Furtex Linux Toolkit Aids Post-Exploitation and Evasion for Red Teams

Key Takeaways

• Furtex is a new open-source toolkit designed for Linux post-exploitation and evasion research.
• It leverages raw io_uring system calls, BPF/eBPF tooling, and EDR evasion techniques without external frameworks.
• The toolkit aims to help red teams and authorized researchers identify blind spots in Linux telemetry, kernel monitoring, and endpoint detection and response (EDR) solutions.
• Defenders can use Furtex to evaluate their security stack’s visibility into non-traditional kernel execution paths and improve detection capabilities.

A new open-source initiative, dubbed Furtex, has emerged, providing a specialized toolkit for Linux-centric post-exploitation and evasion research. This resource is intended for authorized security researchers and red team operators.

The project integrates raw io_uring system calls, along with BPF and eBPF utilities, and includes research tools focused on EDR evasion. Notably, it operates independently of larger frameworks or the liburing library.

Furtex is structured as a collection of purpose-built tools, each designed to illustrate how contemporary Linux telemetry, kernel monitoring, and endpoint defenses can be rigorously tested. The repository explicitly restricts its use to authorized research, penetration testing, capture-the-flag (CTF) scenarios, and the development of defensive capabilities.

Understanding the Furtex Linux Post-Exploitation Toolkit

Furtex organizes its functionalities into five primary categories: io_uring, bpf, ebpf, edrs, and techniques. The io_uring segment alone comprises 13 distinct tools that interact directly with kernel interfaces to perform operations related to file manipulation, networking, process injection, and data transfer.

The core research objective of this section is to highlight potential visibility gaps that arise when operations are submitted via io_uring work queues, as opposed to following conventional syscall dispatch paths. The project asserts that certain io_uring operations may bypass traditional sys_enter_* tracepoints or avoid hooks placed on syscall-table dispatch functions.

This bypass is significant because many security products rely on syscall tracing, kprobes, eBPF programs, audit rules, or user-space interception for collecting Linux telemetry.

Furtex offers practical examples intended to assist defenders in assessing whether their existing monitoring infrastructure adequately observes these alternative kernel execution paths.

The BPF and eBPF components further enhance this assessment capability. Furtex includes utilities for listing loaded BPF maps and programs, examining BPF links, identifying Linux Security Module (LSM) hooks, and scrutinizing configurations that could reveal blind spots in endpoint monitoring. It also provides eBPF proof-of-concept programs designed to monitor process, network, credential-path, and terminal activities. The largest directory within Furtex, ‘edrs’, contains approximately 75 utilities, categorized by their privilege requirements.

These tools encompass EDR reconnaissance, discovery of BPF programs, enumeration of kernel hooks, audit and logging visibility tests, namespace activity, process masquerading, memory-based execution concepts, and network channel experiments. Several of these functions necessitate elevated Linux capabilities, such as CAP_BPF, CAP_PERFMON, CAP_NET_RAW, CAP_NET_ADMIN, or CAP_AUDIT_CONTROL.

Developed by MatheuZSecurity and available on GitHub, Furtex also features a techniques directory specifically dedicated to Falco detection engineering. This section outlines tools for evaluating bypass conditions against Falco’s default rule set, covering scenarios involving event collection, process names, paths, namespaces, and alternative execution methods.

For defensive teams, these tests are crucial for identifying detections that might be overly reliant on a single event source, process name, or command-line pattern. The toolkit requires GCC, Clang, Make, Linux kernel headers, libbpf development files, and bpftool. Certain eBPF functionalities also depend on kernel BTF support, enabled by CONFIG_DEBUG_INFO_BTF=y.

Furtex meticulously documents its kernel-version dependencies, indicating that specific features become available across Linux kernel versions 5.4 through 5.19. While Furtex serves as a valuable resource for validating Linux EDR coverage, its dual-use nature presents a high risk.

What You Should Do

• Monitor io_uring Activity: Implement monitoring for io_uring system call usage, as it can be used to bypass traditional syscall tracing.
• Track BPF Program and Link Changes: Continuously monitor for new or modified BPF programs and links, which can indicate malicious activity or attempts to evade detection.
• Alert on Unusual Capability Usage: Configure alerts for the unusual or unauthorized use of elevated Linux capabilities such as CAP_BPF, CAP_PERFMON, CAP_NET_RAW, CAP_NET_ADMIN, or CAP_AUDIT_CONTROL.
• Protect Audit Configurations: Secure and regularly review Linux audit configurations to ensure comprehensive logging and prevent tampering.
• Correlate Kernel Events with Telemetry: Integrate and correlate low-level kernel events with process and network telemetry to gain a holistic view of system activity and detect sophisticated evasion techniques.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.