Cloud Native Runtime Security
Repository Index
47,133 repositories indexed
1–20 of 20 · Most stars
eBPF-based Security Observability and Runtime Enforcement
Linux Runtime Security and Forensics using eBPF
A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.
ebpfkit is a rootkit powered by eBPF
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
- blue-team
- detection-engineering
- edr
- endpoint-detection
Framework for running BPF programs with rules on Linux as a daemon. Container aware.
TranslatedPacket monster (っ‘-’)╮=͟͟͞͞◒ ヽ( '-'ヽ) TUI tool for sending packets of arbitrary input and monitoring packets on any network interfaces (default: eth0). Windows/macOS/Linux
- packet-generator
- packet-analyzer
- network
- networking
Sigma Rules Engine inside the Linux Kernel using eBPF. Focusing on prevention capabilities
- ebpf
- security
- linux-kernel
- linux-security-module
🔍 Function-level tracing tool for Seccomp profiling, with eBPF
- ebpf
- ebpf-programs
- golang
- seccomp
bpflock - eBPF driven security for locking and auditing Linux machines
ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits
eBPF Information Flow Enforcement for AI Agent safety, security and effectiveness
- ebpf
- harness
- ifc
- policy-engine
An EBPF based IPv4/IPv6 firewall with integrations for OpenZiti Zero-Trust Framework edge-routers and tunnellers
eBPF Security Monitoring and Sandboxing Agent Based on Aya
🛡️ Free AI that blocks hackers while you sleep. Runs on cheap hardware. When someone in Tokyo gets attacked, you're protected in 30 seconds. No fees. No experts needed. Just protection. One node's detection → everyone's protection.
- ai-security
- cybersecurity
- ids
- iot-security
Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.
Open-source eBPF compatibility evidence and CI gate
A modular Linux telemetry engine built with eBPF, libbpf CO-RE, and Modern C++ that captures kernel-level process, file, syscall, and network events through a portable event-processing pipeline for decoding, enrichment, filtering, and structured output—forming the foundation for higher-level runtime intelligence.
- cpp20
- ebpf
- event-logger
- filesystem
Advanced eBPF-driven Digital Forensics and Incident Response (DFIR) framework for live Golang malware analysis, threat hunting, and observability.