OpenClarity is an open source platform built to enhance security and observability of cloud native applications and infrastructure

This is the list of all rootkits found so far on github and other sites.

a summary of linux rootkits published on GitHub

Linux Malware Sample Archive including various types of malicious ELF binaries and viruses. Be careful!

VMClarity is a tool for agentless detection and management of Virtual Machine Software Bill Of Materials (SBOM) and vulnerabilities

Resolve DOS MZ executable symbols at runtime

Automated Cyber Offense

A curated list of rootkits found on Github and other sites.

Rootkit Detector for UNIX

Small scripts to help with Linux forensics and incident response.

ld_preload userland rootkit

Scripts to decloak Linux Loadable Kernel Module (LKM) stealth rootkits.

Collection of windows rootkits

-x-x-x- DO NOT RUN ON PRODUCTION MACHINE -x-x-x- LD_PRELOAD based user-land rootkit for Linux platform.

Kernel-space x86_64 Linux rootkit leveraging kprobes and ftrace for syscall hooking (hiding entries and reverse shell backdoor)

Linux userland rootkit. Hides file and directory, hides process, hides bind shell port, hides daemon port, hides reverse shell port, cleans up bash history and logs during installation

Linux Loadable Kernel Module Rootkit for Linux Kernel 5.x and 6.x on x86_64, hides files, hides process, hides bind shell & reverse shell port, privilege escalation, cleans up logs and bash history during installation

A LKM (Loadable Kernel Module) to execute a command as root; I include a example of using netcat and a compiled(with source and steps on how to compile) reverse shell provided in C.

Complete Windows usermode rootkit with custom C2 server, dropper, and EDR bypass. Features: privilege escalation, process/file/registry hiding, keylogger, reverse shell. Evasion: indirect syscalls, NTDLL unhooking, API hashing, ETW/AMSI bypass.

Rootkit breaker - experimental Linux anti-rootkit tool based on kprobes