defensive-security - Comprehensive defensive security and system harden

项目说明

Defensi Toolkit

A comprehensi defensi toolkit designed for system hardening, monitoring, and threat detection in authorized security operations.

CRITICAL LEGAL DISCLAIMER

THIS TOOLKIT IS PROVIDED FOR AUTHORIZED DEFENSI OPERATIONS AND SYSTEM ADMINISTRATION PURPOSES ONLY.

Legal Responsibility

You are solely responsible for ensuring you ha authorization before using any tool in this toolkit

Unauthorized access to computer systems is illegal under laws including:

- Computer Fraud and Abuse Act (CFAA) - United States
- Computer Misuse Act - United Kingdom
- Similar cybercrime legislation in your jurisdiction

Criminal penalties may include substantial fines and imprisonment

Ci may result from damages caused by unauthorized access or modification

Required Authorization

Before using ANY function in this toolkit, you MUST have:

Written permission from the system owner

Authority to monitor and administer the systems

Understanding that operations are lawful in your jurisdiction

Proper documentation of authorization

Permitted Uses

System administration on owned or authorized systems

Security monitoring and log analysis

assessment and hardening

Authorized security audits

Threat detection and response

Educational purposes in controlled lab en

Prohibited Uses

Unauthorized access to systems

Unauthorized monitoring or sur

Tampering with system files without permission

Circum security controls without authorization

Modifying audit logs

Any use on systems you do not own or ha written authorization to access

Disclaimer of Liability

THE AUTHOR AND CONTRIBUTORS DISCLAIM ALL LIABILITY FOR:

Unauthorized access or use of this toolkit

Damages caused by misuse of these tools

Any illegal acti conducted using this software

System damage, data loss, or service interruption

Civil or criminal consequences of unauthorized testing

By downloading and using this toolkit, you acknowledge and agree to:
1. Use this software only for lawful and authorized purposes
2. Hold harmless the authors and contributors from any liability
3. Assume full responsibility for all consequences of your actions
4. Comply with all applicable laws and regulations

Installation

Requirements

Python 3.7+

Linux/macOS/Windows

Administrator/sudo access for some features

Dependencies

Quick Setup

Features & Modules

1. Log Analysis

Parse system logs with keyword filtering

Custom keyword searching

Export results to file

Identifies errors, warnings, security events

2. File Integrity Monitoring

Create baseline of file system

Detect new, modified, deleted files

Real-time monitoring with configurable intervals

Hash-based integrity

Change logging and reporting

3. Network Monitoring

View acti connections

Identify associated processes

Monitor network interfaces

Track connection status

4. Process Monitoring

Identify high CPU usage processes

Identify high memory usage processes

Display process ownership

Set custom thresholds

5. Port Blocking

Block ports

Windows and Linux support

Immediate effect

6. Password Strength Audit

E password strength

Check for common passwords

character complexity

Recommend impro

7. YARA Malware Scanning

Pattern-based malware detection

Custom YARA rules support

File-based scanning

8. System Hardening Check

file permissions (/etc/shadow, /etc/passwd)

Check SSH configuration

Identify insecure settings

Linux-focused

9. Malware Hash Lookup

Calculate file hashes (MD5, SHA1, SHA256)

Compare against known malware database

Support for custom hash databases

10. Intrusion Detection

Analyze authentication logs

Detect brute force attempts

Threshold-based alerting

Time-window analysis

11-20. System Auditing

Check open ports

List running services

Enumerate user accounts

Check file permissions

SSH configuration

Firewall status

Pending updates

Suspicious processes

Cron jobs

Startup scripts

21. Generate Full Security Report

Comprehensi report

Combines all checks

Exportable to file

Includes system information

Usage Examples

Example 1: Monitor File Changes

Example 2: Analyze Auth Logs

Example 3: Detect Brute Force Attacks

Example 4: System Security Audit

Example 5: Check Running Processes

Installation of Optional Dependencies

For YARA Scanning

For Process Monitoring (psutil)

Complete Installation

Operational Security (OpSec) Notes

When Using for System Administration:

1. Document all audit acti
2. Maintain proper authorization records
3. Enable logging of your administrati
4. Review logs regularly for unauthorized changes
5. Keep baseline snapshots for comparison
6. Store reports securely
7. Use strong authentication
8. Limit access to sensiti files
9. Regularly update security rules
10. Backup critical system configurations

Troubleshooting

Permission Denied Errors

Module Import Errors

psutil Not Found

YARA Not Found

File Permission Issues on Linux

File Structure

Requirements File (requirements.txt)

Features Summary

| Module | Function | Requires Root/Admin |
|--------|----------|--------------------|
| Log Analysis | Parse system logs | NO |
| File Integrity | Monitor file changes | YES (for /etc) |
| Network Monitor | View connections | NO |
| Process Monitor | Check processes | NO |
| Port Blocking | Firewall rules | YES |
| Password Audit | Check password strength | NO |
| YARA Scan | Malware detection | NO |
| Hardening Check | System security | YES |
| Hash Lookup | File hash comparison | NO |
| Intrusion Detection | Analyze auth logs | YES |
| Port Enumeration | List listening ports | NO |
| Service Check | Running services | NO |
| User Accounts | List system users | NO |
| Permissions Check | World-writable files | YES |
| SSH Config | SSH security | NO |
| Firewall Status | Check firewall rules | YES |
| Updates | Pending security updates | NO |
| Suspicious Process | Find malware tools | NO |
| Cron Jobs | List scheduled tasks | YES |
| Startup Scripts | Check boot-time tasks | YES |

Best Practices

During Monitoring

Review logs regularly

Maintain baseline snapshots

Document all findings

legitimate changes

Keep audit trail

Use proper access controls

Monitor for anomalies

After Detection

In thoroughly

Contain the threat

Collect e

Preserve logs

Restore from clean backup

Apply security patches

Update detection rules

General Security

Keep baselines current

Update malware signatures

Review cron jobs regularly

Check startup scripts

Monitor suspicious processes

Maintain file permissions

Enable system auditing

Support & Contribution

For issues, questions, or impro:

Check existing issues

Provide detailed reproduction steps

Include your en details

Respect responsible disclosure practices

License

See LICENSE file for details.

Contributors

josephelliottwest3-blip

Acknowledgments

This toolkit is designed for system administrators and security operations teams. Defensi helps protect systems and detect unauthorized changes.

Final Warning

UNAUTHORIZED ACCESS TO COMPUTER SYSTEMS IS A FEDERAL CRIME

Using this toolkit without proper authorization can result in:

Federal prosecution

Up to 10 years imprisonment (CFAA )

Substantial fines

Ci

Professional consequences

ALWAYS OBTAIN WRITTEN AUTHORIZATION BEFORE ANY SECURITY OPERATIONS

---

Last Updated: September 2026
: 1.0
Status: Acti

Remember: With great power comes great responsibility. Use ethically and legally.

项目信息

开发语言：Python

Star 数：1

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Comprehensive defensive security and system hardening toolkit for authorized security operations展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。