rootisnaked

Rootisnaked is an eBPF-based tool crafted for monitoring root privilege escalations on Linux systems by intercepting changes to user credentials, specifically monitoring when a process's UID changes to 0 (root). Primarily used for detecting potential privilege escalation attempts, it logs these events to a ring buffer, enabling subsequent analysis. The tool additionally supports centralized alerting via integration with Alertmanager and Telegram for real-time notifications.