Idov31/Nidhogg

Health v2 · maintenance only

Adoption not part of the score

2463 stars · 361 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Nidhogg is an open-source Windows x64 kernel rootkit written in C++ that demonstrates a wide range of rootkit techniques such as process, thread, file, registry, and port hiding, kernel callback manipulation, AMSI/ETW patching, and shellcode/DLL injection. It consists of a kernel driver and a user-mode C++ controller, compatible with all Windows 10 and 11 versions and designed for red team operations and security research.

Use cases

• hide processes and threads from user-mode tools on windows
• bypass AMSI and ETW during red team operations
• inject shellcode or DLLs via APC or NtCreateThreadEx
• remove or restore kernel callbacks to evade EDR
• dump credentials from kernel space
• learn windows kernel rootkit techniques
• protect files and registry keys from deletion
• reflectively load a kernel driver with kdmapper

When to choose

• you need an all-in-one, well-documented windows rootkit for red team engagements
• you are researching or teaching windows kernel rootkit techniques
• you want a kernel driver that integrates with your C2 framework
• you need to test EDR/AV detection against kernel-level evasion

When to avoid

• you need a defensive or production security tool
• you cannot tolerate blue screens or system instability
• you need support for 32-bit or non-Windows platforms
• your use case requires stealth from PatchGuard when registering callbacks via reflective loading

Facets

library · maturity active

security penetration-testing reverse-engineering security penetration-testing operating-systems windows windows cpp rootkit kernel-driver red-team windows-kernel offensive-security edr-evasion credential-dumping process-hiding

Member repositories

For agents

markdown · JSON · MCP: product_card(name="Idov31/Nidhogg")