Furtex Linux Toolkit Uses io_uring and eBPF to Bypass EDR and Falco Detection

A newly published Linux toolkit named Furtex showcases a wide range of concepts related to post-exploitation, persistence, data access, and monitoring evasion. It is built around io_uring, eBPF, BPF maps, and raw system calls.

The project includes over 100 tools organized into modules that cover asynchronous I/O operations, BPF inspection and manipulation, EDR evasion techniques, eBPF payloads, and specific bypass methods for Falco.

Furtex Linux Toolkit

The central premise of Furtex is that Linux security products often rely on hooks inserted into traditional syscall dispatch paths, such as sys_call_table modifications, sys_enter_* tracepoints, livepatch hooks, libc wrappers, and selected kprobes.

The toolkit claims that operations submitted via io_uring can follow kernel worker paths rather than the usual syscall execution path monitored by such instrumentation.

As a result, tools that utilize asynchronous submission queue entries for file or network operations may evade telemetry sources that detect direct reads, opens, connects, or related system calls.

The repository includes utilities for chained file operations, socket communications, DNS-based data transfer, process memory injection, memory-backed execution, raw packet transmission, and data access through alternative interfaces.

It also provides tools to inspect loaded BPF maps and programs, identify EDR-related artifacts, alter map data, detach BPF links, and enumerate kprobes or ftrace hooks.

These capabilities are particularly significant in environments where modern EDRs, cloud workload protection platforms, or runtime detection systems leverage eBPF for monitoring and enforcement.

Furtex specifically targets Falco, an open-source cloud-native runtime security platform. Its techniques component claims coverage for all 25 default Falco rules, using two broad approaches: preventing relevant events from reaching the sensor or modifying execution characteristics to ensure that rule conditions do not match.

Listed evasion concepts include io_uring-based operations, event flooding, ring-buffer exhaustion, process-name masquerading, namespace pivots, alternate file-operation semantics, and nonstandard process-execution paths.

For defenders, the project underscores that telemetry coverage cannot rely solely on syscall entry tracepoints or process-name-based rules. Security teams should verify that their Linux sensors monitor io_uring-originated file and network activity, inspect for suspicious BPF link detachment or map modification attempts, and alert on access to BPF-related kernel interfaces by unexpected processes.

Monitoring should also encompass privileged capabilities, such as CAP_BPF, CAP_PERFMON, CAP_NET_RAW, CAP_NET_ADMIN, and CAP_AUDIT_CONTROL, which Furtex identifies as prerequisites for several higher-impact functions.

Component	Reported scope	Key defensive concern
io_uring/	13 tools	File, network, injection, and exfiltration operations may evade monitoring built mainly around conventional syscall-entry telemetry.
bpf/	15 tools	BPF map/program reconnaissance, map alteration, BPF-link detachment, and sensor-targeting capabilities.
ebpf/	9 programs + 2 runners	eBPF-based payloads include process and port hiding, credential-path activity tracking, input capture, and network triggers.
edrs/	About 75 tools	EDR reconnaissance, hook enumeration, audit/log disruption, process injection, persistence, and alternate C2 mechanisms.
techniques/	13 tools	Falco-focused methods that claim to target all 25 default rules through event suppression or rule-condition evasion.
Privileged capabilities	CAP_BPF, CAP_PERFMON, CAP_NET_RAW, CAP_NET_ADMIN, CAP_AUDIT_CONTROL	Unexpected assignment or use of these capabilities should be investigated, especially on production workloads.
Kernel requirements	Linux 5.4 minimum; 5.19 for selected socket operations	Exposure varies by kernel version, BTF support, enabled capabilities, and the sensor’s telemetry architecture.

Organizations using Falco should review rules to ensure they don’t rely on assumptions tied to executable names, command-line patterns, syscall-specific event sources, and common utilities like shells, grep, or netcat.

Behavioral controls should correlate filesystem access, credential-file reads, memory-backed execution, raw socket creation, namespace changes, and unusual BPF activity, rather than treating any single kernel event as authoritative.

Furtex is distributed under an MIT license, with a legal notice restricting its use to authorized testing, CTFs, and defensive research. Despite these restrictions, its release offers defenders a practical catalog of Linux detection gaps to test in controlled environments, particularly where io_uring and eBPF are enabled on modern kernels.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.