MatheuZSecurity/Singularity

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1736 stars · 193 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Singularity is a stealthy Linux kernel module (LKM) rootkit targeting modern 6.x kernels, using ftrace-based syscall hooking to hide processes, files, network connections, and itself. It is a proof-of-concept offensive security research tool that also demonstrates evasion of eBPF-based runtime security tools, LKRG, audit, and memory forensics mechanisms.

Use cases

• study ftrace-based syscall hooking on modern kernels
• test EDR and eBPF runtime security tools like Falco and Tracee against kernel rootkits
• research rootkit stealth techniques for red team engagements
• evaluate LKRG and audit subsystem detection capabilities
• learn Linux kernel module development and hooking internals
• demonstrate process, file, and network connection hiding in a lab environment

When to choose

• you need a modern, actively maintained kernel rootkit PoC for 6.x kernels
• you are researching EDR/eBPF evasion at the kernel level
• you want to benchmark kernel runtime guards like LKRG
• you need a reference implementation of ftrace syscall hooking

When to avoid

• you want to hide activity on systems you do not own or have authorization to test
• you need a defensive detection tool rather than an offensive PoC
• you target kernels older than 6.x
• you need production-grade, supported software

Facets

library · maturity active

security penetration-testing reverse-engineering security penetration-testing operating-systems c cli rootkit lkm ftrace syscall-hooking edr-evasion ebpf-bypass proof-of-concept kernel-module red-team linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="MatheuZSecurity/Singularity")