A modern, Rust-powered Linux scanner that unmasks hidden rootkits, stealthy eBPF tricks, and ghost processes in one fast sweep (50+ scanners)
Small scripts to help with Linux forensics and incident response.
Scripts to decloak Linux Loadable Kernel Module (LKM) stealth rootkits.
Detection of rootkit file hiding activities through analysis of shifts in kernel function execution times.
A tool to detect EDR hooks on Linux - Userland and kernel level hooks
Kernel-based rootkit detection tool with modules for detecting hidden processes, files, and kernel anomalies.
A simple tool to uncover files, directories, and connections hidden by malware.
Walk any memory dump. Find what's hidden. Linux + Windows kernel forensics from a single static Rust binary — no Python required.
Open-source hypervisor-based endpoint security. Ring -1 monitoring for Intel VT-x and AMD-V. Rootkit detection, DKOM, MSR guard, stealth EPT hooks.
Windows Kernel-Mode implementation for process protection, TPM-backed encryption, and ETW logging.
Agentless EDR-lite for Linux. One static Rust binary finds rootkits, reverse shells, container escapes and CIS gaps in under a second. Read-only, no agents, nothing left resident.
Offline Linux Forensics & Integrity Engine
Lightning-fast Linux security scanner finds real threats in seconds, not hours. Cryptominers, CVEs, rootkits, memory threats, network attacks. Single binary, 100% local.
A tool that detects files and directories that may be hidden by trojan and rootkits on Unix platforms
Scan to oblivion—protect, cleanse, secure.
Detect Linux rootkits which use signals to elevate process privileges.
Advanced Volatile Memory (RAM) Forensics using the Volatility Framework to detect fileless malware, rootkits, and process hollowing.
⚔️ Cross-platform malware & rootkit removal tool with GUI, online threat intelligence and real-time scanning — built in Python
Scheduled Task Shadow Scanner-detects attacker persistence across all 14 Linux hiding locations
Add a description, image, and links to the rootkit-detection topic page so that developers can more easily learn about it.
To associate your repository with the rootkit-detection topic, visit your repo's landing page and select "manage topics."