Hades is a host-based intrusion detection system (HIDS) that uses eBPF and the netlink process connector to monitor activity on Linux systems.
The software collects host information and security events using a plugin-based architecture. Its eBPF driver hooks into tracepoints, kprobes, and uprobes to observe process execution, socket activity, credential changes, kernel modules, file operations, mounts, and other system events.
This is free and open source software.
Key Features
- Uses eBPF and the netlink process connector.
- Monitors system activity using tracepoints, kprobes, and uprobes.
- Tracks process execution and process-related events.
- Monitors socket connections and binds.
- Detects credential changes and kernel module activity.
- Observes file, inode, and mount operations.
- Collects information about processes, users, applications, disks, interfaces, containers, and sockets.
- Monitors SSH configuration and login activity.
- Plugin-based architecture with EDriver, Collector, Eguard, WDriver, and NCP components.
Website: github.com/chriskaliX/Hades
Support:
Developer: chriskali
License: Apache License 2.0
Hades is written in Rust and C. Learn Rust with our recommended free books and free tutorials. Learn C with our recommended free books and free tutorials.
Related Software
| Host-Based Intrusion Detection Systems | |
|---|---|
| Wazuh | Platform used for threat prevention, detection, and response |
| OSSEC | Full platform to monitor and control your systems. |
| Falco | Cloud native runtime security tool |
| Tracee | Runtime security and observability tool |
| AIDE | Advanced Intrusion Detection Environment |
| Logwatch | Powerful and versatile log parser and analyzer |
| Samhain | File integrity checking and log file monitoring/analysis and more |
| Sagan | Multi-threads, high performance log analysis engine |
| Hades | Uses eBPF and the netlink process connector to monitor activity |
| rkhunter | Scans for rootkits, backdoors and possible local exploits |
| Tripwire | Security and data integrity tool |
| chkrootkit | Locally checks for signs of a rootkit |
Read our verdict in the software roundup.
 Explore our carefully curated directory of recommended free and open source software, covering every major software category.The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form. |
Please read our Comment Policy before commenting.