A modern, Rust-powered Linux scanner that unmasks hidden rootkits, stealthy eBPF tricks, and ghost processes in one fast sweep (50+ scanners)
Small scripts to help with Linux forensics and incident response.
Scripts to decloak Linux Loadable Kernel Module (LKM) stealth rootkits.
Detection of rootkit file hiding activities through analysis of shifts in kernel function execution times.
A tool to detect EDR hooks on Linux - Userland and kernel level hooks
Kernel-based rootkit detection tool with modules for detecting hidden processes, files, and kernel anomalies.
A simple tool to uncover files, directories, and connections hidden by malware.
Open-source hypervisor-based endpoint security. Ring -1 monitoring for Intel VT-x and AMD-V. Rootkit detection, DKOM, MSR guard, stealth EPT hooks.
Lightning-fast Linux security scanner finds real threats in seconds, not hours. Cryptominers, CVEs, rootkits, memory threats, network attacks. Single binary, 100% local.
Windows Kernel-Mode implementation for process protection, TPM-backed encryption, and ETW logging.
Walk any memory dump. Find what's hidden. Linux + Windows kernel forensics from a single static Rust binary — no Python required.
Offline Linux Forensics & Integrity Engine
A tool that detects files and directories that may be hidden by trojan and rootkits on Unix platforms
Scan to oblivion—protect, cleanse, secure.
Detect Linux rootkits which use signals to elevate process privileges.
Advanced Volatile Memory (RAM) Forensics using the Volatility Framework to detect fileless malware, rootkits, and process hollowing.
Scheduled Task Shadow Scanner-detects attacker persistence across all 14 Linux hiding locations
Ontological process authentication — rootkit detection through simulacra theory. Process forensics, network honeypot detection, SUID auditing.
⚔️ Cross-platform malware & rootkit removal tool with GUI, online threat intelligence and real-time scanning — built in Python
Add a description, image, and links to the rootkit-detection topic page so that developers can more easily learn about it.
To associate your repository with the rootkit-detection topic, visit your repo's landing page and select "manage topics."