ehids-agent

English | 中文介绍 Introduction to eHIDS HIDS demo implemented by eBPF kernel technology. Warning Just a eBPF-based DEMO, please use Tetragon / Tracee / falco instead. Implementations & Functionalities： 1. TCP network data capture 2. UDP network data capture 3. DNS information capture in uprobe mode ...

WhacAMole

WhacAMole WhacAMole is a program that analyzes processes in memory in an integral way, detecting and alerting of anomalies related to malware and presenting and saving in files all the relevant information for verification, correlation or analysis, as well as dumping memory regions, processes and...

Ps-Tools

Ps-Tools, an advanced process monitoring toolkit for offensive operations. Having a good technical understanding of the systems we land on during an engagement is a key condition for deciding what is going to be the next step within an operation. Collecting and analysing data of running processes...

apiscope

ApiScope ApiScope is a Windows x64 research tool for tracing selected API calls in a new or running process. It follows DLL load events through the Windows debugger API and installs hooks before the debuggee continues from each event. Included hooks: ntdll.dll!NtCreateFile records the target path...

qsreplace

qsreplace Accept URLs on stdin, replace all query string values with a user-supplied value, only output each combination of query string parameters once per host and path. Usage Example input file: ▶ cat urls.txt https://example.com/path?one=1&two=2 https://example.com/path?two=2&one=1...

strace

strace - linux システムコールトレーサー これは strace です -- Linux 用の診断、デバッグ、教育向けユーザースペースユーティリティで、伝統的なコマンドラインインターフェースを備えています。プロセスと Linux カーネル間の相互作用（システムコール、シグナル配送、プロセス状態の変更など）を監視および操作するために使用されます。strace の動作は、ptrace として知られるカーネル機能によって可能になります。 strace は GNU Lesser General Public License バージョン 2.1 以降...

strace

strace - the linux syscall tracer This is strace -- a diagnostic, debugging and instructional userspace utility with a traditional command-line interface for Linux. It is used to monitor and tamper with interactions between processes and the Linux kernel, which include system calls, signal...

rustnet

RustNet English | 简体中文 | 日本語 RustNet is a terminal network monitor that shows live TCP, UDP, and QUIC connections with process attribution when available. It runs on Linux, macOS, Windows, and FreeBSD. Install On macOS or Linux with Homebrew: brew install rustnet Packet capture needs...

tarian

Tarian We want to maintain this as open-source to fight against the attacks on our favorite Kubernetes ecosystem. We can fight threats together as a community, by continuous contribution. Protect your Applications running on Kubernetes from malicious attacks by pre-registering your source code...

iMonitor

中文 Introduction iMonitor Endpoint Behavior Analysis System is a endpoint behavior monitoring and analysis software based on iMonitorSDK. Provides monitoring of system behaviors such as processes, files, registry, and networks. Support extensions and scripts, you can easily customize and add more...

thematrix

TheMatrix This project was created to ease the malware analysis process. The goal is to create an activator binary whose purpose is to load a user defined binary and monitor the execution by using Win32 API hooks. Relevant data is then saved to disk. The code supports both x86 and x64 binaries. D...

bandwhich

bandwhich これは、プロセス、接続、リモートIP/ホスト名別に現在のネットワーク使用状況を表示するCLIユーティリティです。 目次 bandwhich 目次 プロジェクトの状態 動作の仕組み インストール 下流パッケージのステータス プリビルドバイナリのダウンロード ソースからのビルド クロスコンパイル Android インストール後 Linux 1. setcap ケイパビリティの説明 2. sudo または代替 インストール後 Windows 使用方法 コントリビューション ライセンス プロジェクトの状態...

linux-smart-enumeration

まず、便利なワンライナーをいくつか紹介します ; wget "https://github.com/diego-treitos/linux-smart-enumeration/releases/latest/download/lse.sh" -O lse.sh;chmod 700 lse.sh curl "https://github.com/diego-treitos/linux-smart-enumeration/releases/latest/download/lse.sh" -Lo lse.sh;chmod 700 lse.sh バージョン 2.10 以降では、-S...

process-enumeration-stealth

🚴 process-enumeration-stealth 这是什么？ 这是一个简单的 PoC，它允许你通过查询 \ntfs\ 基础设备（Windows 文件系统基础对象）返回当前正在使用 NTFS 的 PID 列表。使用这种方法无需使用典型 API，如 NtQuerySystemInformation 或更高级的 EnumProcesses。使用这种非典型的侦察方法可以让操作者规避端点上的典型监控 🎉。感谢 Jonas Lyk 最初发现了这个技巧。 它是如何工作的？ 1. 使用 GENERICREAD | SYNCHRONIZE 获取 \ntfs\ 的句柄 2. 使用...

PyStat

PyStat - Advanced Netstat For Windows Compatible with Python Version 2.7 Features Know remote address of process Know remote ports of process Know which user using process along with title & PID Changelogs: Auto Install python modules support added in install.py Installation Guide: Download the...

KilledProcessCanary

Windows Killed Process Canary A Windows Service to detect if it has been shutdown and hibernate if multiple instances are. Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by Ollie Whitehouse, ollie dot whitehouse at nccgroup dot com...

Aegis aegis-v0.14.1-alpha

AEGIS Local monitoring and action review for AI agents AEGIS helps you see what local AI agents are doing, review agent files before use, and check policies for selected actions. Monitoring records processes, file activity, TCP endpoints and attribution evidence without requiring an agent plugin...

Securing the Sandbox: A Rootless Containerized Framework for Process-Oriented Monitoring in Computer Graphics Education

Computer Science education fundamentally depends on intensive laboratory hours to foster true programming mastery and logical reasoning. However, the widespread adoption of Generative Artificial Intelligence AI has made it virtually impossible to distinguish authentic student effort from instant ...

Linux Kernel FD-Race Monitoring

This C program is a defensive process-monitoring utility, not a privilege-escalation exploit. It continuously inspects /proc/pid/fd to detect suspicious activity related to excessive file descriptor usage, activity from sensitive SUID binaries, and potential file descriptor leakage or theft...

PT-2026-40970

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.81.0 Description A denial-of-service DoS issue exists in the gRPC Launcher "PublishLogs" endpoint. Certain unexpected input values are not handled gracefully, which can cause the server process to terminate while...