Know what's running -
and what's already inside.
One static Rust binary hunts for active compromise - reverse shells, fileless malware, rootkits, container escapes - and maps every exposure an attacker would find, in under a second. Zero dependencies. Read-only. Nothing leaves the box.
Verifies SHA256 & GPG · installs to /usr/local/bin · run with sudo owlzops-mapper audit
Every finding, with the CIS rule and the evidence
No dashboard, no login, no agent. One command returns a Risk Score, every exposure ranked by penalty, and the exact evidence behind each one - mapped to its CIS Benchmark rule.
$ sudo owlzops-mapper audit --deep
🦉 Owlzops Mapper v0.5.16
🔍 Scan completed in 2.50s
🔒 Risk Score: 60/100 (At Risk)
Security −60 Reliability −0 Hygiene −0
🛡 Security Findings
╭──────────────────┬─────────┬──────────────────────────────────────────────────────┬──────────────────────────────────────────────────────────────────────────╮ │ CIS / Ref ┆ Penalty ┆ Finding ┆ Evidence │ ╞══════════════════╪═════════╪══════════════════════════════════════════════════════╪══════════════════════════════════════════════════════════════════════════╡ │ CIS 5.2.10 ┆ -25 ┆ SSH root login allowed ┆ PermitRootLogin without-password │ │ CIS 5.4.2 ┆ -15 ┆ Sudo NOPASSWD entries found ┆ 2 NOPASSWD entries in sudoers │ │ CIS 5.3 ┆ -15 ┆ Passwordless sudo to ALL commands ┆ 1 principal(s) with NOPASSWD: ALL │ │ CIS 5.2.4 ┆ -10 ┆ SSH password authentication enabled ┆ PasswordAuthentication yes │ │ - ┆ -8 ┆ Non-root processes hold critical kernel caps ┆ 6 non-root process(es) with SYS_ADMIN/SYS_PTRACE/DAC_OVERRIDE/NET_RAW; │ │ ┆ ┆ ┆ 3 with NoNewPrivs=0 - setuid execve escalation path open │ │ CIS 5.2.10/5.2.4 ┆ -5 ┆ Root login with password allowed ┆ PermitRootLogin enabled AND PasswordAuthentication yes │ │ CIS 5.2.3 ┆ -5 ┆ Docker containers without memory limits ┆ At least one container lacks a memory limit │ │ CIS 5.2.2 ┆ -3 ┆ Docker containers without CPU limits ┆ At least one container lacks a CPU limit │ ╰──────────────────┴─────────┴──────────────────────────────────────────────────────┴──────────────────────────────────────────────────────────────────────────╯
⚠️ Anomalous Executable Memory (SEC-026 / SEC-028):
╭──────────┬────────┬─────────┬───────────────────────────╮ │ Process ┆ PID(s) ┆ Regions ┆ Address │ ╞══════════╪════════╪═════════╪═══════════════════════════╡ │ node ┆ 14862 ┆ 1× rwxp ┆ 7dd535807000-7dd535817000 │ ╰──────────┴────────┴─────────┴───────────────────────────╯
🛡 JIT writable-code advisory (SEC-027): 7 suppressed finding(s) with verified runtime topology.
🛡 Provisional Trust (SEC-029): 7 region(s) in allowlisted binaries (JIT shape unverified).
exit code 1 - critical findings
Real scan, redacted. Penalties, CIS references, suppression counts and the score are untouched - your findings will be your own.
Agentless EDR-lite - the full toolkit
Most EDR needs heavy agents, Python runtimes, kernel modules, or open ports. This is a single static binary that treats the host as untrusted, gives you a precise security baseline, and exits cleanly - no trace, no zombie processes.
Active compromise & threat hunting
Sweeps memory (/memfd), deleted executables, and ephemeral paths (/dev/shm, /tmp) to detect hidden rootkits, reverse shells, library injection, and fileless malware in milliseconds.
Deep memory forensics --deep
Reads process memory via process_vm_readv, resolves pointers, calculates Shannon entropy, and detects binary headers. Untrusted executable payloads escalate to SEC-028 (Critical).
Container escape detection
Analyzes Docker/containerd for privileged abuses, sensitive host mounts (docker.sock), capability leakage, and missing resource limits - all mapped to CIS benchmarks.
Agentless fleet orchestration
Drop the binary over SSH, scan dozens of servers in parallel, and clean up automatically. Passwordless or password-based sudo (--ask-sudo-pass). Zero permanent footprint.
Snapshot diff & drift monitoring
Capture state as JSON snapshots, compare any two, and get colour-coded Excel/terminal diffs of exactly what changed - new open ports, changed capabilities, added cronjobs.
Context-aware Risk Score
Findings scored with environment awareness (a kubelet host isn't penalised for ip_forward=1). Separate Security, Reliability, and Hygiene sub-scores prevent saturation.
CIS Benchmark mapping
Every security finding cites the corresponding CIS rule (e.g. CIS 5.2.10) - ready to drop into a SOC 2 or ISO 27001 audit.
