{"id":13509034,"url":"https://github.com/0xN3utr0n/Kanis","last_synced_at":"2025-03-30T13:31:18.945Z","repository":{"id":144365634,"uuid":"253626026","full_name":"0xN3utr0n/Kanis","owner":"0xN3utr0n","description":"Advanced threat detection solution for Linux.","archived":false,"fork":false,"pushed_at":"2020-12-05T23:07:51.000Z","size":155,"stargazers_count":35,"open_issues_count":0,"forks_count":4,"subscribers_count":3,"default_branch":"master","last_synced_at":"2024-08-02T02:13:16.580Z","etag":null,"topics":["antivirus","container-security","containers","docker","endpoint-security","ids","linux","malware","rootkit","threat-detection","yara","yara-scanner"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/0xN3utr0n.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2020-04-06T22:03:37.000Z","updated_at":"2024-03-23T05:48:43.000Z","dependencies_parsed_at":"2023-04-28T21:36:47.033Z","dependency_job_id":null,"html_url":"https://github.com/0xN3utr0n/Kanis","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xN3utr0n%2FKanis","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xN3utr0n%2FKanis/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xN3utr0n%2FKanis/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xN3utr0n%2FKanis/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/0xN3utr0n","download_url":"https://codeload.github.com/0xN3utr0n/Kanis/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":222552311,"owners_count":17002039,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["antivirus","container-security","containers","docker","endpoint-security","ids","linux","malware","rootkit","threat-detection","yara","yara-scanner"],"created_at":"2024-08-01T02:01:02.064Z","updated_at":"2024-11-01T09:30:18.288Z","avatar_url":"https://github.com/0xN3utr0n.png","language":"Go","funding_links":[],"categories":["Go","malware"],"sub_categories":[],"readme":"# Kanis\n[![Go Report Card](https://goreportcard.com/badge/github.com/0xN3utr0n/Kanis)](https://goreportcard.com/report/github.com/0xN3utr0n/Kanis)\n\nKanis is an advanced threat detection solution exclusively designed for Linux with performance and simplicity in mind. Runs locally \"out-of-the-box\" (even on ancient systems) along with a powerful engine, mainly based on heuristic and behavioral analysis, for event and anomaly correlation.\n\n### Features\n- Real-time binary monitoring.\n- Container monitoring.\n- Kernel event monitoring.\n- ELF Viruses/Trojans detection.\n- ELF anti-debugging techniques detection.\n- Process injection detection.\n- Rootkits detection (_In progress_).\n- Yara integration.\n- And much more... :)\n\n### How it works\nAs an event-driven software, Kanis requires real-time interaction with the kernel; this is achieved through [ftrace](https://www.kernel.org/doc/Documentation/trace/ftrace.txt) and the use of [Kprobes](https://www.kernel.org/doc/Documentation/kprobes.txt), as well as [Tracepoints](https://www.kernel.org/doc/Documentation/trace/tracepoints.txt). That is, it can not only monitor syscalls, but any kernel function too. The rule engine is in charge of processing all this stream of information and make sense out of it. \n\nAdditionally, Kanis includes some modules for static heuristic analysis (such as for binaries) which further enhance the product's detection capabilities.\n\n### Requirements\n```\n- Linux \u003e=3.10 x86_64\n- Kernel compiled with CONFIG_FUNCTION_TRACER flag\n- Openssl (libssl-dev)\n- go \u003e=1.14\n```\n### Install\n```\ngit clone https://github.com/0xN3utr0n/Kanis \u0026\u0026 cd Kanis\nmake\nsudo make install\n```\n\n### Usage\nKanis requires root privileges in order to properly work.\n```\n  -h\tThis help.\n  -d\tShow debug messages (very verbose).\n  -e string\n    \tEnable kernel events monitoring.\n    \tSupported categories:\n    \ta ALL events.\n    \tx EXEC events.\n    \tm MOUNT events.\n    \ts SIGNAL events.\n    \tt TASK events.\n    \tp PTRACE events.\n    \tf FILE events.\n    \tn NAMESPACE events.\n    \t\n    \te.g. -e=x:t:n\n    \t\n  -s\tRedirect all output to stdout.\n```\nOnce executed, the following log files will be created (within `/var/kanis/`):\n- **events.log** : Real-time kernel events.\n- **kanis.log**  : Errors and Kanis related messages.\n- **threats.log** : Detected threats.\n\n### Disclaimer\nThe project is currently in pre-alpha state, meaning that there might be some instability issues along with low detection rates or even a high number of false-positives. \n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xN3utr0n%2FKanis","html_url":"https://awesome.ecosyste.ms/projects/github.com%2F0xN3utr0n%2FKanis","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xN3utr0n%2FKanis/lists"}