{"repo":"MatheuZSecurity/RingReaper","free":true,"listed":false,"github":"https://github.com/MatheuZSecurity/RingReaper","clone":"git clone https://github.com/MatheuZSecurity/RingReaper.git","description":"Linux post-exploitation agent that uses io_uring to stealthily bypass EDR detection by avoiding traditional syscalls.","language":"C","stars":384,"topics":["c2","evasion","iouring","malware","poc","rootkit"],"license":"MIT","category":"analytics","readme_excerpt":"RingReaper RingReaper is a simple post-exploitation agent for Linux designed for those who need to operate stealthily, minimizing the chances of being detected by EDR solutions. The idea behind this project was to leverage io uring , the new asynchronous I/O interface in the Linux kernel, specifically to avoid traditional system calls that most EDRs tend to monitor or even hook. In practice, RingReaper replaces calls such as read , write , recv , send , connect , among others, with asynchronous I/O operations ( io uring prep ), reducing exposure to hooks and event tracing typically collected in a standardized way by security products. NOTE: Some functions within RingReaper still rely on traditional calls, such as directory reading ( opendir , readdir ) or symbolic link resolution ( readlink ), because io uring does not yet fully support these types of operations natively. Even so, during my tests, these calls did not trigger alerts on the tested EDRs, precisely because they fall outside the monitored network I/O paths. In summary, RingReaper was built to avoid traditional calls as much as possible , and even in cases where it had to use them, it demonstrated excellent evasion capabilities, with no alerts or detections from common security agents. See the full and detailed article at: https://matheuzsecurity.github.io/hacking/evading-linux-edrs-with-io-uring/ Author: https://www.linkedin.com/in/mathsalves/ Rootkit Researchers - https://discord.gg/66N5ZQppU7 Command Reference C","default_branch":null,"files":null,"tree":[],"storefront":"/r/MatheuZSecurity","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/MatheuZSecurity/RingReaper/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}