
LogsTotal
Self-hosted multi-engine Sigma detection for event logs

Self-hosted multi-engine Sigma detection for event logs

Hunt WiFi threats silently. Catch the hackers.

Open-source blue team tool that protects Linux and Windows systems using multiple host and network defense and detection methods.

Self-contained SSH honeypot for capturing attacker interactions and turning them into structured security intelligence.

Linux kernel security driver using LSM to harden the system, monitor and restore syscall table integrity, and protect CPU control registers against…

Low-resource honeypot that emulates common network services to detect post-breach attacker activity, with extensible protocol modules and…

Defensive detection package for CVE-2026-31431 (Linux kernel AF_ALG LPE). Sigma, Falco, auditd, KQL, and EQL rules mapped to MITRE ATT&CK…

PowerShell-based backdoor detection tool for VMware Horizon connection servers, targeting CVE-2021-44228. Includes canary with optional submission…

Detection script for CVE-2026-31431 (Copy Fail) that checks kernel version, patch presence, kernel configs, AF_ALG socket availability, setuid…

Detection, mitigation, and IOC toolkit for Copy Fail CVE-2026-31431 Linux kernel page-cache privilege escalation

A curated list of resources related to Industrial Control System (ICS) security.

Real-time cloud-native runtime security agent for Linux that monitors syscalls and container/Kubernetes metadata to detect anomalous behavior and…

Linux kernel module using Kprobes to detect and neutralize CVE-2024-1086 heap double-free exploits via temporal gap tracking and active register…

Docker configuration to quickly setup your own Canarytokens.

A repository of sysmon configuration modules

Multi-engine Linux malware scanner with five detection stages (MD5, HEX pattern, YARA, ClamAV, statistical), real-time inotify monitoring,…

Purpleteam scripts simulation & Detection - trigger events for SOC detections

Single-host runtime-security dashboard on eBPF — Go agent + SvelteKit. Live process tree, network map, and rule-based alerts for plain Linux hosts.