Alternatives and similar repositories for Rootkit:

Users that are interested in Rootkit are comparing it to the libraries listed below

• MatheuZSecurity / detect-lkm-rootkit-cheatsheet
  Cheat sheet to detect and remove linux kernel rootkit
  ☆57Updated 4 months ago
• MatheuZSecurity / ModTracer
  ModTracer Finds Hidden Linux Kernel Rootkits and then make visible again.
  ☆79Updated 2 months ago
• MatheuZSecurity / ElfDoor-gcc
  ElfDoor-gcc is an LD_PRELOAD that hijacks gcc to inject malicious code into binaries during linking, without touching the source code.
  ☆103Updated 3 weeks ago
• ArtemBaranov / WindowsRootkitsGuide
  ☆67Updated 3 months ago
• pwnwithlove / C_revshell
  Basic reverse shell in C using socket() with complete explanation
  ☆65Updated last year
• cocomelonc / mdmz_book
  The result of research and investigation of malware development tricks, techniques, evasion, cryptography and linux malware
  ☆42Updated last month
• FuzzySecurity / BHUSA-2023
  ☆105Updated 9 months ago
• ViperXSecurity / lib-nosa
  lib-nosa is a minimalist C library designed to facilitate socket connections through AFD driver IOCTL operations on Windows.
  ☆109Updated 8 months ago
• eversinc33 / 1.6-C2
  Using the Counter Strike 1.6 RCON protocol as a C2 Channel.
  ☆78Updated 2 months ago
• x86byte / Stuxnet-Rootkit
  Stuxnet extracted binaries by reversing & Stuxnet Rootkit Analysis
  ☆52Updated 7 months ago
• MrAle98 / CVE-2025-21333-POC
  POC exploit for CVE-2025-21333 heap-based buffer overflow. It leverages WNF state data and I/O ring IOP_MC_BUFFER_ENTRY
  ☆187Updated 3 weeks ago
• flostyen / windows-persistence
  Windows Persistence IT-Security
  ☆97Updated last month
• ColeHouston / Sunder
  Windows rootkit designed to work with BYOVD exploits
  ☆198Updated 3 months ago
• NtDallas / Svartalfheim
  Stage 0
  ☆159Updated 4 months ago
• gatariee / Winton
  Command and Control (C2) framework
  ☆126Updated last year
• 20urc3 / Aplos
  Aplos an extremely simple fuzzer for Windows binaries.
  ☆68Updated 2 months ago
• synacktiv / DLHell
  Local & remote Windows DLL Proxying
  ☆164Updated 10 months ago
• DarkSpaceSecurity / RunAs-Stealer
  RunAs Utility Credential Stealer implementing 3 techniques : Hooking CreateProcessWithLogonW, Smart Keylogging, Remote Debugging
  ☆186Updated 2 months ago
• eversinc33 / PSXecute
  MIPS VM to execute payloads without allocating executable memory. Based on a PlayStation 1 (PSX) Emulator.
  ☆113Updated 5 months ago
• cocomelonc / bsprishtina-2024-maldev-workshop
  BSides Prishtina 2024 Malware Development and Persistence workshop
  ☆80Updated this week
• Dor00tkit / CVE-2024-30090
  CVE-2024-30090 - LPE PoC
  ☆106Updated 6 months ago
• hasherezade / flareon2024
  ☆37Updated 4 months ago
• TheMalwareGuardian / Awesome-Bootkits-Rootkits-Development
  A curated compilation of extensive resources dedicated to bootkit and rootkit development.
  ☆47Updated 2 weeks ago
• outflanknl / edr-internals
  Tools for analyzing EDR agents
  ☆228Updated 10 months ago
• zerozenxlabs / CVE-2023-36424
  Windows Kernel Pool (clfs.sys) Corruption Privilege Escalation
  ☆127Updated last year
• LambdaMamba / LenaMalwareAnalysis
  Lena's scripts/code/resources for malware analysis
  ☆26Updated 10 months ago
• OtterHacker / Hooker
  ☆105Updated 6 months ago
• Karkas66 / CelestialSpark
  Version 2 - A modern 64-bit position independent meterpreter and Sliver compatible reverse_TCP Staging Shellcode based on Cracked5piders …
  ☆103Updated last month
• 0xsch1zo / NullGate
  Library that eases the use of indirect syscalls. Quite interesting AV/EDR bypass as PoC.
  ☆92Updated last week
• Diverto / IPPrintC2
  PoC for using MS Windows printers for persistence / command and control via Internet Printing
  ☆148Updated last year