Skip to content

Commit 0f35234

Browse files
Update README.md
1 parent 2321165 commit 0f35234

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

README.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@
22
Linux-based vulnerabilities (CVE) exploit detection through runtime security using Falco/Osquery/Yara/Rego/Sigma
33

44
This is an experimental project to evaluate possible ways to detect exploits (CVE) in a Linux environment (HOST/Container/Cloud) using
5-
- `ebpf` based - Falco Runtime Security
6-
- Analytic + Memory based - Osquery + Yara
7-
- Policy based - Rego + OPA/Tracee
8-
- Log based - Sigma
5+
- `ebpf` based - [Falco Runtime Security](https://falco.org/)
6+
- Analytic + Memory based - [Osquery](https://www.osquery.io/) + [Yara](http://virustotal.github.io/yara/)
7+
- Policy based - [Rego + OPA](https://www.openpolicyagent.org/docs/latest/policy-language/)/ [Aquasec-Tracee](https://github.com/aquasecurity/tracee)
8+
- Log based - [Sigma](https://github.com/SigmaHQ/sigma)
99

1010
We were able to detect the majority of the exploits through `ebpf` or `kprobe` instrumentation by analyzing the syscalls. Both `Falco` and `Rego` approaches worked accurately in Host & Containerized environments. However, there are a few limitations in all of the above approaches, stay tuned - the blog coming out soon.
1111

0 commit comments

Comments
 (0)