


A Zeek based NetSupport detector. NetSupport is often abused by attackers in malware.

Detection rules and analysis for Dirty Frag (CVE-2026-43284/CVE-2026-43500) Linux kernel LPE vulnerability. Based on community research and health…

A Zeek based STRRAT malware detector.

A Zeek based Agent Tesla malware C2 detector.

A Zeek based Mitre Caldera detector.

A Zeek based AsyncRAT malware detector.

A Zeek based Gozi banking malware detector.

A Zeek protocol analyzer for the Facefish rootkit, based on Spicy.

eBPF-based Security Observability and Runtime Enforcement

Labtainers: A Docker-based cyber lab framework

Endpoint behavior monitoring and analysis system for processes, files, registry, and networks. Supports scripting, extensions, and plugins for…

Apache Real Time Logs Analyzer System

eBPF-based Linux rootkit detector using multi-channel cross-view analysis (sched_switch, NMI, /proc) to detect DKOM, tracepoint tampering, and…

Runtime Application Self Protection for Python web servers, serverless functions and MCP servers, detecting attacks, prompt injection and data leaks…

A collection of Tools and Rules for decoding Brute Ratel C4 badgers

Reverse Shell Detection with Machine Learning

Detection of Linux Malware C2 RedXOR - demonstration