A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.
Repository Index
47,133 repositories indexed
25–48 of 88 · Most stars
Learning eBPF, published by O'Reilly - out now! Here's where you'll find a VM config for the examples, and more
- ebpf
- ebpf-co-re
- linux-kernel
The beginner's guide to eBPF
Process-aware, eBPF-based tcpdump
- ebpf
- ebpf-tc
- tcpdump
- tcpdump-like
Rust virtual machine and JIT compiler for eBPF programs
- jit-compiler
- ebpf
- ebpf-programs
- rust
Userspace eBPF VM
A Tool to make Build and Run eBPF programs easier
ebpfkit is a rootkit powered by eBPF
eBPF library for Go. Powered by libbpf.
Use eBPF to speed up your Service Mesh like crossing an Einstein-Rosen Bridge.
- ebpf
- istio
- mesh
- linkerd2
An eBPF Manager for Linux and Kubernetes
lightweight system-level observability for AI Agents
eBPF based always-on CPU/GPU profiler auto-discovering targets in Kubernetes and systemd, zero code changes or restarts needed!
Real-time network monitor + outbound firewall — see & block every connection. Privacy-first, local-first, Rust fleet agent, SIEM exports, 8 languages. / Moniteur réseau temps réel + pare-feu sortant, agent de flotte Rust, exports SIEM. 100 % local.
A collection of eBPF programs demonstrating bad behavior, presented at DEF CON 29
Alaz: Advanced eBPF Agent for Kubernetes Observability – Effortlessly monitor K8s service interactions and performance metrics in your K8s environment. Gain in-depth insights with service maps, metrics, and more, while staying alert to crucial system anomalies 🐝
- ddosify
- ebpf
- kubernetes
- metrics
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
- blue-team
- detection-engineering
- edr
- endpoint-detection
Framework for running BPF programs with rules on Linux as a daemon. Container aware.
eBPF verifier based on abstract interpretation
- abstract-interpretation
- static-analyzer
- ebpf
- ebpf-verifier
hBPF = eBPF in hardware
eBPF-based workload orchestration platform, built for Cloud Native ecosystem.
LordOS — a free, fast and secure GNU/Linux distribution based on Debian, with its own desktop environment: display server and Wayland compositor in C, a React UI engine on QuickJS, and private native apps.
Prototyping kernel development work outside mainline
- kernel-modules
- kernel
- xdp
- ebpf-programs
XDP project collaboration through a git-repo