribution, attack commands, verification steps, and cleanup โ organized from No-Admin to Admin level. Built for red teamers, malware analysts, and cybersecurity learners.