Alternatives
Products that do what DriverShield does
Free kernel driver vulnerability & malware analysis
- 1MS
I noticed the growing security concerns around MCP (https://news.ycombinator.com/item?id=43600192) and built an open source tool that can detect several patterns of tool poisoning attacks, exfiltration channels and cross-origin manipulations. MCP-Shield scans your installed servers (Cursor, Claude Desktop, etc.) and shows what each tool is trying to do at the instruction level, beyond just the API surface. It catches hidden instructions that try to read sensitive files, shadow other tools' behavior, or exfiltrate data. Example of what it detects: - Hidden instructions…
2025 · github.com
- 2SA
Hi all, I'm excited to announce Stratoshark, a sibling application to Wireshark that lets you capture and analyze process activity (system calls) and log messages in the same way that Wireshark lets you capture and analyze network packets. If you would like to try it out you can download installers for Windows and macOS and source code for all platforms at https://stratoshark.org. AMA: I'm the goofball whose name is at the top of the "About" box in both applications, and I'll be happy to answer any questions you might have.
2025 · stratoshark.org
- 3TL
Hi HN, I spent the past year building this in my spare time because I got tired of enterprise security tools that cost $50K/year and don't understand Linux. TheProtector is a comprehensive security monitoring tool that actually runs on the systems we use (Linux) instead of being a Windows-first afterthought. Built it entirely on a $500 laptop because I believe good security shouldn't require unlimited budgets. Features: - Real-time process, network, and file monitoring - YARA malware detection with custom rules - eBPF kernel monitoring (when available) - Behavioral baseline…
2025 · github.com
- 4
- 5
- 6
- 7
- 8MM
This project contains no code from Linux, BSD, Minix, or any other OS. Everything up until this point is written entirely from scratch, including a pure microkernel (that only implements multiprocessor priority scheduling, memory management, and interprocess communication), a work-in-progress implementation of the standard C library, and a variety of servers that provide drivers and other essential OS functionality. At the time of writing this post, the servers provide drivers for the keyboard, NVMe SSDs (that works on real hardware), a Unix-like virtual file system (with a single root…
2024 · github.com
- 9PS
What PII-Shield does: It's a K8s sidecar (or CLI tool) that pipes application logs, detects secrets using Shannon entropy (catching unknown keys like "sk-live-..." without predefined patterns), and redacts them deterministically using HMAC. Why deterministic? So that "pass123" always hashes to the same "[HIDDEN:a1b2c]", allowing QA/Devs to correlate errors without seeing the raw data. Key features: 1. JSON Integrity: It parses JSON, sanitizes values, and rebuilds it. It guarantees valid JSON output for your SIEM (ELK/Datadog). 2. Entropy Detection: Uses context-aware entropy…
Feb 2026 · github.com
- 10SA
I've been working on this for ~3 months now, with pretty slow progress to be honest. So far I've got an ATA PIO mode hard disk driver, a FAT32 file system, a real time clock driver, and of course the essentials (interrupts, keyboard, pixel graphics). Kernel panics also cause a blue screen of death xD. It uses a bitmap physical memory allocator, and I'm fixing some issues with paging at the moment as a work towards running userspace applications. I'd be interested to see your thoughts on it :D
2024 · github.com
- 11VD
Did you know that VSCode extensions run with full access to your system—including file system, network, and credentials? Worse, dozens of malicious extensions have already made it into the marketplace, silently compromising devices. I am a security researcher and student developer who ran into this problem myself. To help tackle this, I built a 100% free tool (no login required) that scans VSCode (and Cursor/Windsurf) extensions for: - Hidden malware and obfuscated code - Dangerous permissions and API misuse - Vulnerable dependencies and suspicious network connections Users have already…
2025 · vscan.dev
- 12
- 13
- 14DT
