GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → SitinCloud → Owlyshield

SitinCloud / Owlyshield

Licence: EUPL-1.2 license
Owlyshield is an EDR framework designed to safeguard vulnerable applications from potential exploitation (C&C, exfiltration and impact))..

Programming Languages

rust
11053 projects
C++
36643 projects - #6 most used programming language
c
50402 projects - #5 most used programming language
Inno Setup
370 projects

Labels

machine-learningmalwarecybersecurityransomwareantivirusthreat-huntingmalware-analysismalware-researchbehavior-analysisimpactexfiltrationcommand-and-controledr

Projects that are alternatives of or similar to Owlyshield

Malice
VirusTotal Wanna Be - Now with 100% more Hipster
Stars: ✭ 1,253 (+345.91%)
Mutual labels:  malware, cybersecurity, antivirus, malware-analysis, malware-research
Malware Feed
Bringing you the best of the worst files on the Internet.
Stars: ✭ 69 (-75.44%)
Mutual labels:  malware, cybersecurity, threat-hunting, malware-analysis, malware-research
Malware-Sample-Sources
Malware Sample Sources
Stars: ✭ 214 (-23.84%)
Mutual labels:  malware, cybersecurity, threat-hunting, malware-analysis, malware-research
Multiscanner
Modular file scanning/analysis framework
Stars: ✭ 494 (+75.8%)
Mutual labels:  malware, antivirus, malware-analysis, malware-research
Osweep
Don't Just Search OSINT. Sweep It.
Stars: ✭ 225 (-19.93%)
Mutual labels:  cybersecurity, ransomware, threat-hunting, malware-analysis
Malware-Zoo
Hashes of infamous malware
Stars: ✭ 18 (-93.59%)
Mutual labels:  malware, cybersecurity, malware-analysis, malware-research
awesome-executable-packing
A curated list of awesome resources related to executable packing
Stars: ✭ 720 (+156.23%)
Mutual labels:  malware, cybersecurity, malware-analysis, malware-research
Threat Hunting
Personal compilation of APT malware from whitepaper releases, documents and own research
Stars: ✭ 219 (-22.06%)
Mutual labels:  malware, threat-hunting, malware-analysis, malware-research
MalwareDatabase
One of the few malware collection
Stars: ✭ 37 (-86.83%)
Mutual labels:  malware, ransomware, malware-analysis, malware-research
Malware-Machine-Learning
Malware Machine Learning
Stars: ✭ 26 (-90.75%)
Mutual labels:  malware, cybersecurity, malware-analysis, malware-research
MalwareHashDB
Malware hashes for open source projects.
Stars: ✭ 31 (-88.97%)
Mutual labels:  malware, antivirus, malware-analysis, malware-research
Dex Oracle
A pattern based Dalvik deobfuscator which uses limited execution to improve semantic analysis
Stars: ✭ 398 (+41.64%)
Mutual labels:  malware, malware-analysis, malware-research
Antidebugging
A collection of c++ programs that demonstrate common ways to detect the presence of an attached debugger.
Stars: ✭ 161 (-42.7%)
Mutual labels:  malware, malware-analysis, malware-research
Fcl
FCL (Fileless Command Lines) - Known command lines of fileless malicious executions
Stars: ✭ 409 (+45.55%)
Mutual labels:  malware, threat-hunting, malware-analysis
Engine
Droidefense: Advance Android Malware Analysis Framework
Stars: ✭ 386 (+37.37%)
Mutual labels:  malware, ransomware, malware-analysis
Wdbgark
WinDBG Anti-RootKit Extension
Stars: ✭ 450 (+60.14%)
Mutual labels:  malware, malware-analysis, malware-research
Linux.mirai
Leaked Linux.Mirai Source Code for Research/IoC Development Purposes
Stars: ✭ 466 (+65.84%)
Mutual labels:  malware, malware-analysis, malware-research
Fame
FAME Automates Malware Evaluation
Stars: ✭ 663 (+135.94%)
Mutual labels:  malware, malware-analysis, malware-research
Drakvuf Sandbox
DRAKVUF Sandbox - automated hypervisor-level malware analysis system
Stars: ✭ 384 (+36.65%)
Mutual labels:  malware, malware-analysis, malware-research
Malware Samples
A collection of malware samples and relevant dissection information, most probably referenced from http://blog.inquest.net
Stars: ✭ 565 (+101.07%)
Mutual labels:  malware, malware-analysis, malware-research
View All Similar Projects ➔

Translations (obsolete):

Logo

Owlyshield

An AI antivirus written in Rust

🧪 Access training data · 📖 Read the technical doc · 💬 Request Feature

⏩ TL;DR

Owlyshield is an open-source EDR (Endpoint Detection and Response) solution for Linux and Windows servers. It analyzes how processes use files to detect intrusions through vulnerability exploitation, with a particular focus on detecting Command and Control, exfiltration and impact tactics. The project is developed by SitinCloud, a French company.

