Furtex

Furtex Post-exploitation and evasion research toolkit for Linux, built around iouring and eBPF. No liburing, no frameworks, raw syscalls throughout. More tools soon. PRs are welcome. 🇧🇷 Join in Rootkit Researchers https://discord.gg/66N5ZQppU7 For authorized research and red team engagements only...

agent

Bomfather Agent Bomfather Agent is an eBPF-based agent that runs in the kernel space to block actions based on a policy. We built this agent to solve the problems we had with existing solutions. 1. They were too complex to set up and use. 2. They were too slow and inefficient. 3. And even if they...

phantom-grid

Phantom Grid - Enterprise Zero Trust Network Access ZTNA Phantom Grid is a next-generation Zero Trust Network Access ZTNA and active defense system. It operates at both the Kernel Level eBPF and Application Level mTLS to transform Linux servers into a robust, deceptive attack surface. Built for...

CVE-2026-31431-mitigation

CVE-2026-31431-mitigation This repository holds the source code for our eBPF-based mitigation against CVE-2026-31431, also known as "copy.fail". More info available at https://copy.fail The motivation behind building this solution was to fulfill the need for a reboot-less mitigation for...

linnix

Linnix Find which process is hurting your SLOs — not just who's using CPU, but who's causing stalls. The Problem top shows 80% CPU. Prometheus shows high latency. But which pod is actually stalling your payment service? Linnix uses eBPF + PSI Pressure Stall Information to answer this. PSI measure...

SPiCa

SPiCa System Process Integrity & Cross-view Analysis "I'm going to sing, so shine bright, SPiCa..." SPiCa is an eBPF-based Linux rootkit detector written in Rust. The name comes from the Hatsune Miku song SPiCa and the star it references — Spica Alpha Virginis, the brightest point in Virgo. What...

CVE-2017-16995

Vulnerability Description Ubuntu is an open-source GNU/Linux operating system primarily used on desktops, based on Debian GNU/Linux. Recently, a white hat hacker disclosed a local privilege escalation vulnerability in the latest version of Ubuntu Ubuntu 16.04, with vulnerability ID CVE-2017-16995...

jailer

Jailer - eBPF Mandatory Access Control Warning : This project is under heavy development and is NOT ready for production use. APIs, policy formats, and behavior may change without notice. Use for testing and experimentation only. Acknowledgments Note : This is an independent implementation and is...

logira

logira OS-level runtime auditing for unpredictable automation. logira is an observe-only Linux CLI that records runtime exec, file, and net events via eBPF. It helps you see what actually happened during AI agent runs and other forms of automation, with per-run local storage for auditing, post-ru...

snoop

snoop A syscall tracer for Linux, built on eBPF. Like strace but with a live TUI, smart filters, and argument decoding you can actually read. $ sudo snoop curl https://example.com 0.001 curl1234/1234 openatATFDCWD, "/etc/ssl/certs/ca-certificates.crt", ORDONLY = 4 0.002 curl1234/1234 read4,...

buzzer

Buzzer - An eBPF Fuzzer toolchain Buzzer is a fuzzer toolchain that allows to write eBPF fuzzing strategies. A Fuzzing strategy is a way to generate random eBPF Programs and then validate that they don't have unexpected behaviour. To run the fuzzer follow the next steps 1. Install bazel. 2. Insta...

ebpfmon

ebpfmon ebpfmon is a tool for monitoring eBPF programs. It is designed to be used with bpftool from the linux kernel. ebpfmon is a TUI terminal UI application written in Go that allows you to do real-time monitoring of eBPF programs. Installation eBPFmon can be built from source or there is a...

azazel

Azazel A lightweight eBPF-based runtime security tracer purpose-built for malware analysis sandboxes. Drop a sample into an isolated container, and Azazel captures every syscall, file touch, network connection, and suspicious behavior, then hands you a clean JSON stream of everything that happene...

krie

KRIe KRIe is a research project that aims to detect Linux Kernel exploits with eBPF. KRIe is far from being a bulletproof strategy: from eBPF related limitations to post exploitation detections that might rely on a compromised kernel to emit security events, it is clear that a motivated attacker...

AIOstack

AI agents always look authorized. AIOStack tells you when they're not. AI agents act on behalf of users. They use real credentials, make real API calls, invoke tools, access APIs, and touch production systems. Most security tools see this activity as legitimate because, technically, it is. The re...

vc5

VC5 This README is currently being updated to reflect recent changes - some information may not reflect the current codebase. This iteration of code is not yet battle ready - use a v0.2 release for production A horizontally scalable Direct Server Return DSR layer 4 load balancer L4LB for Linux...

sigwire

sigwire tail -f for signals. Every signal any process on the box raises — who sent it, who it hit, which signal, how it was raised kill2, the kernel, a POSIX timer, whether the target caught it and how long its handler ran, whether it tore a blocked syscall out with EINTR — decoded off the kernel...

bombini

Bombini: eBPF-based Security Monitoring and Sandboxing Agent Bombini is an eBPF-based security agent written entirely in Rust using the Aya library and built on LSM Linux Security Module BPF hooks. At its core, Bombini employs modular components called Detectors, each responsible for monitoring a...

netfence

Netfence Like Envoy xDS, but for eBPF filters. Netfence runs as a daemon on your VM/container hosts and automatically injects eBPF filter programs into cgroups and network interfaces, with a built-in DNS server that resolves allowed domains and populates the IP allowlist. Netfence daemons can be...

mcpguard-dynamic

MCPGuard-Dynamic Kernel-level sandboxing for LLM agent tool calls made through the Model Context Protocol MCP. MCPGuard sits as a transparent proxy between an MCP client the agent / runner and an MCP server subprocess, applying three layered defenses to every tool invocation. The lowest layer is...