引擎名称:K-WATCH 引擎供应商:火绒 Matrix 矩阵启发式 基于深度学习和大数据的启发式查杀技术,通过对海量样本的分析训练,详细分析恶意样本的分布规律而得到超强的病毒检出率。 Matrix即使一个月不更新病毒库检出率也不会下降,误报率< 0.1‰。 Alchemy 样本行为分析 ...
服务端管理规则随着插件下发,HadesSvc.exe解析规则写入内核. 支持规则热更新(Hboat下发). 开发中预计v2.4之前全部完成。 白名单模式:启动规则后(不包含已存在进程),只允许白名单定义的规则操作。 黑名单模式:启动规则后(不包含已存在进程),不允许黑名单定义的规则操作。 进程黑白名单模式(内核规则匹配) { // 1...
"时间","进程名","PID","操作","路径","结果","详细信息" "21:31:32.7487660","Lab10-01.exe","2472","Process Start","","SUCCESS","Parent PID: 1796, Command line: ""C:\Documents and Settings\Administrator\桌面\lab\Lab10-01.exe"" , Current directory: C:\Documents and Settings\Admin...
watchdog.sys, 51: wavemsp.dll, 52: wbcache.deu, 53: wbcache.enu, 54: wbcache.esn, 55: wbcache.fra, 56: wbcache.ita, 57: wbcache.nld, 58: wbcache.sve, 59: wbdbase.deu, 60: wbdbase.enu, 61: wbdbase.esn, 62: wbdbase.fra, 63: wbdbase.ita, 64: wbdbase.nld, 65: wb...
-d Runningindaemon mode. -s [HOST] AoiAWD Probe IP.Default:127.0.0.1-p [PORT] AoiAWD ProbePORT.Default:8023-w [PATH] Inotify watch dir, ';' as divider.Default: /tmp -i [MSECOND]Processwatch interval.Default:100-h This help info...
-s [HOST] AoiAWD Probe IP. Default: 127.0.0.1 -p [PORT] AoiAWD Probe PORT. Default: 8023 -w [PATH] Inotify watch dir, ';' as divider. Default: /tmp -i [MSECOND] Process watch interval. Default: 100 -h This help info About AoiAWD-为CTFer准备的EDR,是AWD比赛利器 Resources Readme...
Tailmon-EDR是一款Linux服务器安全防护软件,旨在帮助企业及个人站长构建网络安全监测与防御体系。主要功能包括:网络攻击防护、病毒查杀、漏洞检测、恶意进程监控、应用资产管理等。
RoundWorm: AoiAWD Filesystem & Process Monitor Tool Usage: ./roundworm [OPTIONS] -d Running in daemon mode. -s [HOST] AoiAWD Probe IP. Default: 127.0.0.1 -p [PORT] AoiAWD Probe PORT. Default: 8023 -w [PATH] Inotify watch dir, ';' as divider. Default: /tmp -i [MSECOND] Process ...
We are looking for an application that attempts to load DLL’s from “unsafe paths” at runtime, typically in the same directory or a statically set directory that is user-land accessible. Fire up some applications of your choice and watch the list grow huge, it is preferable that the app...
-s [HOST] AoiAWD Probe IP. Default: 127.0.0.1 -p [PORT] AoiAWD Probe PORT. Default: 8023 -w [PATH] Inotify watch dir, ';' as divider. Default: /tmp -i [MSECOND] Process watch interval. Default: 100 -h This help info About AoiAWD-专为比赛设计,便携性好,低权限运行的EDR系统。