The main idea behind Owlyshield is to learn the normal behavior of applications (essentially trees of processes) and use this knowledge to identify weak signals of an attack through the use of novelty detection.

❓ An EDR Framework...

Owlyshield's extensibility is a key feature that sets it apart from other EDR solutions. As a framework you can add new algorithms for malware detection, UEBA (User and Entity Behavior Analytics), and novelty detection. You can also use Owlyshield to record and replay file activities for training machine learning models, as we do with our autoencoder feature.

Owlyshield provides powerful and efficient endpoint detection and response capabilities for Linux, Windows, and IoT devices. Its unique focus on file activities makes it highly effective at detecting fileless malware and C&C beacons that may go unnoticed by other EDR solutions.

(back to top)

☑️ ...that's comes with pre-built features

Although Owlyshield is a framework designed to be customized and extended, it also comes with pre-built, powerful features that are immediately usable :

  • Advanced novelty detection with autoencoders (commercial version),
  • Ransomware protection in real-time on Windows using XGBoost,
  • Novelty detection with embedded training on both Linux (+IoT) and Windows,
  • Auto-configuration of SELinux to automatically protect exposed applications.

Gif Demo Owlyshield

(back to top)

🙈 Real-Life Examples

Owlyshield provides a powerful solution for detecting and responding to threats in real-time. Here are three real-life examples of how Owlyshield protected our customers:

  • An attacker exploited a critical CVE in an ESXi server to deploy a payload. Owlyshield detected weak signals of the attack on the ESXi server by analyzing the file activities and identifying unusual behavior in the ESXi process family, indicating the presence of a malicious process.
  • A web application built with JHipster had a hidden URL that could be used to dump the JVM memory, but the infrastructure team was not aware of this vulnerability. Owlyshield was able to detect it was exploited by analyzing the file system for unusual activity related to creating the dump file,
  • A large and expensive ERP system was accessed by teams of consultants from different countries. One of them, with admin rights, began to slowly corrupt specific files in the ERP system. The attacker used this tactic to make the corruption look like a series of bugs or glitches rather than a deliberate attack.

(back to top)

▶️ 2 minutes install

Installation instructions for Owlyshield can be found in the Releases section of the project's GitHub repository. For usage instructions, please refer to the project's Wiki or see the Contributing section if you prefer to build Owlyshield yourself.

(back to top)

🤑 Business

↗️ Free vs Pro editions

The Pro Edition (commercial edition) includes the following features:

  • Integration with Wazuh,
  • Nice local interfaces for end users,
  • Scheduled tasks to automatically update the application.

Within the scope of free version usage, we will do our best to help you find a solution for any issues you may encounter. However, we prioritize support for subscribers to our commercial version and valued added resellers.

💰 Business model

While our products and services can be purchased directly from us (feel free to contact us for a quotation that meets your needs), we believe that it is best for our products to be distributed to end customers indirectly.

Please contact us if you:

  • Want to become a distribution partner or use our products as an MSSP – we are open to such partnerships.
  • Want to integrate Owlyshield as part of your own EDR/XDR system – we will be happy to provide the best proposal for the appropriate level of professional services to do so.
  • Need to protect your critical enterprise servers against crafted attacks or progressive wipers – we can introduce you to our brand-new novelty detection engine based on encoders AI tools (Owlyshield Enterprise Edition).
  • Have any questions or would like a presentation of our products.

(back to top)

🦾 Contributing

We offer free access to the Owlyshield Pro Edition to our contributors.

If you discover an undetected ransomware, please open an issue with the tag "undetected" to help us improve the AI engine and understand the new techniques used to avoid detection.

If you have suggestions on how to improve Owlyshield, you can fork the repository and create a pull request or simply open an issue with the tag "enhancement".

Don't forget to give the project a ⭐! Thank you for your contributions.

To contribute:

  1. Fork the project.
  2. Create a feature branch: git checkout -b feature/AmazingFeature.
  3. Commit your changes: git commit -m 'Add some AmazingFeature'.
  4. Push to the branch: git push origin feature/AmazingFeature.
  5. Open a pull request.

(back to top)

📖 License

Distributed under the EUPL v1.2 license. See LICENSE.txt for more information.

(back to top)

💌 Contact

Damien LESCOS - @DamienLescos

Project Link: https://github.com/SitinCloud/Owlyshield/

Company Link: SitinCloud

(back to top)

🙏 Acknowledgments

(back to top)

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].