Hey everyone! I've been working on a project called SysTrace, a Linux behavioral monitoring tool built mainly to learn more about Linux internals, system calls, and cybersecurity.

It uses ptrace to trace a process and monitor different types of activity, including:

File operations

Process execution

Network-related syscalls

Memory operations

I also added a simple rule-based detection system and experimented with using collected behavioral data for ML classification.What would you improve next? I'm especially interested in opinions about the architecture and whether moving from ptrace toward eBPF would be a good next step.

github

Anthropic warned users about infostealer malware stealing active browser session tokens. Since the session is already logged in, attackers gain access without triggering 2FA or needing a password.

This isn't a flaw in Claude's infrastructure, but it highlights why revoking active sessions and securing developer endpoints is critical when dealing with AI tools containing sensitive chats/code.

Context & Use Case Deception technology relies heavily on believability. If a low-interaction decoy exposes static banners, uniform error codes, or anomalous TCP/FSM behavior, sophisticated adversaries will fingerprint and bypass it.

I developed Honeypot-Auditor as a Python-based utility to help blue and purple teams test their own honeypots, identify fingerprinting leaks, and validate decoy believability before deploying them into production environments.

How It Works

• Multi-Protocol Fingerprinting: Runs non-destructive behavioral probes across 16 protocols (SSH, SMB, Redis, MySQL, Postgres, Telnet, HTTP, etc.).
• Behavioral Honeyscore (0–100%): Evaluates host behavior rather than relying on static product-name string matches (arbitrary authentication acceptances, FSM tells, multi-protocol co-tenancy corroboration).
• Deep Mode & Signatures: Inspects shell semantics, HASSH/TCP stack characteristics, and known signatures for common decoy frameworks (e.g., uniform FTP 500 responses, MySQL SSL drop quirks).
• Output: Generates CLI reports and structured JSON for SIEM/automation pipeline ingestion.

Installation & Quick Start

pip install honeypot-auditor
honeypot-auditor --target <DECOY_IP> -v

Links & Documentation

• Cool Style Web Interface:https://mziqudhd92.github.io/honeypot-auditor/
• GitHub Repository:https://github.com/mziqudhd92/honeypot-auditor
• PyPI Package:https://pypi.org/project/honeypot-auditor/

Interested in feedback from deception engineers and blue teams:

Are there specific behavioral tells or signatures from modern decoys you'd like added to the rule engine? Pull requests and feedback are welcome!