Furtex – Linux Toolkit for Post-Exploitation and Evasion for Security Researchers and Red Teamers

A new open-source project, Furtex, has emerged as a Linux-focused post-exploitation and evasion research toolkit for authorized security researchers and red-team operators.

The project combines raw io_uring system calls, BPF and eBPF tooling, and EDR-evasion research utilities without relying on liburing or larger frameworks.

Furtex is a collection of single-purpose tools designed to demonstrate how modern Linux telemetry, kernel monitoring, and endpoint defenses can be tested.

The repository explicitly states that it is only for authorized research, penetration testing, CTF environments, and defensive development.

Furtex: Linux Post-Exploitation Toolkit

Furtex is divided into five main areas: io_uring, bpf, ebpf, edrs, and techniques. The io_uring section contains 13 tools that use raw kernel interfaces for file, networking, process injection, and data transfer operations.

Its stated research focus is the visibility gap created when operations are submitted through io_uring work queues rather than traditional syscall-dispatch paths.

The project claims that certain io_uring operations may not trigger sys_enter_* tracepoints or pass through hooks placed on syscall-table dispatch functions.

This matters because security products often collect Linux telemetry through syscall tracing, kprobes, eBPF programs, audit rules, or user-space interception.

Furtex provides examples designed to help defenders evaluate whether their monitoring stack observes alternative kernel execution paths.

The BPF and eBPF components broaden that assessment capability. Furtex includes utilities for enumerating loaded BPF maps and programs, reviewing BPF links, detecting Linux Security Module hooks, and inspecting configurations that could expose gaps in endpoint monitoring.

It also includes eBPF proof-of-concept programs for monitoring process, network, credential-path, and terminal activity. Its largest directory, edrs, includes roughly 75 utilities categorized by privilege requirements.

These tools cover EDR reconnaissance, BPF program discovery, kernel-hook enumeration, audit and logging visibility tests, namespace activity, process masquerading, memory-based execution concepts, and network-channel experiments.

Several functions require elevated Linux capabilities such as CAP_BPF, CAP_PERFMON, CAP_NET_RAW, CAP_NET_ADMIN, or CAP_AUDIT_CONTROL.

Developed by MatheuZSecurity and available on GitHub, Furtex includes a techniques directory focused on Falco detection engineering.

The repository describes tools that assess bypass conditions against Falco’s default ruleset, including scenarios involving event collection, process names, paths, namespaces, and alternate execution methods.

For defenders, these tests can identify detections that rely too heavily on a single event source, process name, or command-line pattern.

The toolkit requires GCC, Clang, Make, Linux kernel headers, libbpf development files, and bpftool. Some eBPF features also depend on kernel BTF support through CONFIG_DEBUG_INFO_BTF=y.

Furtex documents kernel-version dependencies, noting that particular features become available across Linux kernel versions 5.4 through 5.19. While Furtex can be useful for validating Linux EDR coverage, its capabilities are dual-use and high risk.

Security teams should treat the project as a threat-modeling resource: monitor io_uring activity, track BPF program and link changes, alert on unusual use of capabilities, protect audit configurations, and correlate low-level kernel events with process and network telemetry.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post Furtex – Linux Toolkit for Post-Exploitation and Evasion for Security Researchers and Red Teamers appeared first on Cyber Security News.