https://github.com/mempodippy/vlany

Linux LD_PRELOAD rootkit (x86 and x86_64 architectures)

https://github.com/unix-thrust/beurk

https://github.com/chokepoint/azazel

https://github.com/chokepoint/Jynx2

https://github.com/chokepoint/jynxkit

https://github.com/NexusBots/Umbreon-Rootkit

https://github.com/ChristianPapathanasiou/apache-rootkit

https://github.com/MatheuZSecurity/Singularity

https://github.com/ait-aecid/caraxes/

https://github.com/jermeyyy/rooty

https://github.com/trailofbits/krf

https://github.com/f0rb1dd3n/Reptile

zap: details :zap:

https://github.com/QuokkaLight/rkduck

zap: details :zap:

https://github.com/croemheld/lkm-rootkit

https://github.com/mncoppola/suterusu

https://github.com/romeroperezabel/ARP-RootKit

https://github.com/nurupo/rootkit

https://github.com/m0nad/Diamorphine

A loadable kernel module (LKM) rootkit for Linux Kernels (x86/x86_64 and ARM64).

https://github.com/ivyl/rootkit

https://github.com/deb0ch/toorkit

https://github.com/vrasneur/randkit

https://github.com/Eterna1/puszek-rootkit

https://github.com/trimpsyw/adore-ng

https://github.com/bones-codes/the_colonel

https://github.com/David-Reguera-Garcia-Dreg/enyelkm

https://github.com/falk3n/subversive

https://github.com/jiayy/lkm-rootkit

https://github.com/a7vinx/liinux

https://github.com/hanj4096/wukong

https://github.com/varshapaidi/Kernel_Rootkit

https://github.com/kacheo/KernelRootkit

https://github.com/dsmatter/brootus

https://github.com/jarun/keysniffer

https://github.com/PinkP4nther/Sutekh

https://github.com/En14c/LilyOfTheValley

https://github.com/NoviceLive/research-rootkit

https://github.com/NinnOgTonic/Out-of-Sight-Out-of-Mind-Rootkit

zap: writeup :zap:

https://github.com/h3xduck/Umbra

https://github.com/kris-nova/boopkit

https://github.com/milabs/kopycat

https://github.com/h3xduck/TripleCross

A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.

https://github.com/carloslack/KoviD

https://github.com/reveng007/reveng_rtkit

https://github.com/landhb/DrawBridge

https://github.com/gianlucaborello/libprocesshider

Hide a process under Linux using the ld preloader (https://sysdig.com/blog/hiding-linux-processes-for-fun-and-profit/)

https://github.com/spiderpig1297/kprochide

https://github.com/spiderpig1297/kfile-over-icmp

https://github.com/spiderpig1297/kunkillable

https://web.archive.org/web/20140701183221/https://www.thc.org/papers/LKM_HACKING.html

https://github.com/MatheuZSecurity/Rootkit

[Collection of codes focused on Linux rootkits]

https://github.com/bad-antics/rupurt

https://github.com/ossec/ossec-hids

OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.

https://github.com/chkrootkit/chkrootkit

https://github.com/Sysinternals/SysmonForLinux

A security monitoring tool. It depends on SysinternalsEBPF.

https://github.com/al0ne/LinuxCheck

https://github.com/CISOfy/lynis

Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional..

https://github.com/draios/sysdig

A tool for deep Linux system visibility, with native support for containers. Think about sysdig as strace + tcpdump + htop + iftop + lsof + ...awesome sauce