awesome-linux-attack-forensics-purplelabs

यह पृष्ठ उन्नत Linux हमलों, डिटेक्शन और फोरेंसिक तकनीकों और उपकरणों के आसपास चल रहे प्रैक्टिकल शोध का परिणाम है।

चूंकि मैं वर्षों से रेड बनाम ब्लू दृष्टिकोण का अभ्यास कर रहा हूँ, नीचे दी गई सामग्री आपको Linux/Kubernetes आक्रामक/डिटेक्शन/DFIR के दायरे में परियोजनाओं, तकनीकों और रणनीतियों की संख्या का पैमाना देखने की अनुमति देगी।

ये सभी आक्रामक तकनीकें और उपकरण मेरे द्वारा स्वयं परीक्षण किए गए हैं (सोर्स कोड विश्लेषण सहित), विभिन्न परतों (होस्ट/नेटवर्क) द्वारा पहचाने गए हैं, और छोटे प्रैक्टिकल लैब परिदृश्यों में मैप किए गए हैं, जो अंततः PurpleLabs Playground (https://edu.defensive-security.com/) का हिस्सा बन गए हैं।

यदि आप एक संपूर्ण वर्कशॉप/प्रशिक्षण कार्यक्रम की तलाश में हैं, तो नीचे दिए गए लिंक अद्वितीय "Linux Attack and Live Forensics At Scale" (https://edu.defensive-security.com/linux-attack-live-forensics-at-scale) प्रशिक्षण कार्यक्रम के मूल हैं। यह एक फ्रेमवर्क के रूप में एक गतिशील वर्कशॉप कार्यक्रम बनाने का पहला कदम है, जहाँ आप कस्टम TTPS के पूरे सेट के साथ एक साथ Linux हमलावर, डिटेक्शन इंजीनियर और फोरेंसिकेटर की भूमिका निभा सकते हैं! यह दृष्टिकोण कस्टम अटैक पाथ, डिटेक्शन इंजीनियरिंग और लाइव फोरेंसिक सहित इंसिडेंट रिस्पॉन्स चरणों के निर्माण की भी अनुमति देगा।

पर्पल टीमिंग फॉर लाइफ!

