Search Results for "malicious"

...With osquery, SQL tables represent abstract concepts such as running processes, loaded kernel modules, open network connections, browser plugins, hardware events or file hashes.Osquery queries your devices like a database. Osquery uses basic SQL commands to leverage a relational data-model to describe a device. Frequently, attackers will leave a malicious process running but delete the original binary on disk. This query returns any process whose original binary has been deleted, which could be an indicator of a suspicious process.

HLBR is an IPS (Intrusion Prevention System) that can filter packets in the OSI layer 2. Detection of malicious traffic is done by rules. It can even be used as bridge to honeypots. The HLBR is a firewall element and can use regular expressions. Warning: this project was discontinued and should not be used in production networks. There are several bugs.

Tiny program to make a memory snapshot of a running process and also to print out some meta information like open file descriptors and used sockets. Useful for dumping malicious programs or live forensic.

Hogwash is an inline packet scrubber that uses Snort's (www.snort.org) detection engine to drop malicious packets before they reach the target machine.