memguard

MemGuard Software enclave for storage of sensitive information in memory. This package attempts to reduce the likelihood of sensitive data being exposed when in memory. It aims to support all major operating systems and is written in pure Go. Features Sensitive data is encrypted and authenticated...

fim-ebpf

FIM-eBPF: eBPFによるファイル完全性監視 Linux上でファイル作成および変更イベントを監視する軽量なeBPFプログラムです。このツールはeBPF（Extended Berkeley Packet Filter）を活用して、カーネルから直接ファイル操作をトレースし、最小限のオーバーヘッドで高性能な監視を提供します。 機能 カーネルレベルの監視 : カーネルから直接ファイル操作（touch、nanoなど）をトレースします。 CO-RE対応 : 対応するカーネル（Kernel 5.x以降）上でCompile Once – Run Everywhere CO-RE...

mcpguard-dynamic

MCPGuard-Dynamic Model Context Protocol MCP を通じて行われる LLM エージェントのツール呼び出しに対するカーネルレベルのサンドボックス化。 MCPGuard は MCP クライアント エージェント / ランナー と MCP サーバーサブプロセスの間に透過プロキシとして位置し、すべてのツール呼び出しに対して 3 層の防御を適用します。最下層は eBPF で実装され、システムコール境界でケイパビリティポリシーを強制するため、悪意のある MCP サーバーが自身の実装内に機密性の高い動作をハードコードしてポリシーを回避することはできません。...

rosemary

Rosemary クロスプラットフォームのカーネルレベルピボットプラットフォーム（QUIC 経由）。TUN/TAP 不要。proxychains 不要。プロキシ設定不要。 Rosemary はリモートホスト上のトラフィックをカーネルレベルで透過的に傍受します。プロキシ設定、TUN/TAP デバイス、proxychains は一切不要です。エージェントは QUIC 経由でサーバーに接続します。あたかも直接ネットワークにいるかのように、リモートネットワーク全体に到達できます。 目次 仕組み 機能 対応プラットフォーム スクリーンショット クイックスタート PowerShell エージェント...

psc

psc psc ps container는 eBPF 반복자와 Google CEL을 사용하여 시스템 상태를 정밀하게 조회하고 완전한 컨테이너 컨텍스트를 제공하는 빠른 프로세스 스캐너입니다. 왜 psc인가? eBPF 반복자를 통한 빠른 커널 수준 액세스 psc는 eBPF 반복자를 사용하여 커널 데이터 구조에서 직접 프로세스 및 파일 디스크립터 정보를 읽습니다. 이 접근 방식은: 빠름 : eBPF 반복자는 기존 도구가 대부분의 시간을 시스템 호출 실행에 소비하는 proc 파일 시스템에 비해 매우 효율적입니다. 완전함 : 전통적으로...

CVE-2026-19569

An integer overflow vulnerability exists in the Zephyr RTOS kernel's dynamic_object_create() function within kernel/userspace/userspace.c. The system fails to check for unsigned wrap-around when computing backing allocations for dynamically allocated kernel objects and thread stack elements. An u...

KernelFlirt

KernelFlirt OllyDbg/IDA Pro スタイルのインターフェースを備えた Windows カーネルレベルのデバッガ。VM 環境 VMware でのセキュリティ研究、リバースエンジニアリング、マルウェア解析向けに設計されています。 アーキテクチャ Host machine VM Windows 10, testsigning ┌──────────────────┐ TCP:31337 ┌──────────────────┐ IOCTL ┌──────────────────┐ │ KernelFlirt UI │◄───────────────►│ KfRelay.e...

Step-by-Step Malware Development: Evading EDR from Loaders to the Kernel

These are the workshop materials for "Step-by-Step Malware Development: Evading EDR from Loaders to the Kernel", presented at DEF CON 34 and BSidesLV 2026. This workshop explores custom malware development, EDR Architecture and Evasion, C2 customization, and kernel-level techniques using Elastic...

Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot

Check Point Research has disclosed a technique that uses Microsoft Defender's own legitimately signed boot-time remediation driver to perform arbitrary kernel-level file and registry operations on Windows systems ranging from Windows 7 through Windows 11 25H2, with no software flaw exploited and ...

CVE-2026-9492: Exposed IOCTL with Insufficient Access Control

The MBStorage DRAM lighting control module within Gigabyte Control Center GCC developed by GIGABYTE Technology has an Improper Access Control vulnerability. Authenticated local attackers can send specific IOCTL commands through the driver MyPortIOx64.sys bundled with the module, thereby arbitrari...

Rosemary 1.2.0

Rosemary is a cross-platform transparent tunneling platform designed for network pivoting. Unlike traditional tools that rely on TUN/TAP interfaces or require per-application proxy configuration like proxychains, Rosemary intercepts traffic at the kernel level...

protection

🛡️ protection Kernel-level abuse protection for container...

CVE-2025-47407

Memory corruption while creating a process on the digital signal processor due to allocation failure at the kernel level...

CVE-2025-47407

Memory corruption while creating a process on the digital signal processor due to allocation failure at the kernel level...

Rosemary 1.0.3

Rosemary is a cross-platform transparent tunneling platform designed for network pivoting. Unlike traditional tools that rely on TUN/TAP interfaces or require per-application proxy configuration like proxychains, Rosemary intercepts traffic at the kernel level...

Rosemary 1.0.1

Rosemary is a cross-platform transparent tunneling platform designed for network pivoting. Unlike traditional tools that rely on TUN/TAP interfaces or require per-application proxy configuration like proxychains, Rosemary intercepts traffic at the kernel level...

Hiding in the Tunnels: Unmasking the New Stealthy BPFDoor Variants

This is Rapid7's whitepaper discussing BPFDoor variants. Advanced persistent threats APTs are locked in a continuous arms race with network defenders. As static indicators of compromise IoCs for the notorious BPFDoor malware became widely deployed by security vendors, the threat actors went back ...

SPARK: Secure Predictive Autoscaling for Robust Kubernetes

Achieving high availability and robust security in Kubernetes requires more than reactive scaling and standard perimeter firewalls. Traditional autoscalers, such as HPA, often fail to react quickly to traffic spikes and cannot distinguish between legitimate flash crowds and DDoS attacks. We prese...

Exploit for CVE-2023-52271

Disclaimer: This repository contains code that is provided stric...

CVE-2021-47789: Stack-based Buffer Overflow

Yenkee Hornet Gaming Mouse driver GM312Fltr.sys contains a buffer overrun vulnerability that allows attackers to crash the system by sending oversized input. Attackers can exploit the driver by sending a 2000-byte buffer through DeviceIoControl to trigger a kernel-level system crash...