A fast, single-binary incident response scanner for Linux. Detects rootkits, hidden processes, kernel tampering, and persistence mechanisms in one sweep.
Ghostscan inspects kernel structures, BPF programs, network sockets, and filesystem artifacts to surface threats that traditional tools miss.
Drop one static binary onto the target host. No dependencies, no installation, no agents. Build once with Rust and go.
Run once, get results. No daemons, no persistent state. Every scan is a fresh, complete sweep with immediate findings.
Embedded BPF programs inspect kernel data structures directly, finding hidden processes and listeners invisible to procfs.
Validates syscall tables, ftrace hooks, kprobes, and kernel text sections to detect runtime tampering and rootkit hooks.
Cross-references netlink sockets, /proc/net, and netfilter hooks to find hidden listeners, orphaned sockets, and backdoor ports.
Scans cron jobs, systemd units, SSH configs, ld.so.preload, PAM modules, sudoers, and more for backdoor persistence mechanisms.
Every scanner cross-references multiple data sources to detect discrepancies that indicate active compromise.
No configuration. No tuning. Drop, run, read.
Copy the single binary to your target host. No runtime dependencies required.
Run as root. All 52 scanners execute automatically in under 2 seconds.
Color-coded findings with actionable context. Red means investigate, green means clear.
Build from source with the Rust toolchain, then deploy anywhere.
Clone the repository and build a release binary.
git clone https://github.com/h2337/ghostscan
cd ghostscan && cargo build --release
Copy the binary to the target host.
scp target/release/ghostscan root@host:/tmp/
Run as root and review findings.
sudo ./ghostscan
Modular scanner architecture with multi-source cross-referencing for high-confidence detections.
Open source. MIT licensed. Built in Rust.