Umbra
h3xduck/umbraA LKM rootkit targeting 4.x and 5.x kernel versions which opens a backdoor that can spawn a reverse shell to a remote host, launch malware and more.
command-and-controleducationencryption-decryption-tools+6
135
h3xduck/umbraA LKM rootkit targeting 4.x and 5.x kernel versions which opens a backdoor that can spawn a reverse shell to a remote host, launch malware and more.
nurupo/rootkitLinux kernel module that grants root privileges, hides processes/files, and protects itself from unloading, designed for educational purposes on…
asekon/rootkitA rootkit for ubuntu-16.04.6 (Linux 4.4). Can hide a process, give root access and hide itself
m0nad/diamorphineLKM rootkit for Linux Kernels 2.6.x/3.x/4.x/5.x/6.x (x86/x86_64 and ARM64)
matheuzsecurity/singularityStealthy Linux kernel rootkit (LKM) for 6.x kernels with advanced process/network hiding, privilege escalation, and comprehensive evasion of eBPF…
bytecode77/r77-rootkitFileless ring 3 rootkit with installer and persistence that hides processes, files, network connections, etc.
idov31/nidhoggWindows rootkit for Intel x64 with 25+ features, demonstrating rootkit techniques compatible with all Windows 10 and Windows 11 versions.
h3xduck/triplecrossA Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.
daem0nc0re/vectorkernelPoCs for Kernelmode rootkit techniques research.
emcruise/tor-rootkitA Python 3 standalone Windows 10 / Linux Rootkit using Tor.
buter-chkalova/project-rvbbitEducational Linux kernel rootkit PoC exploring DKOM, syscall hooking, stealth, observability and defensive detection
matheuzsecurity/imperiusMake an Linux Kernel rootkit visible again.
buter-chkalova/rvbbit-arsenalOffensive & defensive Linux kernel security research focused on rootkit behavior, observable artifacts and detection.
idov31/silversealLinux post-exploitation framework with a UEFI bootkit that persistently and stealthily loads a Rust-based kernel module rootkit on modern Linux…
xaff-xaff/kernel-process-hollowingWindows x64 kernel mode rootkit process hollowing POC.
xaff-xaff/cronos-rootkitCronos is Windows 10/11 x64 ring 0 rootkit. Cronos is able to hide processes, protect and elevate them with token manipulation.
xaff-xaff/black-angel-rootkitBlack Angel is a Windows 11/10 x64 kernel mode rootkit. Rootkit can be loaded with enabled DSE while maintaining its full functionality.
