A modern, Rust-powered Linux scanner that unmasks hidden rootkits, stealthy eBPF tricks, and ghost processes in one fast sweep (50+ scanners)
Small scripts to help with Linux forensics and incident response.
Scripts to decloak Linux Loadable Kernel Module (LKM) stealth rootkits.
Detection of rootkit file hiding activities through analysis of shifts in kernel function execution times.
A tool to detect EDR hooks on Linux - Userland and kernel level hooks
Kernel-based rootkit detection tool with modules for detecting hidden processes, files, and kernel anomalies.
Walk any memory dump. Find what's hidden. Linux + Windows kernel forensics from a single static Rust binary — no Python required.
A simple tool to uncover files, directories, and connections hidden by malware.
Windows 10/11 x64 Kernel Analysis & Anti-Rootkit Toolkit
Open-source hypervisor-based endpoint security. Ring -1 monitoring for Intel VT-x and AMD-V. Rootkit detection, DKOM, MSR guard, stealth EPT hooks.
Live Linux threat hunting for incident responders: fileless implants, injected code, rootkits, stealthy persistence, webshells and backdoor sockets. Static Rust binary, YARA, MITRE ATT&CK mapped.
Agentless EDR-lite for Linux. One static Rust binary finds rootkits, reverse shells, container escapes and CIS gaps in under a second. Read-only, no agents, nothing left resident.
Windows Kernel-Mode implementation for process protection, TPM-backed encryption, and ETW logging.
Scan to oblivion—protect, cleanse, secure.
Lightning-fast Linux security scanner finds real threats in seconds, not hours. Cryptominers, CVEs, rootkits, memory threats, network attacks. Single binary, 100% local.
Offline Linux Forensics & Integrity Engine
A tool that detects files and directories that may be hidden by trojan and rootkits on Unix platforms
Detect Linux rootkits which use signals to elevate process privileges.
Advanced Volatile Memory (RAM) Forensics using the Volatility Framework to detect fileless malware, rootkits, and process hollowing.
To associate your repository with the rootkit-detection topic, visit your repo's landing page and select "manage topics."