red-detector

Red-Detector Descrizione Scansiona la tua istanza EC2 per trovare vulnerabilità utilizzando Vuls https://vuls.io/en/. Controlla la tua istanza EC2 per individuare configurazioni di sicurezza errate utilizzando Lynis https://cisofy.com/solutions/lynis. Scansiona la tua istanza EC2 alla ricerca di...

ModTracer

ModTracer v1.0 ModTracer findet versteckte Linux-Kernel-Rootkits und macht sie wieder sichtbar. Eine weitere Möglichkeit, ein LKM sichtbar zu machen, ist der Imperius-Trick: https://github.com/MatheuZSecurity/Imperius Tritt der Rootkit-Forscher-Gruppe bei https://discord.gg/66N5ZQppU7...

security checks

🔍 Miner Hunter Krypto-Miner-Erkennung, -Entfernung und Härtungstoolkit für Linux-Server. Entwickelt aus realen Vorfallreaktionen – erkennt Miner, die sich mit Rootkit-Techniken vor ps, top, htop und btop verstecken. 📦 Installation root@kitploit: git clone...

tyton

Tyton Dieses Projekt ist nun archiviert Linux-Kernel-Mode-Rootkit-Jäger für 4.4.0-31+. Weitere Informationen finden Sie auf Tyton's Website. Erkannte Angriffe Versteckte Module Syscall-Tabellen-Hooking Netzwerkprotokoll-Hooking Netfilter-Hooking Gelöschte Prozess-Inodes Prozess-Fops-Hooking...

sandfly-entropyscan

Cos'è sandfly-entropyscan? sandfly-entropyscan è un'utilità per scansionare rapidamente file o processi in esecuzione e riportare la loro entropia misura di casualità e se sono eseguibili di tipo ELF Linux/Unix. Alcuni malware per Linux sono impacchettati o crittografati e mostrano un'entropia...

ved-ebpf

VED-eBPF: Kernel Exploit and Rootkit Detection using eBPF VED Vault Exploit Defense-eBPF leverages eBPF extended Berkeley Packet Filter to implement runtime kernel security monitoring and exploit detection for Linux systems. Introduction eBPF is an in-kernel virtual machine that allows code...

ved-ebpf

VED-eBPF: Kernel-Exploit- und Rootkit-Erkennung mit eBPF VED Vault Exploit Defense-eBPF nutzt eBPF Extended Berkeley Packet Filter, um Runtime-Kernel-Sicherheitsüberwachung und Exploit-Erkennung für Linux-Systeme zu implementieren. Einleitung eBPF ist eine In-Kernel-Virtuelle-Maschine, die die...

LinuxCheck

LinuxCheck Strumento per la risposta alle emergenze Linux / raccolta informazioni / rilevamento vulnerabilità. Supporta oltre 70 controlli in 13 categorie: configurazione di base, traffico di rete, pianificazione attività, variabili d'ambiente, informazioni utente, servizi, bash, file malevoli,...

red-detector

Red-Detector Description Scan your EC2 instance to find its vulnerabilities using Vuls https://vuls.io/en/. Audit your EC2 instance to find security misconfigurations using Lynis https://cisofy.com/solutions/lynis. Scan your EC2 instance for signs of a rootkit using Chkrootkit...

tyton

Tyton This Project Is Now Archived Linux Kernel-Mode Rootkit Hunter for 4.4.0-31+. For more information, visit Tyton's website. Detected Attacks Hidden Modules Syscall Table Hooking Network Protocol Hooking Netfilter Hooking Zeroed Process Inodes Process Fops Hooking Interrupt Descriptor Table...

sandfly-entropyscan

What is sandfly-entropyscan? sandfly-entropyscan is a utility to quickly scan files or running processes and report on their entropy measure of randomness and if they are a Linux/Unix ELF type executable. Some malware for Linux is packed or encrypted and shows very high entropy. This tool can...

ksentinel

ksentinel - Monitor di Integrità delle Syscall del Kernel Panoramica ksentinel monitora le funzioni critiche del kernel e la tabella delle syscall per rilevare modifiche non autorizzate. Rileva syscall comuni che sono bersaglio della maggior parte dei rootkit, inclusi hook ftrace, kprobe e...

SeqShield: A Behavioral Analysis Approach to Uncover Rootkits

Rootkits are among the most elusive types of malware, capable of bypassing traditional static analysis methods due to their metamorphic behavior. Signature-based detection techniques struggle against these threats, necessitating a shift toward dynamic analysis approaches. We propose SeqShield, a...

On Drovorub: Linux Kernel Security Best Practices | McAfee Blogs

ARCHIVED STORY On Drovorub: Linux Kernel Security Best Practices By ATR Operational Intelligence Team/b · AUG 13, 2020 Intro In a U.S. government cyber security advisory released today, the National Security Agency and Federal Bureau of Investigation warn of a previously undisclosed piece of Linu...

Kernel-Mode Rootkit Hunter: Tyton

Loadable kernel modules, LKMs for short, are an integral companion to the Linux kernel. Typically, LKMs are used to add support for new hardware as device drivers or file systems or add additional system calls. Without LKMs, an operating system would have to include all possible anticipated...

September 5, 2017 – Morning Cyber Coffee Headlines – “The Office” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! September 5, 2017 - Headlines Carbon Black in the News: Carbon Black’s Cb Defen...

Open-Source Host-Based Intrusion Detection System: OSSEC

OSSEC is a platform to monitor and control your systems. It mixes together all the aspects of HIDS host-based intrusion detection, log monitoring, and Security Incident Management SIM/Security Information and Event Management SIEM together in a simple, powerful, and open source solution. Key...

Host Based Intrusion Detection System: Samhain

The Samhain host-based intrusion detection system HIDS provides file integrity checking and log file monitoring/analysis, as well as rootkit detection, port monitoring, detection of rogue SUID executables, and hidden processes. samhain is a file and host integrity and intrusion alert system...

SAMHAIN v3.1.2 - File Integrity Checker / Host-Based Intrusion Detection System

The Samhain host-based intrusion detection system HIDS provides file integrity checking and log file monitoring/analysis , as well as rootkit detection, port monitoring, detection of rogue SUID executables, and hidden processes. Samhain been designed to monitor multiple hosts with potentially...

[SAMHAIN v3.0.11 & BELTANE v2.4.6] Host-based intrusion detection system (HIDS)

The Samhain host-based intrusion detection system HIDS provides file integrity checking and log file monitoring/analysis , as well as rootkit detection, port monitoring, detection of rogue SUID executables, and hidden processes. Samhain been designed to monitor multiple hosts with potentially...