ओपन सोर्स SOC / IR

https://github.com/Cyb3rWard0g/HELK

https://github.com/Graylog2/graylog2-server

https://github.com/Velocidex/velociraptor

https://docs.velociraptor.app/exchange/

https://github.com/wazuh/wazuh

https://github.com/robcowart/elastiflow

https://github.com/arkime/arkime

https://github.com/osquery/osquery

https://github.com/TheHive-Project/TheHive

https://github.com/TheHive-Project/Cortex

https://github.com/Shuffle/Shuffle

https://github.com/dfir-iris/iris-web

https://github.com/MISP/MISP

https://jupyter.org/

https://github.com/OISF/suricata

https://github.com/zeek/zeek

https://github.com/SecurityRiskAdvisors/VECTR

https://github.com/archanchoudhury/SOC-OpenSource

Linux और Kubernetes डिटेक्शन / फोरेंसिक्स

https://github.com/sandflysecurity

https://github.com/lkrg-org/lkrg

https://github.com/Sysinternals/SysmonForLinux

https://github.com/volatilityfoundation/volatility

https://github.com/volatilityfoundation/community3

https://github.com/k1nd0ne/VolWeb

https://github.com/pathtofile/bpf-hookdetect

https://github.com/Exein-io/pulsar

https://github.com/ntop/libebpfflow

https://github.com/ehids/ehids-agent

https://github.com/falcosecurity/falco

https://github.com/aquasecurity/tracee

https://github.com/draios/sysdig

https://github.com/cilium/tetragon

https://github.com/gamemann/XDP-Firewall

https://github.com/linuxthor/rkbreaker

https://github.com/therealdreg/lsrootkit

https://github.com/linuxthor/rkspotter

https://github.com/kkamagui/shadow-box-for-x86

http://www.chkrootkit.org/

https://github.com/octarinesec/kube-scan

Linux कर्नेल स्पेस रूटकिट्स

https://github.com/lukasbalazik123/1337kit

https://github.com/f0rb1dd3n/Reptile

https://github.com/carloslack/KoviD

https://github.com/vkobel/linux-syscall-hook-rootkit

https://github.com/h3xduck/TripleCross

https://github.com/amir9339/ebpf_maps_hooking

https://github.com/milabs/kopycat

https://github.com/m0nad/Diamorphine

https://github.com/stdhu/kernel-inline-hook

https://github.com/ilammy/ftrace-hook

https://github.com/WeiJiLab/kernel-hook-framework

https://github.com/C24IO/Netfilter-Hooks-Simple.git

https://github.com/shubham0d/Immutable-file-linux

https://github.com/therealdreg/enyelkm

https://github.com/m0nad/Diamorphine

https://github.com/elfmaster/kprobe_rootkit

https://github.com/En14c/LilyOfTheValley

https://github.com/QuokkaLight/rkduck

https://github.com/a7vinx/liinux

https://github.com/mgrube/DragonKing

https://github.com/aidielse/Rootkits-Playground

https://github.com/cccssw/JynKbeast

https://github.com/hanj4096/wukong

https://github.com/mponcet/subversive

https://github.com/h3xduck/Umbra

https://github.com/ruckuus/kernel-abuse/tree/master/kbeast

https://github.com/CDuPlooy/Rootkit

https://github.com/jussihi/SMM-Rootkit

https://github.com/nnedkov/swiss_army_rootkit

https://github.com/spiderpig1297/kprochide

https://github.com/pathtofile/bad-bpf

https://github.com/cloudflare/ebpf_exporter

https://github.com/DavadDi/bpf_study

https://github.com/Esonhugh/sshd_backdoor

https://github.com/vrasneur/randkit

https://github.com/ricardomaraschini/ebpf-signals

https://github.com/bones-codes/the_colonel

https://github.com/PinkP4nther/Sutekh

https://github.com/spiderpig1297/kfile-over-icmp

https://github.com/dave4422/linux_rootkit

https://github.com/nurupo/rootkit

https://github.com/Nadharm/CoVirt

https://github.com/3intermute/loonix_syscall_hook

https://github.com/alfonmga/hiding-cryptominers-linux-rootkit

https://github.com/loneicewolf/linux-rootkits

https://github.com/yasindce1998/KubeDagger

https://github.com/loneicewolf/EXEC_LKM

https://github.com/deurzen/linux-rootkit

https://github.com/roggenbrot42/rkptum2013

https://github.com/DanielAvinoam/TheSubZeroProject

https://github.com/jermeyyy/rooty

https://github.com/NoviceLive/research-rootkit

https://github.com/aesophor/satan

https://github.com/Pratik32/linux_rkit

https://github.com/AlirezaChegini/kernel-based-keylogger-for-Linux

https://github.com/jordan9001/superhide

https://github.com/nccgroup/ebpf/tree/master/conjob

https://github.com/FlamingSpork/iptable_evil

https://github.com/ilee38/root-of-all-evil

https://github.com/milabs/lkrg-bypass

Linux यूज़र स्पेस रूटकिट्स / इंजेक्टर्स

https://github.com/ldpreload/Medusa

https://github.com/arget13/DDexec

https://github.com/mav8557/Father

https://github.com/yasukata/zpoline

https://github.com/dsnezhkov/zombieant

https://github.com/ulexec/SHELF-Loading

https://github.com/chokepoint/Jynx2

https://github.com/unix-thrust/beurk

https://github.com/cloudsec/brootkit

https://github.com/trimpsyw/adore-ng

https://github.com/rvillordo/libpreload

https://github.com/r00tkillah/HORSEPILL

https://github.com/elfmaster/skeksi_virus

https://github.com/elfmaster/linker_preloading_virus

https://github.com/nopn0p/rkorova

https://github.com/amir9339/Tcpdump-evasion

https://github.com/Paradoxis/PHP-Backdoor

https://github.com/ixty/mandibule

https://github.com/DavidBuchanan314/dlinject

https://github.com/guitmz/memrun

Linux C2 / अटैक इम्यूलेशन

https://github.com/BishopFox/sliver

https://github.com/facebookincubator/WEASEL

https://github.com/cyberark/kubesploit

https://github.com/controlplaneio/simulator

https://github.com/iagox86/dnscat2

https://github.com/rapid7/metasploit-framework

पुस्तकें / PDFS / DOCS

https://dl.acm.org/doi/fullHtml/10.1145/3545948.3545980 - Katana: Linux मेमोरी स्नैपशॉट्स का रोबस्ट, स्वचालित, केवल-बाइनरी फोरेंसिक विश्लेषण

https://www.crysys.hu/publications/files/setit/thesis_bme_Nemeth20bsc.pdf - एम्बेडेड IoT उपकरणों पर लगातार रूटकिट घटकों का पता लगाना

https://raw.githubusercontent.com/h3xduck/TripleCross/master/docs/ebpf_offensive_rootkit_tfg.pdf - eBPF की आक्रामक क्षमताओं का विश्लेषण और रूटकिट का कार्यान्वयन

https://github.com/NinnOgTonic/Out-of-Sight-Out-of-Mind-Rootkit/blob/master/osom.pdf - Out-of-Sight-Out-of-Mind-Rootkit

https://pentera.io/blog/the-good-bad-and-compromisable-aspects-of-linux-ebpf/

https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf

https://vblocalhost.com/uploads/VB2021-Mechtinger-Kennedy.pdf

https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Fixing-A-Memory-Forensics-Blind-Spot-Linux-Kernel-Tracing-wp.pdf

https://i.blackhat.com/USA-20/Wednesday/us-20-Livelli-Decade-Of-The-RATs-Custom-Chinese-Linux-Rootkits-For-Everyone.pdf

https://www.vanbastelaer.com/publication/sabpf/sabpf.pdf

https://cormander.com/wp-content/uploads/2017/04/Distribution-Kernel-Security-Hardening.pdf

https://bibis.ir/science-books/information-technology/security/2022/Security-Observability-with-eBPF-by-Jed-Salazar_bibis.ir.pdf

https://isovalent.com/data/isovalent_security_observability.pdf

https://cs.brown.edu/~vpk/papers/ret2dir.sec14.pdf

https://www.iij.ad.jp/en/dev/iir/pdf/iir_vol45_focus_EN.pdf