
security checks
linux security checks

linux security checks
Offensive & defensive Linux kernel security research focused on rootkit behavior, observable artifacts and detection.

You didn't think I'd go and leave the blue team out, right?

IOCs and a read-only triage checklist from a real Linux root compromise: RedTail miner, XorDDoS persistence, MoneroOcean miner, DirtyFrag LPE…

Check for and remediate conditions that make an IOS-XE device vulnerable to CVE-2023-20198

Open-source security orchestration, automation, and response (SOAR) platform with a visual workflow editor, prebuilt security app integrations, and…

Graph platform for Detection and Response

A forensic reconstruction engine for cloud and identity incident response.

Forensic collection and analysis toolkit for Android and iOS devices to identify potential compromise by known spyware using public and private…

Tools and Techniques for Blue Team / Incident Response

PacketFence is a fully supported, trusted, Free and Open Source network access control (NAC) solution. Boasting an impressive feature set including a…

This repository serves as a place for community created Targets and Modules for use with KAPE.

Red Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.

RDP monster-in-the-middle (mitm) and library for Python with the ability to watch connections live or after the fact

Portable Linux RAM acquisition tool for forensics and incident response, capturing LiME-compatible images with optional compression and remote…

IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.

Curated IPv4 blocklist of malicious addresses, refreshed every 6 hours for firewall and WAF ingestion, with split lists and CTI-ready formats for…

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs