https://github.com/0x4D31/stinger
Stinger is an unprivileged endpoint deception tool for macOS and Linux. It uses FIFO baits, other local traps, and protected sessions to detect secret collection as it happens.
https://github.com/0x4D31/santamon
a lightweight macOS detection agent that taps into Santa’s Endpoint Security telemetry, runs CEL detection rules locally on-device, and only ships high-signal alerts to a tiny backend. basically a poor man’s macOS EDR for home labs and small fleets!
https://github.com/0x4D31/finch
Finch is a lightweight reverse proxy that inspects TLS and HTTP traffic to extract JA3, JA4, JA4H and Akamai HTTP/2 fingerprints. It uses hot-reloadable HCL rules to evaluate requests and can allow, deny, tarpit, route, or even deceive attackers with LLM-generated responses!
https://github.com/nianticlabs/venator
a flexible threat detection platform that simplifies rule execution and management with k8s cronJobs and helm. flexible enough to run standalone or with other schedulers like hashicorp nomad.