securityonion
security-onion-solutions/securityonionOpen-source security monitoring platform for threat hunting, intrusion detection, log management, incident response, and endpoint visibility with…
anomaly-detectionanti-botdefensive-tools+9
4.9k
security-onion-solutions/securityonionOpen-source security monitoring platform for threat hunting, intrusion detection, log management, incident response, and endpoint visibility with…
spensercai/copy_failRust exploit PoC for Linux kernel LPE CVE-2026-31431 (AF_ALG page-cache write) plus eBPF runtime defense blocking AF_ALG socket creation via LSM or…
netblue30/firejailLinux namespaces and seccomp-bpf sandbox
cisagov/esxiargs-recoverA tool to recover from ESXiArgs ransomware
mirage/qubes-mirage-firewallMinimal unikernel firewall for QubesOS that filters network traffic, implements NAT, and communicates via Qubes DB and qrexec.
huzjie/aegisagentRuntime security gateway for AI agents: cryptographically attests tool calls, enforces policies, sandboxes execution, and logs tamper-evident audit…
dosx-dev/obfus.hMacro-header for compile-time C obfuscation (tcc, win x86/x64)
malwaretech/appcontainersandboxAn example sandbox using AppContainer (Windows 8+)
nccgroup/windowsjoblockWindows Process Lockdown Tool using Job Objects
zephrfish/ludus-defender-labMDE/MDI Defender setup for Ludus
wgnet/wg.copyfail.patcheBPF-based workaround for CVE-2026-31431 (Copy.Fail) that filters or kills AF_ALG socket creation to prevent local privilege escalation and container…
openedx/codejailSecure code execution
d4rksystem/vmwarecloakA PowerShell script that attempts to help malware analysts hide their VMware Windows VM's from malware that may be trying to evade analysis.
shoucheng3/graylog2__graylog2-server_cve-2023-41044_5-1-2Open source log management platform for centralized log aggregation, real-time analysis, and security event monitoring with customizable dashboards…
qubesos/qubes-core-adminManages the core lifecycle of Qubes OS domains via a Python admin API, handling secure compartmentalization with Xen and exposing an event system for…
vatson112/deny-af-alg-bpfeBPF LSM program that blocks AF_ALG socket creation to mitigate CVE-2026-31431, with userspace daemon logging denied attempts via ring buffer.
aarif450/zapscapeGuest-to-host KVM/x86 escape exploiting CVE-2026-64561, delivering a full PoC chain and analysis for security researchers.
withsecurelabs/amsidetectionProof-of-concept tool for detecting AMSI (Antimalware Scan Interface) bypasses and malicious in-memory script activity on Windows endpoints.