rootkit-detector

🛡️ All-in-one input security monitor. Detects keyloggers, rootkits, hooks, and exfiltration. Cross-platform (Win/Linux/macOS) with Web GUI & MITRE ATT&CK mapping.

Awesome Rootkit Malware Resources

Rootkit detector based on analyzing inconsistencies between the system handles table and Toolhelp32 process snapshots. Implements Floating Thread Detection in private memory and RWX region scanning, integrating a SIEM telemetry pipeline for remote incident monitoring.

Advanced Volatility 3 plugin & standalone memory carver for eBPF rootkit detection, eBPF map inspection, and Linux kernel forensics.