We are super excited to release the community edition of our product to help DevSecOps teams -- Deepfence ThreatMapper ! Deepfence is a unified platform to protect kubernetes, virtual machines and serverless workloads at runtime. We have packaged a subset of important features of the platform in this edition. Essentially, you can visualize kubernetes clusters, virtual machines and container images in real time and scan them for vulnerabilities. You can also scan an unlimited number of container images by integrating with popular registries. This community edition comes with batteries…
2020
- 15
- 16IB
2021 · log4shell.tools
- 17IB
I built a GitHub app that detects it in pull requests, notifies or blocks them. Alongside it, I published a Semgrep ruleset for any stage of the CI/CD. I started this after getting frustrated by all the FUD around malicious code - lots of noise, little effort to solve it. Having said that, it's still a major attack vector - a stored RCE, with the codebase itself as the sink. Feedback is appreciated. The app, PRevent - https://github.com/apiiro/PRevent The ruleset: https://github.com/apiiro/malicious-code-ruleset The research:…
2025 · github.com
- 18JR
Jibril is a runtime security monitoring and enforcement tool. It introduces a new architecture designed to overcome limitations of previous-generation runtime security tooling and EDRs, which were primarily built for traditional endpoints and long-running containerized workloads. Jibril introduces an event-less architecture leveraging eBPF to maintain lightweight state maps directly within the kernel. Instead of buffering events, it queries kernel state directly, enabling real-time detection and enforcement with minimal overhead. This approach is especially effective for protecting ephemeral…
2025 · garnet.ai
- 19VN
If you are worried about the recent Lazarus group software supply chain attack, you should consider having guard rails that is more than conventional SCA. `vet` detects the package (version) published in the report as malware. Try out vet, its free and open source: https://github.com/safedep/vet More details on the attack: https://www.nodejs-security.com/blog/north-korea-malware-on-...
2023 · github.com
- 20
- 21IB
Linux Foundation survey says 70-90% of modern software constitute OSS code. Yet we are stuck with tools that scan only for vulnerabilities in 3rd party libraries and that too with high degree of false positives. I built `vet` for policy and data driven analysis of 3rd party packages that goes beyond only vulnerability and allows codifying organisational policies related to OSS consumption. https://github.com/safedep/vet Looking forward to feedback and suggestions from HN :)
2023 · github.com
- 22DI
I built an open-source malware detection daemon that monitors all running processes in real-time using ML + heuristics. No kernel modules or eBPF required. Key points: - Polls /proc for new processes (works on any Linux kernel 2.6+) - Random Forest model trained on EMBER 2018 dataset (2.3M samples) - Heuristic rules for crypto miners, ransomware, rootkits - ~20MB RAM, <1% CPU, sub-millisecond scan latency - Pure C, zero runtime dependencies - Model embedded directly in binary (50KB) Why I built this: Existing solutions either require modern kernels (eBPF) or are heavy/proprietary.…
Nov 2025 · github.com
- 23PY
Hello HN, my name is Varun, and I am the co-founder of StepSecurity. Here is the backstory about Harden-Runner. We thoroughly researched past software supply chain security incidents. The devastating breaches of SolarWinds, Codecov, and others, have one thing in common – they attacked the CI/ CD pipeline or the build server. These incidents made it clear that a purpose-built security agent was needed for CI/ CD. While there are numerous agents available for desktops and servers, such as from CrowdStrike and Lacework, none have been tailored specifically to address the unique risks…
2023 · github.com
- 24RP
https://github.com/akoerner/kprox/blob/master/img/combat_tit... https://github.com/akoerner/kprox/raw/master/img/combat_loss... KProx is a HID (mouse + keyboard) automation firmware targeted at the M5Stack Cardputer, Cardputer Adv, and the M5Stack Atom S3. It features a DSL similar to DuckScript, an API with a web interface, and KeePass KDBX 3.1 database support for an onboard credential store via the nvme or SD card. Additionally, it includes a plethora of HID "apps," such as psCombatProx: kill processes by…
Mar 2026 · github.com
Ranked by how close each launch is in meaning, then by votes. Refine with a description →