Security firm Cybereason has open-sourced owLSM, an EDR-like agent for Linux, an eBPF LSM agent to run Sigma rules

https://github.com/Cybereason-Public/owLSM

GitHub - Cybereason-Public/owLSM: Sigma Rules Engine inside the Linux Kernel using eBPF. Focusing on prevention capabilities

Sigma Rules Engine inside the Linux Kernel using eBPF. Focusing on prevention capabilities - Cybereason-Public/owLSM

GitHub
@campuscodi This seems sort of unhinged and I'm here for it