TLDR Tech / InfoSec
Rustinel
Karib0u's Rust-based user-mode EDR uses ETW for Windows kernel telemetry, normalizing data into Sysmon schemas for Sigma, YARA, and atomic IOC matching. It features active response, hot-reloadable rules, and extensive enrichment like PE metadata and parent-process correlation. Note: While the README claims a v1.0 release with Linux eBPF support, the repository remains an Alpha Windows-only tool (v0.3.1) lacking eBPF code.
Read the full story