Furtex: A New Linux Toolkit for Post-Exploitation and EDR Evasion

Furtex: Post-exploitation, rootkit and evasion research toolkit for Linux

I built Furtex, a research toolkit for Linux that leverages io_uring and eBPF to bypass standard security hooks. By using raw syscalls instead of traditional libraries, this tool avoids detection by many EDR solutions. It includes over 100 utilities for file operations, network exfiltration, and disabling kernel-level protections, designed strictly for authorized red team engagements.

"io_uring SQEs go through the kernel workqueue, never calling through sys_call_table or firing sys_enter tracepoints, which alone kills a large class of EDR hooks without touching anything."