Intrusion Detection

oyesanyf/oshoosiclaw

Autonomous Rust endpoint security agent combining Ring-0 Windows driver and Linux eBPF pre-execution blocking, YARA detection, MITRE ATT&CK mapping,…

gmh5225/maldec-edr

Unix endpoint detection and response solution using kernel-level mechanisms to detect anomalies and malware attacks in real time.

nawaralseelawi/pvbrf-id

Simulation code and results for a private, verifiable, Byzantine-robust federated intrusion detection protocol using secret sharing, Merkle audits…

perplexityai/numbat

Visibility into AI agent activity on endpoints, with on-device detection, optional pre-action blocking, and forensic reconstruction.

cognis-digital/c2detect

C2 server fingerprinter — Cobalt Strike, Sliver, Mythic, Havoc, Brute Ratel

swastiksagar/wazuhlabproject

Hands-on Wazuh SIEM/XDR home lab covering OVA deployment, agent enrollment, file integrity monitoring, VirusTotal malware detection, and MITRE ATT&CK…

jev-sec/jev-ids

Blazing-Fast Token-Efficient Intrusion Detection System (IDS) based on TypeSafe's Jev.

ahmed-tarek22752/security-vulnerability-in-microsoft-office.

Blue-team analysis of a malicious DOCX exploiting CVE-2017-0199, covering sandbox detonation, network forensics, IOC extraction, MITRE ATT&CK…

trustedsec/artillery

Open-source blue team tool that protects Linux and Windows systems using multiple host and network defense and detection methods.

g0dse11/detecttrace

Open-source detection engineering tool that traces security detections end to end and identifies the first failing stage.

arpsyndicate/vedas-signatures

VEDAS-Driven Autonomous Generation + Community Contributions of Suricata & Nuclei Rules for over 13,000 CVEs

rbidou/pyrasp

Runtime Application Self Protection for Python web servers, serverless functions and MCP servers, detecting attacks, prompt injection and data leaks…

gopasteverything/gpewebdefender

Lightweight web-attack monitor. One Go binary + SQLite. Not OSSEC, not a WAF.

ndaal_open_source/ndaal_public_auditd

Best-practice Linux Auditd rule set with 14,956 MITRE ATT&CK-mapped rules, Ansible deployment role, and lint/test tooling for security monitoring and…

liuz233/harde

Research code for HARDE, an agent harness that probes and adaptively optimizes components for runtime risk detection and execution control across…

microlaser/dns_watchdog_windows2

PowerShell script that monitors Windows DNS traffic via pktmon to detect poisoning, spoofing, rogue resolver responses, and gateway MAC changes,…

haidang-infosec/phantom-grid

An eBPF-powered Active Defense system that turns your Linux server into a deceptive honeypot. Features transparent traffic redirection, OS…