h3xduck/TripleCross

Health v2 · maintenance only

Adoption not part of the score

1977 stars · 243 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

TripleCross is a Linux eBPF rootkit demonstrating offensive capabilities of eBPF technology, including library injection, execution hijacking, privilege escalation, a C2 backdoor, persistence, and stealth modules. It was created as an academic thesis project and is intended purely for educational and research purposes.

Use cases

• study how eBPF rootkits work
• demonstrate eBPF offensive capabilities in a security course
• research kernel-level backdoor and C2 techniques
• test endpoint detection of eBPF-based rootkits
• learn libbpf programming through a real-world example
• evaluate Linux kernel security against rootkit techniques

When to choose

• you are a security researcher or student studying eBPF-based rootkit techniques
• you need a reference implementation for defensive rootkit detection research
• you want to understand library injection, execution hijacking, and stealth on Linux

When to avoid

• you need a production or defensive security tool - this is offensive research code
• you cannot accept legal and ethical risk from rootkit software
• you need a maintained, supported project - it is an academic thesis artifact

Facets

application · maturity maintenance

security penetration-testing networking monitoring security penetration-testing operating-systems developer-tools c cli ebpf rootkit backdoor c2 libbpf kernel offensive-security privilege-escalation library-injection educational linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="h3xduck/TripleCross")