Furtex packs 100+ Linux evasion tools into one repo

Furtex is a Linux post-exploitation and evasion research toolkit centered on io_uring and eBPF, with raw syscalls throughout and no liburing or higher-level frameworks. The GitHub project says it is intended “for authorized research and red team engagements only” and warns users not to run it on systems they do not own.

The repository is split into several major components:

• io_uring/: 13 tools for file, network, injection, and exfiltration operations
• bpf/: 15 tools for BPF map and program handling
• ebpf/: 9 programs and 2 runners
• edrs/: 75 tools for EDR evasion and post-exploitation
• techniques/: 13 tools aimed at bypassing all 25 default Falco rules

The project lists Linux 5.4 as the minimum kernel for base io_uring support, with later versions unlocking additional features such as IORING_OP_OPENAT and IORING_OP_STATX in 5.6, the CAP_BPF/CAP_PERFMON split in 5.8, BPF_LINK_DETACH in 5.9, and IORING_OP_SOCKET in 5.19. It also requires BTF support enabled in the kernel to generate vmlinux.h for the eBPF programs.

Recommended reading

Top AI models caught cheating in up to 14.1% of tests

According to the project, io_uring can bypass several common monitoring points because work submitted through io_uring SQEs runs through the kernel workqueue rather than the usual syscall path. The repo claims this means io_uring_enter(2) does not traverse the sys_call_table, does not trigger *sys_enter_ tracepoints, and does not hit livepatch hooks on native_sys_call**.

Furtex also documents what io_uring does not bypass on its own, pairing those cases with dedicated tools. Examples include ftrace_enum for clearing kprobe hooks, bpf_link_detach for detaching BPF LSM/KRSI links, audit_kill for disabling auditd via NETLINK_AUDIT, and plt_unhook for removing LD_PRELOAD or PLT/GOT userland hooks.

The largest module, edrs/, includes both privileged and unprivileged binaries. The listed tools cover tasks such as EDR detection, BPF link detachment, kernel module unloading, audit disabling, netfilter flushing, process hiding, raw Ethernet C2, ICMP exfiltration, and multiple memfd, ptrace, and pidfd_getfd-based techniques.

The repo includes build targets for individual components as well as a top-level make all, and invites outside contributions with PRs welcome and a public Rootkit Researchers Discord link.