issues
search
droe
/
xnumon
monitor macOS for malicious activity
https://www.roe.ch/xnumon
Open Software License 3.0
230
stars
30
forks
source link
issues
Newest
Newest
Most commented
Recently updated
Oldest
Least commented
Least recently updated
Apply my own configration.plist error!
#48
MrJeffyw
closed
5 years ago
4
Add tlsh hash support
#47
droe
opened
5 years ago
0
Add ssdeep hash support
#46
droe
opened
5 years ago
0
Verify identity of process attaching to cdev
#45
droe
opened
5 years ago
2
Add symhash hash support
#44
droe
opened
6 years ago
0
Extend launchd-add[4] event with Login Items
#43
droe
opened
6 years ago
0
O(1) audit event type testing
#42
droe
closed
6 years ago
1
Spurious radar39623812_fatal with malformed path[0]
#41
droe
closed
6 years ago
0
Differentiate between UDP, TCP, SCTP, raw etc socket events
#40
droe
closed
6 years ago
1
Add option to suppress localhost socket accept and connect
#39
droe
closed
6 years ago
0
Add local addr:port to socket-accept[6] and socket-connect[7] events
#38
droe
closed
6 years ago
2
Replace socket-bind[5] with socket-listen[5]
#37
droe
closed
6 years ago
2
EXC_BAD_ACCESS of kextloop_thread in kqueue_dispatch()
#36
droe
closed
6 years ago
1
Watchdog timer for system-wide audit policy
#35
droe
closed
6 years ago
0
More flexible suppression syntax
#34
droe
opened
6 years ago
0
[kext] Event loop redesign
#33
droe
closed
6 years ago
0
JSON schema
#32
droe
opened
6 years ago
0
Add code signature origin field: Apple, App Store, Developer ID
#31
droe
closed
6 years ago
0
Schema documentation
#30
droe
closed
6 years ago
1
auid, euid, ruid -1 is logged as 4294967295
#29
droe
closed
6 years ago
2
Extend image-exec events with username (e.g. getpwuid)
#28
losandros
closed
6 years ago
2
Allow by_ident suppressions to restrict ident to a specific teamid
#27
droe
closed
6 years ago
1
Improve file monitoring core
#26
droe
opened
6 years ago
1
Faster code signature verification mode(s)
#25
droe
closed
6 years ago
3
Continuous integration service
#24
droe
closed
6 years ago
0
New event: browser extension install
#23
losandros
opened
6 years ago
5
Child image suppression for image exec
#22
droe
closed
6 years ago
0
Extract CDHashes from code signature
#21
droe
closed
6 years ago
0
Extract the team ID from code signatures
#20
droe
closed
6 years ago
1
Make use of identity tokens in audit(4) records in 10.14
#19
droe
opened
6 years ago
0
xnumon self-defense
#18
droe
opened
6 years ago
0
Reimplement kext loading using c API
#17
droe
closed
6 years ago
0
New event: kext load
#16
droe
opened
6 years ago
2
Process access event does not cover processor_set_tasks()
#15
droe
closed
6 years ago
1
New events: Network sockets
#14
droe
closed
6 years ago
1
json-seq log format (RFC 7464)
#13
droe
closed
6 years ago
1
XML log format
#12
droe
closed
6 years ago
0
Acquire stat and hashes in kext to move burden to caller
#11
droe
opened
6 years ago
2
Test binaries for chdir/fchdir+exec
#10
droe
closed
6 years ago
1
Automated test framework
#9
droe
closed
6 years ago
0
Optional event for already running processes
#8
droe
closed
6 years ago
0
Detect DYLD_INSERT_LIBRARIES dylib injection
#7
droe
closed
6 years ago
0
Ship signed kext
#6
droe
closed
5 years ago
10
Create source release tarballs
#5
droe
closed
6 years ago
0
Resolve uid and gid to names
#4
droe
closed
6 years ago
0
Field configuration
#3
droe
closed
6 years ago
2
Option to omit hashes for signed Apple binaries
#2
droe
closed
6 years ago
0
Event type selection in configuration
#1
droe
closed
6 years ago
1