milabs/awesome-linux-rootkits resource

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

2094 stars · 266 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A curated awesome-list of Linux rootkits, covering both user-mode (LD_PRELOAD) and kernel-mode (LKM) rootkits with a feature comparison table. It serves as a reference catalog for security research, detection research, and understanding rootkit capabilities.

Use cases

• find open source linux rootkits for research
• compare features of LKM rootkits
• study LD_PRELOAD userland rootkit techniques
• research rootkit detection evasion methods
• find academic rootkit projects for learning kernel internals
• build a rootkit detector by studying known techniques

When to choose

• you need a catalog of existing Linux rootkit projects with capability comparisons
• you are researching rootkit techniques or building detection tooling
• you want examples of syscall hooking and stealth techniques on Linux

When to avoid

• you need a defensive security tool rather than a reference list
• you want a maintained rootkit itself rather than links to third-party projects
• you are not working on Linux systems

Facets

learning-resource · maturity active

security reverse-engineering developer-tools security operating-systems awesome-lists cli awesome-list rootkit lkm ld-preload kernel-module offensive-security curated-list linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="milabs/awesome-linux-rootkits")