Alternatives and similar repositories for knockles

Users that are interested in knockles are comparing it to the libraries listed below

• evilsocket / ebpf-process-anomaly-detection
  Process behaviour anomaly detection using eBPF and unsupervised-learning Autoencoders
  ☆131Updated 2 years ago
• krisnova / xpid
  Linux Process Discovery. C Library, Go bindings, Runtime.
  ☆221Updated 2 years ago
• Gui774ume / ssh-probe
  monitor and protect SSH sessions with eBPF
  ☆69Updated 3 years ago
• citronneur / pamspy
  Credentials Dumper for Linux using eBPF
  ☆1,138Updated 8 months ago
• quarkslab / peetch
  An eBPF playground
  ☆206Updated last year
• exein-io / kepler
  NIST-based CVE lookup store and API powered by Rust.
  ☆130Updated this week
• adgaultier / tamanoir
  An eBPF🐝 Keylogger with C2-based RCE payload delivery
  ☆268Updated 3 weeks ago
• h2337 / modreveal
  Utility to find hidden Linux kernel modules
  ☆144Updated 5 months ago
• hackerschoice / zapper
  Zaps arguments and environment from the process list
  ☆200Updated last year
• redcanaryco / ebpfmon
  ☆88Updated 11 months ago
• redcanaryco / redcanary-ebpf-sensor
  Red Canary's eBPF Sensor
  ☆107Updated 3 weeks ago
• armosec / curing
  io_uring based rootkit
  ☆197Updated last month
• c-grimshaw / gosniff
  A fancy-schmancy tcpdump-esque TUI, programmed in Go.
  ☆369Updated 3 years ago
• hackerschoice / bpfhacks
  eBPF hacks
  ☆187Updated 5 months ago
• hardenedvault / ved-ebpf
  VED-eBPF: Kernel Exploit and Rootkit Detection using eBPF
  ☆158Updated 9 months ago
• noisysockets / nsh
  The Noisy Sockets CLI
  ☆261Updated 8 months ago
• Gui774ume / ebpfkit-monitor
  ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits
  ☆131Updated 2 years ago
• synacktiv / io_uring_scanner
  io_uring based network scanner written in Rust
  ☆45Updated 2 years ago
• poettering / diskomator
  🦠 NVMe-TCP at your fingertips 🦠
  ☆307Updated 4 months ago
• kpcyrd / sh4d0wup
  Signing-key abuse and update exploitation framework
  ☆129Updated 2 weeks ago
• liamg / siphon
  Intercept stdin/stdout/stderr for any process
  ☆198Updated 2 years ago
• nnsee / fileless-elf-exec
  Execute ELF files without dropping them on disk
  ☆492Updated 11 months ago
• lkarlslund / fastsync
  Fast syncronization across networks using speedy compression, lots of parallelization and fast hashmaps for keeping track of things inter…
  ☆95Updated 10 months ago
• netfoundry / zfw
  An EBPF based IPv4/IPv6 firewall with integrations for OpenZiti Zero-Trust Framework edge-routers and tunnellers
  ☆57Updated this week
• rpetrich / callander
  Simple syscall sandboxing for Linux
  ☆133Updated last month
• jorisvink / sanctum
  Blessed sanctum, save us || Sanctum is a small, reviewable, capable, pq-safe and fully privilege seperated VPN daemon. || This is a read-…
  ☆72Updated this week
• linux-lock / bpflock
  bpflock - eBPF driven security for locking and auditing Linux machines
  ☆146Updated 3 years ago
• Gui774ume / krie
  Linux Kernel Runtime Integrity with eBPF
  ☆179Updated last year
• anvilsecure / ulexecve
  ulexecve is a userland execve() implementation which helps you execute arbitrary ELF binaries on Linux from userland without the binaries…
  ☆189Updated last year
• evanrolfe / trayce_agent
  ☆55Updated this week