psc

psc psc ps container is a fast process scanner that uses eBPF iterators and Google CEL to query system state with precision and full container context. Why psc? Fast Kernel-Level Access with eBPF Iterators psc uses eBPF iterators to read process and file descriptor information directly from kerne...

memguard

MemGuard Software enclave for storage of sensitive information in memory. This package attempts to reduce the likelihood of sensitive data being exposed when in memory. It aims to support all major operating systems and is written in pure Go. Features Sensitive data is encrypted and authenticated...

mcpguard-dynamic

MCPGuard-Dynamic Kernel-level sandboxing for LLM agent tool calls made through the Model Context Protocol MCP. MCPGuard sits as a transparent proxy between an MCP client the agent / runner and an MCP server subprocess, applying three layered defenses to every tool invocation. The lowest layer is...

rosemary

Rosemary Plataforma de pivoteo a nivel de kernel multiplataforma sobre QUIC. Sin TUN/TAP. Sin proxychains. Sin configuración de proxy. Rosemary intercepta de forma transparente el tráfico en hosts remotos a nivel de kernel: sin configuración de proxy, sin dispositivos TUN/TAP, sin proxychains. Lo...

fim-ebpf

FIM-eBPF: File Integrity Monitoring with eBPF A lightweight eBPF program to monitor file creation and modification events on Linux. This tool leverages eBPF Extended Berkeley Packet Filter to trace file operations directly from the kernel, providing high-performance monitoring with minimal...

KernelFlirt

KernelFlirt Depurador a nivel de kernel de Windows con una interfaz estilo OllyDbg/IDA Pro. Diseñado para investigación de seguridad, ingeniería inversa y análisis de malware en entornos de VM VMware. Arquitectura Host machine VM Windows 10, testsigning ┌──────────────────┐ TCP:31337...

CVE-2026-9492: Exposed IOCTL with Insufficient Access Control

The MBStorage DRAM lighting control module within Gigabyte Control Center GCC developed by GIGABYTE Technology has an Improper Access Control vulnerability. Authenticated local attackers can send specific IOCTL commands through the driver MyPortIOx64.sys bundled with the module, thereby arbitrari...

CVE-2025-47407

Memory corruption while creating a process on the digital signal processor due to allocation failure at the kernel level...

CVE-2025-47407

Memory corruption while creating a process on the digital signal processor due to allocation failure at the kernel level...

Rosemary 1.0.3

Rosemary is a cross-platform transparent tunneling platform designed for network pivoting. Unlike traditional tools that rely on TUN/TAP interfaces or require per-application proxy configuration like proxychains, Rosemary intercepts traffic at the kernel level...

Rosemary 1.0.1

Rosemary is a cross-platform transparent tunneling platform designed for network pivoting. Unlike traditional tools that rely on TUN/TAP interfaces or require per-application proxy configuration like proxychains, Rosemary intercepts traffic at the kernel level...

Hiding in the Tunnels: Unmasking the New Stealthy BPFDoor Variants

This is Rapid7's whitepaper discussing BPFDoor variants. Advanced persistent threats APTs are locked in a continuous arms race with network defenders. As static indicators of compromise IoCs for the notorious BPFDoor malware became widely deployed by security vendors, the threat actors went back ...

SPARK: Secure Predictive Autoscaling for Robust Kubernetes

Achieving high availability and robust security in Kubernetes requires more than reactive scaling and standard perimeter firewalls. Traditional autoscalers, such as HPA, often fail to react quickly to traffic spikes and cannot distinguish between legitimate flash crowds and DDoS attacks. We prese...

Exploit for CVE-2023-52271

Disclaimer: This repository contains code that is provided stric...

CVE-2021-47789: Stack-based Buffer Overflow

Yenkee Hornet Gaming Mouse driver GM312Fltr.sys contains a buffer overrun vulnerability that allows attackers to crash the system by sending oversized input. Attackers can exploit the driver by sending a 2000-byte buffer through DeviceIoControl to trigger a kernel-level system crash...

CVE-2025-36922

In bigomap of bigoiommu.c, there is a possible information disclosure due to a use after free. This could lead to local escalation of privilege in the OS Kernel level with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-30185

Summary : CVE-2025-30185 is an Intel UEFI reference-platform issue where active debugging code in Ring 0 could allow denial of service and privilege escalation. A system software adversary with privileged access and low attack complexity, via local access and without user interaction, could alter...

EUVD-2016-9914

Malware in sbrugna...

The vulnerability of the kernel-level driver nvlddmkm.sys from NVIDIA’s graphics processing units, including GeForce, Quadro, NVS, and Tesla, allows attackers to cause system failures or gain unauthorized access to protected information.

The vulnerability of the kernel mode driver nvlddmkm.sys of NVIDIA’s graphics processing units, including GeForce, Quadro, NVS, and Tesla, relates to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause system failures or gain unauthorized...

How ToddyCat tried to hide behind AV software

To hide their activity in infected systems, APT groups resort to various techniques to bypass defenses. Most of these techniques are well known and detectable by both EPP solutions and EDR threat-monitoring and response tools. For example, to hide their activity in Windows systems, cybercriminals...