Alternatives and similar repositories for knockles:

Users that are interested in knockles are comparing it to the libraries listed below

• krisnova / xpid
  Linux Process Discovery. C Library, Go bindings, Runtime.
  ☆220Updated 2 years ago
• evilsocket / ebpf-process-anomaly-detection
  Process behaviour anomaly detection using eBPF and unsupervised-learning Autoencoders
  ☆130Updated 2 years ago
• citronneur / pamspy
  Credentials Dumper for Linux using eBPF
  ☆1,129Updated 4 months ago
• quarkslab / peetch
  An eBPF playground
  ☆201Updated last year
• Gui774ume / ssh-probe
  monitor and protect SSH sessions with eBPF
  ☆66Updated 3 years ago
• exein-io / kepler
  NIST-based CVE lookup store and API powered by Rust.
  ☆128Updated 3 months ago
• h2337 / modreveal
  Utility to find hidden Linux kernel modules
  ☆145Updated last month
• TimeToogo / remote-pty
  Tricking shells into interactive mode when local PTY's are not available
  ☆143Updated 2 years ago
• redcanaryco / redcanary-ebpf-sensor
  Red Canary's eBPF Sensor
  ☆101Updated 6 months ago
• redcanaryco / oxidebpf
  A Rust library for managing eBPF programs.
  ☆116Updated 11 months ago
• system-transparency / stboot
  Paused mirror. Official repository at https://git.glasklar.is/system-transparency/core/stboot
  ☆111Updated last year
• anvilsecure / ulexecve
  ulexecve is a userland execve() implementation which helps you execute arbitrary ELF binaries on Linux from userland without the binaries…
  ☆183Updated last year
• redcanaryco / ebpfmon
  ☆85Updated 6 months ago
• poettering / diskomator
  🦠 NVMe-TCP at your fingertips 🦠
  ☆295Updated 8 months ago
• Gui774ume / ebpfkit
  ebpfkit is a rootkit powered by eBPF
  ☆775Updated last year
• c-grimshaw / gosniff
  A fancy-schmancy tcpdump-esque TUI, programmed in Go.
  ☆368Updated 2 years ago
• hardenedvault / ved-ebpf
  VED-eBPF: Kernel Exploit and Rootkit Detection using eBPF
  ☆154Updated 4 months ago
• hackerschoice / zapper
  Zaps arguments and environment from the process list
  ☆192Updated 9 months ago
• nnsee / fileless-elf-exec
  Execute ELF files without dropping them on disk
  ☆487Updated 7 months ago
• guardicore / IPCDump
  ☆245Updated 3 years ago
• liamg / siphon
  Intercept stdin/stdout/stderr for any process
  ☆198Updated 2 years ago
• hackerschoice / bpfhacks
  eBPF hacks
  ☆181Updated last month
• jorisvink / sanctum
  Blessed sanctum, save us || Sanctum is a small, reviewable, capable and fully privilege seperated VPN daemon. || This is a read-only mirr…
  ☆46Updated 3 weeks ago
• evanrolfe / trayce_agent
  ☆52Updated 3 weeks ago
• liamg / grace
  It's strace, with colours.
  ☆271Updated 2 years ago
• aidansteele / ipv6-ghost-ship
  Silly usage of AWS EC2 IPv6 prefixes
  ☆321Updated 3 years ago
• airbus-cert / dirtypipe-ebpf_detection
  An eBPF detection program for CVE-2022-0847
  ☆28Updated 2 years ago
• tarsal-oss / kflowd
  Kernel-based Process Monitoring on Linux Endpoints for File System, TCP and UDP Networking Events and optionally DNS, HTTP and SYSLOG App…
  ☆56Updated this week
• winterknife / PINKPANTHER
  Windows x64 handcrafted token stealing kernel-mode shellcode
  ☆504Updated 9 months ago
• noisysockets / nsh
  The Noisy Sockets CLI
  ☆254Updated 4 months ago