Alternatives and similar repositories for knockles

Users that are interested in knockles are comparing it to the libraries listed below

• evilsocket / ebpf-process-anomaly-detection
  Process behaviour anomaly detection using eBPF and unsupervised-learning Autoencoders
  ☆131Updated 2 years ago
• citronneur / pamspy
  Credentials Dumper for Linux using eBPF
  ☆1,136Updated 8 months ago
• h2337 / modreveal
  Utility to find hidden Linux kernel modules
  ☆144Updated 5 months ago
• Gui774ume / ssh-probe
  monitor and protect SSH sessions with eBPF
  ☆69Updated 3 years ago
• quarkslab / peetch
  An eBPF playground
  ☆206Updated last year
• hackerschoice / zapper
  Zaps arguments and environment from the process list
  ☆198Updated last year
• armosec / curing
  io_uring based rootkit
  ☆181Updated 3 weeks ago
• exein-io / kepler
  NIST-based CVE lookup store and API powered by Rust.
  ☆131Updated last week
• Gui774ume / ebpfkit-monitor
  ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits
  ☆131Updated 2 years ago
• redcanaryco / oxidebpf
  A Rust library for managing eBPF programs.
  ☆120Updated last year
• redcanaryco / redcanary-ebpf-sensor
  Red Canary's eBPF Sensor
  ☆106Updated this week
• redcanaryco / ebpfmon
  ☆88Updated 10 months ago
• liamg / siphon
  Intercept stdin/stdout/stderr for any process
  ☆198Updated 2 years ago
• adgaultier / tamanoir
  An eBPF🐝 Keylogger with C2-based RCE payload delivery
  ☆259Updated this week
• linux-lock / bpflock
  bpflock - eBPF driven security for locking and auditing Linux machines
  ☆147Updated 3 years ago
• Gui774ume / ebpfkit
  ebpfkit is a rootkit powered by eBPF
  ☆794Updated 2 years ago
• c-grimshaw / gosniff
  A fancy-schmancy tcpdump-esque TUI, programmed in Go.
  ☆367Updated 3 years ago
• TimeToogo / remote-pty
  Tricking shells into interactive mode when local PTY's are not available
  ☆145Updated 2 years ago
• synacktiv / shh
  Systemd Hardening Helper - Mirror of https://github.com/desbma/shh
  ☆123Updated last week
• harporoeder / ebpfsnitch
  Linux Application Level Firewall based on eBPF and NFQUEUE.
  ☆699Updated last year
• hackerschoice / bpfhacks
  eBPF hacks
  ☆187Updated 5 months ago
• SkyperTHC / curlshell
  reverse shell using curl
  ☆206Updated 2 months ago
• airbus-cert / dirtypipe-ebpf_detection
  An eBPF detection program for CVE-2022-0847
  ☆28Updated 2 years ago
• exein-io / pulsar
  A modular and blazing fast runtime security tool for the IoT, powered by eBPF.
  ☆948Updated this week
• BishopFox / asminject
  Heavily-modified fork of David Buchanan's dlinject project. Injects arbitrary assembly (or precompiled binary) payloads directly into x86…
  ☆130Updated 2 years ago
• nnsee / fileless-elf-exec
  Execute ELF files without dropping them on disk
  ☆491Updated 10 months ago
• winterknife / PINKPANTHER
  Windows x64 handcrafted token stealing kernel-mode shellcode
  ☆508Updated last year
• hardenedvault / ved-ebpf
  VED-eBPF: Kernel Exploit and Rootkit Detection using eBPF
  ☆156Updated 8 months ago
• pathtofile / bad-bpf
  A collection of eBPF programs demonstrating bad behavior, presented at DEF CON 29
  ☆610Updated 10 months ago
• poettering / diskomator
  🦠 NVMe-TCP at your fingertips 🦠
  ☆306Updated 3 months ago