Tracking interesting Linux (and UNIX) malware. Send PRs
☆1,210May 10, 2025Updated 9 months ago
Alternatives and similar repositories for linux-malware
Users that are interested in linux-malware are comparing it to the libraries listed below
Sorting:
- A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.☆1,942Apr 7, 2024Updated last year
- Collection of malware source code for a variety of platforms in an array of different programming languages.☆17,858Sep 10, 2025Updated 5 months ago
- awesome-linux-rootkits☆2,032Feb 15, 2026Updated 2 weeks ago
- Reverse Engineer's Toolkit☆5,169May 1, 2025Updated 10 months ago
- Resources for DFIR Professionals Responding to the REvil Ransomware Kaseya Supply Chain Attack☆180Jul 6, 2021Updated 4 years ago
- Knowledge base of exploit mitigations available across numerous operating systems, architectures and applications and versions.☆923May 20, 2024Updated last year
- Materials for Windows Malware Analysis training (volume 1)☆2,028Jul 1, 2024Updated last year
- Malwoverview is a rapid response tool used to gather intelligence information from VirusTotal, Hybrid Analysis, URLHaus, Polyswarm, Malsh…☆3,547Jan 20, 2026Updated last month
- Automatic Linux privesc via exploitation of low-hanging fruit e.g. gtfobins, pwnkit, dirty pipe, +w docker.sock☆7,111Mar 12, 2024Updated last year
- Offensive Software Exploitation Course☆2,393May 31, 2023Updated 2 years ago
- A FREE comprehensive reverse engineering tutorial covering x86, x64, 32-bit/64-bit ARM, 8-bit AVR and 32-bit RISC-V architectures.☆13,287Updated this week
- Execute ELF files without dropping them on disk☆503Jun 28, 2024Updated last year
- Elastic Security detection content for Endpoint☆1,380Updated this week
- Malware samples, analysis exercises and other interesting resources.☆1,613Jan 13, 2024Updated 2 years ago
- Windows kernel and user mode emulation.☆1,860Updated this week
- ☆1,072May 18, 2024Updated last year
- Rust Weaponization for Red Team Engagements.☆2,986Apr 25, 2024Updated last year
- Cover your tracks during Linux Exploitation by leaving zero traces on system logs and filesystem timestamps.☆1,476Oct 8, 2022Updated 3 years ago
- Rapidly Search and Hunt through Windows Forensic Artefacts☆3,452Feb 14, 2026Updated 2 weeks ago
- Bootkit sample for firmware attack☆266Dec 1, 2024Updated last year
- Linux Kernel Defence Map shows the relationships between vulnerability classes, exploitation techniques, bug detection mechanisms, and de…☆2,258Dec 27, 2025Updated 2 months ago
- Linux eBPF backdoor over TCP. Spawn reverse shells, RCE, on prior privileged access. Less Honkin, More Tonkin.☆1,662Oct 19, 2023Updated 2 years ago
- A Simple Linux ELF Runtime Crypter☆271Feb 25, 2025Updated last year
- 💀 Generate a bunch of malicious pdf files with phone-home functionality. Can be used with Burp Collaborator or Interact.sh☆3,610Nov 14, 2025Updated 3 months ago
- Defences against Cobalt Strike☆1,296Jul 14, 2022Updated 3 years ago
- FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.☆3,897Feb 23, 2026Updated last week
- A curated list of awesome resources related to executable packing☆1,542Feb 14, 2026Updated 2 weeks ago
- ☆1,455Jan 23, 2024Updated 2 years ago
- The FLARE team's open-source tool to identify capabilities in executable files.☆5,844Updated this week
- Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks,…☆2,313Oct 31, 2025Updated 4 months ago
- Organized list of my malware development resources☆1,701May 16, 2022Updated 3 years ago
- A collaborative, multi-platform, red teaming framework☆4,318Feb 19, 2026Updated last week
- A list of cyber-chef recipes and curated links☆2,186Jun 14, 2024Updated last year
- This is a collection of threat detection rules / rules engines that I have come across.☆296May 5, 2024Updated last year
- ScareCrow - Payload creation framework designed around EDR bypass.☆2,874Aug 18, 2023Updated 2 years ago
- 🐸 Identify anything. pyWhat easily lets you identify emails, IP addresses, and more. Feed it a .pcap file or some text and it'll tell …☆7,153Oct 31, 2023Updated 2 years ago
- My experiments in weaponizing Nim (https://nim-lang.org/)☆3,038May 13, 2024Updated last year
- This is a repository of resource about Malware techniques☆824Apr 8, 2023Updated 2 years ago
- Covenant is a collaborative .NET C2 framework for red teamers.☆4,620Jul 18, 2024Updated last year