Linux Runtime Security and Forensics using eBPF
Repository Index
47,133 repositories indexed
1–8 of 8 · Most stars
Process-aware, eBPF-based tcpdump
- ebpf
- ebpf-tc
- tcpdump
- tcpdump-like
A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.
- cybersecurity
- incident-response
- sysinternals
- nirsoft
A Linux packet crafting tool.
- packet-crafting
- networking
- hacking-tool
- intrusion-prevention
inVtero.net: A high speed (Gbps) Forensics, Memory integrity & assurance. Includes offensive & defensive memory capabilities. Find/Extract processes, hypervisors (including nested) in memory dumps using microarchitechture independent Virtual Machiene Introspection techniques
- forensics
- hypervisor
- memory-dump
- reverse-engineering
Memory acquisition for Linux that makes sense.
Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.
Advanced eBPF-driven Digital Forensics and Incident Response (DFIR) framework for live Golang malware analysis, threat hunting, and observability.