What is furtex?

Furtex is a post-exploitation and evasion research toolkit for Linux, built for red team engagements and authorized security research. The project provides a large collection of tools, 75 in the EDR evasion directory alone, organized into several categories. The authors stress that it should only be run on systems you own or have explicit permission to test. The toolkit is written in C and uses two Linux kernel technologies: io_uring and eBPF. The README does not explain these in detail, but the core idea is that io_uring handles input and output through a kernel workqueue, which lets the tools skip the normal syscall path that security software monitors. This design alone bypasses several common monitoring hooks without any extra effort. eBPF, meanwhile, lets the tools inspect and manipulate kernel-level security programs directly. The repository is split into five directories. The io_uring folder holds 13 tools for file, network, process injection, and data exfiltration operations. The bpf folder contains 15 tools for listing, dumping, writing to, and detaching BPF maps and programs. The ebpf folder holds BPF-side programs and loaders, while edrs contains the bulk of the toolkit with 75 tools for evading endpoint detection and response software. A techniques folder covers bypasses for Falco, a specific Linux security tool, with 13 tools targeting its default rules. Building the toolkit requires gcc, clang, make, kernel headers, and libbpf development files. Different kernel versions unlock different capabilities, with 5.19 needed for the full set of io_uring network operations. Many tools also require specific Linux capabilities, such as CAP_BPF for BPF tools or CAP_NET_RAW for raw network operations. The README is detailed about requirements and bypass coverage but does not explain what each evasion technique does at a high level. It assumes the reader already understands Linux security internals, kernel hooks, and EDR architecture. Beginners will find the command examples useful but will need outside references to understand why these techniques work.