Awesome AI AgentsPost-Exploitation Agents

chriskaliX/Hades

⭐ 307 C added to this list on 2025-04-19 repository created 2020-10-17

Hades is a Host-Based Intrusion Detection System (HIDS) primarily leveraging eBPF (extended Berkeley Packet Filter) technology and netlink (cn_proc) for monitoring and analyzing system activities to detect potential intrusions. The project is currently under development and serves as a backend demo. It is inspired by and based on the open-source projects Tracee and Elkeid, incorporating elements from these to build its architecture and functionality. The system architecture includes an agent part mainly derived from Elkeid version 1.7, which collects data through various hooks implemented via tracepoints, kprobes, and uprobes. These hooks monitor critical system calls and kernel events such as execve, prctl, ptrace, socket operations, module initialization, file permissions, and BPF program activities. The agent collects detailed event data to provide comprehensive monitoring of the host system. Hades also features a data analysis component that processes the collected data to identify suspicious activities and potential security threats. The system supports multiple plugins including EDriver, Collector, Eguard, NCP, Scanner, and Logger, each contributing specific functionalities such as event hooking, data collection, security enforcement, netlink communication, scanning, and logging. The Collector plugin gathers various system events categorized as synchronous (real-time), periodic, or configuration-based, covering processes, crontab, ssh login, user activities, system configurations, package management, container monitoring, and network sockets. The NCP plugin facilitates communication via netlink CN_PROC. Hades aims to provide a robust and extensible platform for host-based intrusion detection by utilizing modern kernel tracing and monitoring techniques. It is suitable for security researchers and system administrators looking to enhance their host security posture through detailed and real-time system event monitoring.

https://github.com/chriskaliX/Hades

agentbackendcn_proccollectordata-analysisebpfebpf-programsebpf-secedrivereguardelkeidgolanghidshost-based-intrusion-detection-systemintrusion-detectionkernel-hookskprobeslibbpflinuxloggerncpnetlinkopen-sourcepluginsruntime-securityrustscannersecuritysystem-callssystem-monitoringtraceetracepointsuprobes

Also in Post-Exploitation Agents

PromtEngineer/localGPT

LocalGPT enables secure, private conversations with your documents on your local device using various open-source GPT models and embeddings without any data leaving your computer.

guardrails-ai/guardrails

Guardrails is a Python framework that enhances AI application reliability by providing input/output guards to detect and mitigate risks and generate structured data from large language models.

fr0gger/Awesome-GPT-Agents

A curated community-driven repository compiling diverse GPT agents specialized in offensive and defensive cybersecurity tasks, providing AI-powered tools for malware analysis, threat intelligence, vulnerability assessment, and more.

Ne0nd0g/merlin

Merlin is a cross-platform post-exploitation Command & Control server and agent supporting multiple protocols and advanced encryption for secure and flexible red teaming operations.

AprilNEA/AChat

AChat is an open-source, self-hosted AI platform designed for enterprises and teams, combining local processing with remote synchronization for centralized AI conversation management and collaboration.

sauravpanda/BrowserAI

BrowserAI is an open-source platform that enables running production-ready large language models and AI functionalities directly in the browser with WebGPU acceleration, ensuring privacy, offline capability, and no server infrastructure requirements.

HXSecurity/DongTai-agent-java

DongTai-agent-java is a Java application probe for DongTai IAST that collects runtime method invocation data via dynamic bytecode instrumentation to detect security vulnerabilities.

spellshift/realm

Realm is a scalable, reliable, and automated cross-platform Red Team engagement platform featuring a Pythonic DSL, multi-host management, and native Google Cloud integration for advanced offensive security operations.