Repository Index

Cloud Native Runtime Security

• cncf
• containers
• security
• falco

eBPF-based Security Observability and Runtime Enforcement

• bpf
• ebpf
• kernel
• kubernetes

Linux Runtime Security and Forensics using eBPF

• ebpf
• linux
• bpf
• security

A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.

• backdoor
• ebpf
• kernel
• rootkit

ebpfkit is a rootkit powered by eBPF

• ebpf
• security
• rootkit
• linux

Real-time network monitor + outbound firewall — see & block every connection. Privacy-first, local-first, Rust fleet agent, SIEM exports, 8 languages. / Moniteur réseau temps réel + pare-feu sortant, agent de flotte Rust, exports SIEM. 100 % local.

• cybersecurity
• d3js
• electron
• fastapi

Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.

• blue-team
• detection-engineering
• edr
• endpoint-detection

Sigma Rules Engine inside the Linux Kernel using eBPF. Focusing on prevention capabilities

• ebpf
• security
• linux-kernel
• linux-security-module

bpflock - eBPF driven security for locking and auditing Linux machines

• bpf
• ebpf
• security
• lsm

ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits

• linux
• security
• kernel
• rootkit

eBPF Information Flow Enforcement for AI Agent safety, security and effectiveness

• ebpf
• harness
• ifc
• policy-engine

An EBPF based IPv4/IPv6 firewall with integrations for OpenZiti Zero-Trust Framework edge-routers and tunnellers

• ebpf
• ebpf-tc
• firewall
• ipv4

eBPF Security Monitoring and Sandboxing Agent Based on Aya

• aya
• bpf
• ebpf
• security

🛡️ Free AI that blocks hackers while you sleep. Runs on cheap hardware. When someone in Tokyo gets attacked, you're protected in 30 seconds. No fees. No experts needed. Just protection. One node's detection → everyone's protection.

• ai-security
• cybersecurity
• ids
• iot-security

Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.

• bpf
• ebpf
• forensics
• golang

Open-source eBPF compatibility evidence and CI gate

• bpf
• ci
• compatibility
• ebpf

A modular Linux telemetry engine built with eBPF, libbpf CO-RE, and Modern C++ that captures kernel-level process, file, syscall, and network events through a portable event-processing pipeline for decoding, enrichment, filtering, and structured output—forming the foundation for higher-level runtime intelligence.

• cpp20
• ebpf
• event-logger
• filesystem

Advanced eBPF-driven Digital Forensics and Incident Response (DFIR) framework for live Golang malware analysis, threat hunting, and observability.

• bpf
• ebpf
• forensics
• goroutine