Tools

damnkrishna/cve-2025-32433-lab

A Flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without…

bombinisecurity/bombini

eBPF Security Monitoring and Sandboxing Agent Based on Aya

andreicscs/honeywire

Open-source deception platform that turns any Linux machine into a high-signal canary. Deploy tripwire sensors on files, ports, and network services…

dougburks/so-crates

SO-CRATES: Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus!

wattocyber/detection-defense-library

Detection-engineering reference mapping Windows, cloud, container, identity, and ICS attack classes to Sigma rules, trust-boundary models, BYOVD…

nabhan-mohy/dirty-frag-research-cve-2026-43284-

Comprehensive technical research on CVE-2026-43284 (Dirty Frag), including Linux kernel internals, root cause analysis, patch analysis, detection…

cybereason-public/owlsm

Sigma Rules Engine inside the Linux Kernel using eBPF. Focusing on prevention capabilities

secdev02/cyber-decoy

Experimental Decoy Broker

azdevops143/fragnesia-charan-cve-2026-46300

Hardened container staging framework with seccomp syscall whitelisting and eBPF telemetry to detect and block container escape and kernel ULP…

detect-defenselab/cve-2026-31431-detection-defense

Research and detection guidance for CVE-2026-31431, an io_uring-based bypass of syscall monitoring. Provides detection rules for Tetragon, Falco, and…

ashok523/cve-2026-31431

Defensive IR playbook and detection package for CVE-2026-31431 (Copy Fail) Linux kernel LPE, including Sigma, auditd, Falco, Wazuh, YARA, eBPF, and…

garethmsheldon/cve-2025-60787-detection-motioneye-rce-via-config-injection

Detection rules and YARA/KQL signatures for CVE-2025-60787, an unauthenticated RCE in motionEye via config injection, with process execution and file…

spanwich/sel4-ics-gateway-demo

Defensive security demo: seL4 microkernel gateway protecting vulnerable ICS from CVE-2019-14462

michaelsanford/log4shell-honeypot

Dockerized honeypot for CVE-2021-44228.

snyk/leaky-vessels-dynamic-detector

eBPF-based runtime detector for container breakout vulnerabilities in runc and Docker, monitoring syscalls and Docker daemon calls to detect…

deepfence/packetstreamer

⭐ ⭐ Distributed tcpdump for cloud native environments ⭐ ⭐

kube-tarian/tarian

eBPF-based runtime security agent for Kubernetes that detects unknown processes and file changes, enforces pre-registered constraints, and automates…

dorser/cve-2024-21626

Educational demo of CVE-2024-21626 runc container escape with eBPF-based detection gadget for exploitation attempts.