A modern, Rust-powered Linux scanner that unmasks hidden rootkits, stealthy eBPF tricks, and ghost processes in one fast sweep (50+ scanners)
Small scripts to help with Linux forensics and incident response.
Scripts to decloak Linux Loadable Kernel Module (LKM) stealth rootkits.
Detection of rootkit file hiding activities through analysis of shifts in kernel function execution times.
A tool to detect EDR hooks on Linux - Userland and kernel level hooks
A simple tool to uncover files, directories, and connections hidden by malware.
Kernel-based rootkit detection tool with modules for detecting hidden processes, files, and kernel anomalies.
Walk any memory dump. Find what's hidden. Linux + Windows kernel forensics from a single static Rust binary — no Python required.
Open-source hypervisor-based endpoint security. Ring -1 monitoring for Intel VT-x and AMD-V. Rootkit detection, DKOM, MSR guard, stealth EPT hooks.
Agentless EDR-lite for Linux. One static Rust binary finds rootkits, reverse shells, container escapes and CIS gaps in under a second. Read-only, no agents, nothing left resident.
Live Linux threat hunting for incident responders: fileless implants, injected code, rootkits, stealthy persistence, webshells and backdoor sockets. Static Rust binary, YARA, MITRE ATT&CK mapped.
Windows Kernel-Mode implementation for process protection, TPM-backed encryption, and ETW logging.
Scan to oblivion—protect, cleanse, secure.
Lightning-fast Linux security scanner finds real threats in seconds, not hours. Cryptominers, CVEs, rootkits, memory threats, network attacks. Single binary, 100% local.
Offline Linux Forensics & Integrity Engine
HYPERSENSEGLOBAL HyperSense64 - live usermode memory analysis for Windows. Pick any running process, scan its memory for malware IOCs and injected regions, export a TXT or HTML report. Single 1.7 MB executable with the Moneta engine (GPLv3) built in.
A tool that detects files and directories that may be hidden by trojan and rootkits on Unix platforms
Detect Linux rootkits which use signals to elevate process privileges.
Advanced Volatile Memory (RAM) Forensics using the Volatility Framework to detect fileless malware, rootkits, and process hollowing.
To associate your repository with the rootkit-detection topic, visit your repo's landing page and select "manage topics."