Contains materials for my technical presentation exploring Linux malware tradecraft—from userland and fileless techniques to kernel rootkits, ftrace, eBPF, and defensive strategies.
☆34Oct 30, 2026Updated this week
Alternatives and similar repositories for LinuxMalwareTechniques
Users that are interested in LinuxMalwareTechniques are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Generate proxy DLLs for sideloading and hijacking research. Mirrors exports, embeds originals, runs payloads.☆17Jun 16, 2026Updated 4 months ago
- Clean Indirect Syscalls with Syscall Tampering.☆46Updated this week
- Kassandra is a custom Mythic C2 agent written in Rust, containerized via a Python-based builder☆25Jul 31, 2026Updated 3 months ago
- A stealth-focused kernel-mode virtual HID mouse driver for Windows. Built with KMDF and VHF for precise, hardware-level input simulation …☆49Jul 27, 2026Updated 3 months ago
- This is a project aimed to make every other Saas product a C2, confluence is just the beginning.☆21Oct 21, 2026Updated last week
- Proton VPN Special Offer - Get 70% off • AdSpecial partner offer. Trusted by over 100 million users worldwide. Tested, Approved and Recommended by Experts.
- Cross-platform syscall-powered implant & C2 — direct syscalls (Win), raw syscalls (Linux), HTTPS/DNS/ICMP channels. No winapi layer.☆67Updated this week
- A poor man's attempt to replicate the shellcode execution technique demo'd by @3lk during STHACK 2026 (https://www.youtube.com/watch?v=al…☆39Oct 14, 2026Updated 2 weeks ago
- ☆18Oct 3, 2026Updated 3 weeks ago
- A PoC of User-Defined Reflective Loader for Havoc Framework built with Cystal Palace☆46Oct 18, 2026Updated last week
- A BOF designed to inspect processes memory and addresses☆42Apr 19, 2026Updated 6 months ago
- Pull-based C2 framework with ten native transports, concurrent multi-profile handlers, and end-to-end ECDSA-signed tasking. Single Go bin…☆34Oct 16, 2026Updated 2 weeks ago
- ☆22Jun 28, 2026Updated 4 months ago
- Async port/ping scanner BOF. Supports IP/port ranges, CIDR notation and hostnames.☆20Jul 23, 2026Updated 3 months ago
- Process ID Mutator via BYOVD Kernel R/W☆20Sep 6, 2026Updated last month
- Deploy open-source AI quickly and easily - Special Bonus Offer • AdRunpod Hub is built for open source. One-click deployment and autoscaling endpoints without provisioning your own infrastructure.
- A truly Position Independent Code (PIC) NimPlant C2 beacon written in C, without reflective loading.☆66Feb 11, 2025Updated last year
- Technical documentation, reverse engineering research, and tools for the Windows Endpoint Security Platform (WESP).☆81Sep 18, 2026Updated last month
- Kernel-mode process terminator using a signed BYOVD driver. Works on all Windows 10/11. No offsets, no PDB. Rust.☆110Updated this week
- A technique that mixes NTDLL unhooking and hellsgate gate varients☆33Updated this week
- Crypter developed in Rust, featuring the implementation of various injection and evasion techniques, and including a builder with an intu…☆22Jul 18, 2026Updated 3 months ago
- Debugger utilizing stealth hooks to hide from debugger detection☆27Aug 22, 2026Updated 2 months ago
- Staged DLL injection proof-of-concept built in C using Win32 APIs — developed in an isolated lab environment for red team certification s…☆42Jun 4, 2026Updated 4 months ago
- Find Windows RWX Memory Regions depending on the memory space needed☆18Nov 26, 2023Updated 2 years ago
- Userland EDR for Windows. ETW telemetry, behavioral correlation, MITRE ATT&CK.☆38Updated this week
- Proton VPN Special Offer - Get 70% off • AdSpecial partner offer. Trusted by over 100 million users worldwide. Tested, Approved and Recommended by Experts.
- Malware as a Service Ludus Range☆141Sep 24, 2026Updated last month
- Advanced static Linux kernel local privilege escalation toolkit for discovery and analysis.☆39Jun 19, 2026Updated 4 months ago
- A Position Independent Code (PIC) implementation of the execute-assembly command built with Crystal Palace.☆21Oct 4, 2026Updated 3 weeks ago
- Research on a new PoC for a Windows Sandbox .wsb HostFolder UNC path primitive that causes the host to authenticate over SMB and leak Net…☆32Jun 21, 2026Updated 4 months ago
- Windows Kernel-Mode Shellcode Development Framework (WKMSDF)☆91Aug 1, 2026Updated 2 months ago
- PIC shellcode agent based on Stardust framework and Crystal Palace☆91Updated this week
- Windows named pipe hooking toolkit☆46Mar 20, 2026Updated 7 months ago
- Process Impairment Exploit Chain.☆36Aug 12, 2026Updated 2 months ago
- Serverless C2 transport plugin for AdaptixC2 v1.2 using AWS Lambda + DynamoDB as the relay infrastructure.☆31Oct 19, 2026Updated last week
- Serverless GPU API endpoints on Runpod - Get Bonus Credits • AdSkip the infrastructure headaches. Auto-scaling, pay-as-you-go, no-ops approach lets you focus on innovating your application.
- A cross-platform, collaborative C2 for red-teaming. Agents are cross-compilable (e.g, you can generate Windows DLLs on Linux), cross-comp…☆23Mar 7, 2025Updated last year
- Advanced in-memory process injection using transient SEC_IMAGE sections, custom crypter, and ADS payload delivery no disk traces, maximum…☆22Jun 12, 2025Updated last year
- A PoC Cobalt Strike UDRL written in Rust☆34Sep 12, 2026Updated last month
- ☆38Sep 8, 2026Updated last month
- Silverseal is an open-source Linux bootkit and rootkit framework written in Rust, using UEFI and early kernel boot hooks to load a stealt…☆173Oct 8, 2026Updated 3 weeks ago
- Mythic Peer to Peer (P2P) Communication Protocol via. LLDP☆24Aug 20, 2026Updated 2 months ago
- Build guide for Red Teaming home lab. GOAD lab setup in Proxmox and pfSense, Operator/C2 and Redirectors.☆51Sep 26, 2026Updated last month