
jev-ids
Blazing-Fast Token-Efficient Intrusion Detection System (IDS) based on TypeSafe's Jev.

Blazing-Fast Token-Efficient Intrusion Detection System (IDS) based on TypeSafe's Jev.

Runtime Application Self Protection for Python web servers, serverless functions and MCP servers, detecting attacks, prompt injection and data leaks…

eBPF Security Monitoring and Sandboxing Agent Based on Aya

Isolated AD/Linux attack lab: exploited CVE-2007-2447 via Metasploit, detected with Wazuh SIEM mapped to MITRE ATT&CK (T1190, T1059)

A collection of Tools and Rules for decoding Brute Ratel C4 badgers


The Sigma command line interface based on pySigma

Aggregated Zeek-format threat intelligence feeds with combined indicators from public and curated sources for continuous IDS and network threat…

ETW based POC to identify direct and indirect syscalls

Detection rules and analysis for Dirty Frag (CVE-2026-43284/CVE-2026-43500) Linux kernel LPE vulnerability. Based on community research and health…

Detection of Linux Malware C2 RedXOR - demonstration

A Zeek based Agent Tesla malware C2 detector.

A Zeek based AsyncRAT malware detector.

A Zeek based Mitre Caldera detector.

A Zeek based Gozi banking malware detector.

A Zeek based NetSupport detector. NetSupport is often abused by attackers in malware.

A Zeek IPSec protocol analyzer based on Spicy.

A Zeek protocol analyzer for the Facefish rootkit, based on Spicy.