OpenClarity is an open source platform built to enhance security and observability of cloud native applications and infrastructure

This is the list of all rootkits found so far on github and other sites.

a summary of linux rootkits published on GitHub

Linux Malware Sample Archive including various types of malicious ELF binaries and viruses. Be careful!

VMClarity is a tool for agentless detection and management of Virtual Machine Software Bill Of Materials (SBOM) and vulnerabilities

Resolve DOS MZ executable symbols at runtime

Automated Cyber Offense

Rootkit Detector for UNIX

Small scripts to help with Linux forensics and incident response.

ld_preload userland rootkit

Scripts to decloak Linux Loadable Kernel Module (LKM) stealth rootkits.

Windows usermode rootkit with inline hooking for process/file/registry hiding, indirect syscalls, keylogger, HTTPS C2, dropper, and EDR/AV evasion.

Detection of rootkit file hiding activities through analysis of shifts in kernel function execution times.

Collection of windows rootkits

-x-x-x- DO NOT RUN ON PRODUCTION MACHINE -x-x-x- LD_PRELOAD based user-land rootkit for Linux platform.

Kernel-space x86_64 Linux rootkit leveraging kprobes and ftrace for syscall hooking (hiding entries and reverse shell backdoor)

Linux userland rootkit. Hides file and directory, hides process, hides bind shell port, hides daemon port, hides reverse shell port, cleans up bash history and logs during installation

Linux Loadable Kernel Module Rootkit for Linux Kernel 5.x up to linux kernel 6.8 on x86_64, hides files, hides process, hides bind shell & reverse shell port, privilege escalation, cleans up logs and bash history during installation

A LKM (Loadable Kernel Module) to execute a command as root; I include a example of using netcat and a compiled(with source and steps on how to compile) reverse shell provided in C.

Cybersecurity Threats & Vulnerabilities Guide is a comprehensive educational resource that provides detailed documentation, detection scripts, and prevention strategies for various cybersecurity threats.

Rootkit breaker - experimental Linux anti-rootkit tool based on kprobes

A Linux kernel module and userland utility pair to detect processes hidden by Linux kernel module (LKM) rootkits.

Framework built with LibVMI to collect indicators of Linux kernel-mode rootkit detection.

An Nginx module for persistent privileged malware

Installer for Rkhunter - A rootkit scanner for Linux

Linux Privilege Escalation Toolkit

Windows Kernel Drivers Project

All the Programs of the 7th Sem Cyber Security Lab with their output in different steps. This lab provides students with hands-on experience in implementing and understanding fundamental cybersecurity concepts. It focuses on practical exposure to key security areas such as cryptography, network security, vulnerability assessment, secure code.

A Proof-of-Concept Project prepared for Rootkit Analysis

Awesome Rootkit Malware