Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

Cloud Native Runtime Security

Linux Runtime Security and Forensics using eBPF

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.

ebpfkit is a rootkit powered by eBPF

OWASP iGoat (Swift) - A Damn Vulnerable Swift Application for iOS

Hades is a Host-Based Intrusion Detection System based on eBPF(mainly)

Deep Linux runtime visibility meets Wireshark

ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits

🐝 BPFBox 📦 Exploring process confinement in eBPF

Protect your Cloud Native Applications running on Kubernetes from malicious attacks with pre-registered source code, pre-registered runtime processes monitoring, automated actions based on configure-actions, analytics, alerting and also sharing detections with community. Maybe save from Ransomware. Shift-Left your threat detection. Shift Right t…

Community curated list of System and Network policy templates for the KubeArmor and Cilium

Kubernetes offensive framework built in eBPF

eBPF Security Monitoring Agent Based on Aya

PyRASP is a Runtime Application Self Protection package for Python-based Web Servers (Flask, FastAPI and Django), Serverless Functions (AWS Lambda, Azure and Google Cloud Functions) and MCP Servers (FastMCP)

Linux based vulnerabilities (CVE) exploit detection through runtime security using Falco/Osquery/Yara/Sigma

Proactive security monitoring and threat detection in CI/CD

Ansible playbooks to provision firecracker VMs and run Falco kernel tests

Jibril: A performant and low impact Linux runtime security tool agent.

A Minecraft client injection platform with in-environment JVM object resolution against obfuscation.