Top 9 C rootkit Projects

TitanHide

1 1,941 2.5 C

Hiding kernel-driver for x86/x64.
TripleCross

11 1,677 0.7 C

A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.
WorkOS

workos.com sponsored

The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.
Diamorphine

1 1,661 3.0 C

LKM rootkit for Linux Kernels 2.6.x/3.x/4.x/5.x/6.x (x86/x86_64 and ARM64)
r77-rootkit

1 1,495 6.2 C

Fileless ring 3 rootkit with installer and persistence that hides processes, files, network connections, etc.
ebpfkit

2 660 0.7 C

ebpfkit is a rootkit powered by eBPF
Stuxnet-Source

2 149 5.5 C

stuxnet Source & Binaries. ONLY FOR ACADEMICAL RESEARCH AND EDUCATIONAL PURPOSES! Includes: Source files, Binaries, PLC Samples,Fanny Added in another repo.
WSAAcceptBackdoor

1 111 0.0 C

Winsock accept() Backdoor Implant.
InfluxDB

www.influxdata.com sponsored

Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.
ebpfkit-monitor

1 110 0.6 C

ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits
arm64_silent_syscall_hook

1 95 0.0 C

silent syscall hooking without modifying sys_call_table/handlers via patching exception handler

NOTE: The open source projects on this list are ordered by number of github stars. The number of mentions indicates repo mentiontions in the last 12 Months or since we started tracking (Dec 2020).

C rootkit related posts

TripleCross – Linux eBPF Rootkit
1 project | news.ycombinator.com | 10 Jul 2022
GitHub - h3xduck/TripleCross: A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.
1 project | /r/devopsish | 7 Jul 2022
Show HN: TripleCross – A Linux eBPF rootkit with a C2 system and more
1 project | news.ycombinator.com | 6 Jul 2022
Show HN: Credentials dumper for Linux using eBPF
5 projects | news.ycombinator.com | 5 Jul 2022
TripleCross: A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.
1 project | /r/linux | 5 Jul 2022
TripleCross: A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.
1 project | /r/cybersecurity | 5 Jul 2022
TripleCross: A Linux eBPF rootkit framework
1 project | news.ycombinator.com | 5 Jul 2022
A note from our sponsor - WorkOS
workos.com | 27 Apr 2024

The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning. Learn more →

Index

What are some of the best open-source rootkit projects in C? This list will help you:

	Project	Stars
1	TitanHide	1,941
2	TripleCross	1,677
3	Diamorphine	1,661
4	r77-rootkit	1,495
5	ebpfkit	660
6	Stuxnet-Source	149
7	WSAAcceptBackdoor	111
8	ebpfkit-monitor	110
9	arm64_silent_syscall_hook	95