monitor macOS for malicious activity
-
Updated
Feb 5, 2025 - C
monitor macOS for malicious activity
A Linux kernel module that captures and analyzes UDP DNS queries using Netfilter. It hooks into the network stack to inspect DNS packets, extracts the queried domain name (QNAME), and logs the details (source IP, destination IP, QNAME) to the kernel log.
Add a description, image, and links to the security-monitoring topic page so that developers can more easily learn about it.
To associate your repository with the security-monitoring topic, visit your repo's landing page and select "manage topics."