Alternatives and similar repositories for santa-linux

Users that are interested in santa-linux are comparing it to the libraries listed below

• nccgroup / insject
  insject is a tool for poking at containers. It enables you to run an arbitrary command in a container or any mix of Linux namespaces.
  ☆50Updated 3 years ago
• theevilbit / macos
  ☆31Updated 11 months ago
• immune-gmbh / tpm-vuln-checker
  Checks for tpm vulnerabilities
  ☆37Updated 2 years ago
• ald3ns / XPR-dump
  Helper scripts to automate the extraction of YARA rules from XProtectRemediators
  ☆20Updated last year
• 0xbf00 / macos-sandbox-coverage
  Tools to measure an app's App Sandbox usage
  ☆25Updated 5 years ago
• airbus-cert / dirtypipe-ebpf_detection
  An eBPF detection program for CVE-2022-0847
  ☆28Updated 2 years ago
• obelisk / endpointsecurity
  Nice (ish) bindings for the EndpointSecurity framework on macOS for Rust.
  ☆20Updated last year
• xorrior / xpcutil
  Golang Tool to interact with Launchd and other services with XPC
  ☆29Updated 5 years ago
• ForensicITGuy / libpreloadvaccine
  Whitelisting LD_PRELOAD libraries using LD_AUDIT
  ☆63Updated 3 years ago
• ancat / egrets
  egrets monitors egress
  ☆46Updated 5 years ago
• netspooky / notes
  ☆26Updated 2 years ago
• berthubert / sbox
  sandbox demo
  ☆11Updated last year
• ant4g0nist / crashmon
  crashmon - A LLDB Based replacement for CrashWrangler
  ☆46Updated last year
• milabs / lkrg-bypass
  LKRG bypass methods
  ☆72Updated 5 years ago
• ergot86 / itlb_poc
  iTLB multihit PoC
  ☆41Updated last year
• claesmnyberg / netfuzz
  Fuzz Network Traffic
  ☆18Updated 5 months ago
• JonathonReinhart / nosecmem
  Demonstrate ability to read memfd_secret() data from the kernel
  ☆58Updated last year
• usbarmory / armory-drive
  Armory Drive - USB encrypted drive with mobile unlock over BLE
  ☆54Updated last month
• objective-see / TAOMM
  The Art of Mac Malware
  ☆44Updated 2 months ago
• JacobPimental / r2-gohelper
  gopclntab finder and analyzer for Radare2
  ☆20Updated 4 years ago
• mcarmanize / esfriend
  A minimal malware analysis sandbox for macOS
  ☆29Updated 2 years ago
• buzzer-re / whoexec
  Discover which process execute a hunted binary inside macOS
  ☆24Updated 3 years ago
• redcanaryco / ebpfmon
  ☆88Updated 10 months ago
• impost0r / Rotten-Apples
  macOS codesigning translocation vulnerability.
  ☆42Updated 3 years ago
• c-skills / passport
  ☆23Updated 8 months ago
• slyd0g / SwiftParseTCC
  Use "Full Disk Access" permissions to read the contents of TCC.db and display it in human-readable format
  ☆39Updated 3 years ago
• WithSecureLabs / ESFang
  ESF modular ingestion tool for development and research.
  ☆35Updated 3 years ago
• taviso / scanlimits
  Tool to examine the behaviour of setuid binaries under constrained limits.
  ☆61Updated 4 years ago
• felipec / xz-min
  Minimal setup to trigger the xz backdoor
  ☆28Updated 7 months ago
• mdowd79 / presentations
  ☆77Updated 11 months ago