rootkit topic

awesome-linux-rootkits

milabs

ebpfkit is a rootkit powered by eBPF

Gui774ume

Linux LD_PRELOAD rootkit (x86 and x86_64 architectures)

mempodippy

Elf binary infector written in Go.

sad0p

Kernel rootkit, that lives inside the Windows registry values data

Cr4sh

Cronos is Windows 10/11 x64 ring 0 rootkit. Cronos is able to hide processes, protect and elevate them with token manipulation.

XaFF-XaFF

Nidhogg is an all-in-one simple to use rootkit.

Idov31

Fileless ring 3 rootkit with installer and persistence that hides processes, files, network connections, etc.

bytecode77

A basic Direct Kernel Object Manipulation rootkit that removes a process from the EPROCESS list, hiding it from the Task Manager

landhb

A LKM rootkit for most newer kernel versions.

croemheld