Field Notes: SessionScribe in the wild
Live battle journal of CVE-2026-41940 exploitation. 17-day quiet zero-day window, vendor disclosure, the post-PoC surge, and the kill chain walked end-to-end on a single host. Pattern catalog, operator buckets, attacker IP block list, and the verdict-engine gap that hides active malware on patched hosts. Updated as new evidence lands.
sessionscribe-ioc-scan.sh
Read-only on-host triage. Score-rubric verdicts. JSON / JSONL / CSV.
sessionscribe-mitigate.sh
Active defense. ModSec rules + cpsrvd-port scrub + proxysub.
sessionscribe-remote-probe.sh
Non-destructive remote verdict by HTTP code. Fleet-friendly.
372.9k
31.97M
2,187
Deployed across government, defense, education & enterprise networks
git clone https://github.com/rfxn/linux-malware-detect.git && cd linux-malware-detect && ./install.shRecent GitHub Activity
View allFeatured Projects
View allLinux Malware Detect
A high-performance malware scanner for Linux designed for the multi-core era. v2.0.1 introduces a foundational engine leap that delivers up to 10x faster performance than traditional scanners via hash-first short-circuiting and batch-parallel processing.
Advanced Policy Firewall
An iptables(netfilter) based firewall system for Linux servers. Provides three-fold filtering with static rules, stateful connection tracking, and sanity-based packet inspection.
Brute Force Detection
A modular shell script for parsing application logs and detecting authentication failures. Uses regex rules and integrates with APF, Shorewall, or raw iptables for blocking.
Quick Start
Get up and running in minutes. All tools install from source with a single command.
$ git clone https://github.com/rfxn/linux-malware-detect.git && cd linux-malware-detect && ./install.sh$ git clone https://github.com/rfxn/advanced-policy-firewall.git && cd advanced-policy-firewall && ./install.sh$ git clone https://github.com/rfxn/brute-force-detection.git && cd brute-force-detection && ./install.shBuilt for Real-World Linux Security
Threat-Driven Design
Built from real malware data collected at the network edge. Every detection signature comes from active threats seen in production hosting environments, not theoretical research.
Shell-Native & Lightweight
Pure bash with minimal dependencies. No agents, no daemons eating resources, no runtime interpreters. Runs on any Linux system from embedded devices to enterprise servers.
Community-Sustained
20+ years of open source development under GPL v2. No venture funding, no enterprise upsells. Sustained by the community of sysadmins who rely on these tools daily.
Protection Stack
Three tools, one defense-in-depth strategy. Layer them together for comprehensive Linux security.
Malware Detection
LMD
Scan & quarantine threats from real hosting threat data
Firewall Policy
APF
Stateful iptables filtering with reactive address blocking
Intrusion Prevention
BFD
Block brute-force auth attacks with modular log parsing
Connect
AboutSupport Open Source Security
R-fx Networks projects are entirely community-funded. If these tools help protect your infrastructure, consider contributing.