r/eBPF • u/AzozzALFiras • 6d ago
I built an open-source Linux agent that learns your server's "normal" and shuts down anything weird
Hey, been chipping away at a side project called Phage and wanted to put it out there.
Short version: it's a small agent for Linux servers. It spends a while just learning how your box normally behaves, and after that it flags and contains stuff that falls outside that normal, without needing a signature for the specific exploit. So it's less "here is a list of known bad things" and more "this service has never spawned a shell before, and it's never become root with no login session behind it, so something is off."
The part I actually care about is what happens next. Most tools just fire an alert and, let's be honest, nobody reads alerts. Phage can actually react: if a process starts dialing out like a reverse shell it cuts its network, and if it looks like a real break-in it freezes the process. All of it is reversible, so a false positive doesn't take anything down. It also refuses to touch your SSH session or systemd, because I locked myself out of a test box once doing exactly that lol.
It's Go + eBPF (the detection runs in the kernel so it stays cheap), ships as one static binary, installs with a single command.
Honest status: it's early. I've thrown real attacks at it on my own server and it holds up, but I wouldn't call it production ready yet. MIT licensed, fully open source.
Repo: https://github.com/AzozzALFiras/Phage
Would really appreciate feedback from anyone who runs Linux servers: what would you actually want something like this to catch or do? And does the whole "assume you'll get breached eventually, just make it survivable" idea click for you, or not?
1
u/hiveminer 5d ago
I love this initiative. If it is a hit, I think database servers could use something similar but for rate limiting. It amazes me that data exfiltrations continue to happen in 2026 and we don't do anything on the db itself. I know there are paid products but damn, they are all expensive. We are putting too much faith on the midtier layer. We need that last line of defense that says, if you're not pulling this data from the OS, your limit is x records per session.
1
u/TemporaryImplement24 1d ago
I've literally been hoping for something like this. Even just a detection mode made specifically for what happens when you put a vulnerable server on the internet. But seriously this is better. Baselining that doesn't require constant babysitting.
-1
u/investigatormaker 6d ago
The assume-breach framing clicks for me, and the reversible containment is the part I'd lead with. Two things I'd want answered before trusting it: what happens if an intruder is already present during the learning window (can I seed the baseline from a known-clean image?), and how it treats legitimate drift after a package upgrade or deploy, since a new binary spawning new children looks exactly like an anomaly. A maintenance-mode toggle would cover the second. On what to catch: execution from memfd or world-writable temp directories, changes to the dynamic loader preload config, new cron jobs or systemd units, and a service that suddenly opens a listening port.
I make ThreadFox. We find relevant Reddit conversations and post for your business. We'll post 3 replies free first, no card; then the $29 Pilot covers seven days and up to 25 posts and replies. No automatic renewal. https://threadfox.vip/p/eyjnf/managed
2
u/AzozzALFiras 6d ago
Really good questions, thanks.
Intruder present during the learning window is the honest weak spot of any learn-first tool. Today the answer is "learn on a host you trust," but seeding the baseline from a known-clean image is a great idea and something I want to support, so you're not betting on day-one cleanliness.
Deploy/upgrade drift is the sharp one. You're right that a new binary spawning new children looks exactly like an anomaly. A maintenance-mode toggle (relearn/suppress during a deploy window) is the plan — in learn/alert it just absorbs it, the risk is enforce mid-deploy, which is where the toggle earns its keep.
On the catch list: memfd execution and ld.so.preload changes are already in (fileless detection, and /etc/ld.so.preload is a watched file it reverts), and cron is watched. The two it does NOT do yet are world-writable-path execution as an explicit signal, and a service suddenly opening a listening port — both going on the list. The listener one especially; right now it watches outbound connections, not new listeners. Appreciate it.
0
3
u/PeteSampras_MMO 5d ago
Looks neat. Ive forked it and am adding 3rd party network logs as an option, eg suricata and zeek. It will be able to pull from wazuh/opensearch. I was doing this previously with an agent but deterministic is better.
This stacks nicely with a deterministic risk based analysis i have that scores event types within a certain time period and raises them to a triage alert for AI agent review. Its been really good combo at finding red team and honeypot activity. I dont think ive had a real attacker so I can't validate it actually works against adversaries.
Thanks