Air-gapped & SIEM-ready
Single static binary, no runtime deps. --offline guarantees zero outbound calls. Export rich Excel dashboards or flat JSONL for immediate SIEM ingestion.
Trust-but-verify
A content-bound verdict cache (inode + mtime + size) replaces static allowlists and revokes trust automatically on modification. Memory that can't be attributed is flagged, not hidden.
Everything an attacker would enumerate - in one read-only pass
No prior setup. No config file. Run it on a server you've never seen before and get the full exposure picture immediately.
| Category | Details |
|---|---|
| Malware & Intrusion | Full /proc sweep for known malicious processes, fileless/memfd implants, bind-mount masking, reverse shells, library injection, hidden PIDs (LKM rootkit), container runtime capability tampering |
| Security | SSH config (effective + fallback), root login, password auth, users, authorized keys, login history, fail2ban & auditd, sudo NOPASSWD, sudoers permissions, sysctl security audit |
| Network | Listening ports with bind address (red = exposed on 0.0.0.0/::), firewall (ufw, firewalld, nftables, iptables), DNS, SSL certificates with expiry |
| Docker | Images, dangling layers, containers, mounts, log sizes, privileged flag, memory/CPU limits, dangerous capabilities, sensitive host mounts, OOM kills, restart loops, health status |
| Memory Forensics --deep | Process memory reading, pointer resolution, Shannon entropy, binary headers, prologue detection, origin attribution (FFI, GObject, JVM, trampoline), content-bound verdict caching |
| Packages | Installed count, upgradable, security updates (apt/dnf/yum/pacman/zypper) |
| Databases | PostgreSQL, MySQL, Redis, MongoDB - versions and data sizes |
| Internals | Cron jobs (severity-classified), systemd timers, /etc/hosts overrides, kernel errors, failed systemd units |
| System | OS, kernel, uptime, CPU, RAM, load average, LSM modules |
| Storage | Disk usage, inode usage per mount |
| Backups | Detection of restic, borg, duplicati, rsync/backup in cron |
| NTP | Time synchronization status and offset |
Full field reference → docs/FIELDS.md
One number your board understands, backed by findings you can act on
The Risk Score (0–100, lower is better) is split into three sub-scores so a single noisy category can't hide a real problem. Colour legend: green < 40, yellow 40–69, red ≥ 70.
🛡 Security
cap 60Firewall, SSH config, security updates, Docker risks, sysctl hardening, malware & intrusion detection.
⚙ Reliability
cap 30Failed services, missing backups, OOM kills, container health.
🧹 Hygiene
cap 10NTP synchronization and lower-severity drift.
Active-compromise indicators (SEC-015…SEC-024, SEC-028, DOCK-010) each add up to +60 and escalate the process to exit code 3 - a signal you can wire straight into CI/CD or a fleet alert. Every finding carries its CIS Benchmark reference for audit evidence.
Same scan. Different reason to run it.
One read-only pass. What changes is why you're looking - and what the red means for you.
You inherited a server and don't trust it
A contractor left. The wiki is stale. You have root and no real idea what's reachable from the outside - but you're liable for it now.
- Every open port and listening service, with bind address - what's exposed to the world
- Every SSH key and sudo entry - know who can get in before someone does
- The real running stack from live processes, not the outdated README
Why this, and not a Python script or another agent
single static binary
No Python, no Node, no kernel module, no open port. Copy it, run it, done.
host treated as untrusted
Defensive I/O, capped memory reads, no ptrace. Exits cleanly - no trace, no zombie processes.
< 1 second
Pure Rust, zero-copy parsing. Fast enough to run on production without a maintenance window.
Install & run
Pick whichever you're comfortable running on production. Every path is read-only.
Option 1 – direct download
Download the latest release, extract, and run.
sudo ./owlzops-mapper audit
Option 2 – install script (verifies SHA256 + GPG)
Detects your platform and verifies the checksum and GPG signature automatically.
sudo ./owlzops-mapper audit
Option 3 – macOS orchestrator (remote-only)
Install the orchestrator on your Mac and scan remote Linux hosts.
1. Install the orchestrator
2. Download & rename Linux agent
mv owlzops-mapper owlzops-agent-linux
3. Run a remote audit
--host 192.168.1.10 \
--ssh-user operator \
--ssh-key ~/.ssh/id_rsa \
--remote-path /tmp/owlzops-mapper \
--copy-binary \
--local-binary ./owlzops-agent-linux \
--ask-sudo-pass
Important for macOS users:
The macOS orchestrator cannot perform local scans. Always download the Linux agent separately and rename it (owlzops-agent-linux). If you do not rename it, the Linux binary will overwrite the macOS orchestrator, resulting in a «cannot execute binary file» error. Use --local-binary to point to the Linux agent when scanning remote hosts.
Usage & workflows
Local audit & forensics
sudo ./owlzops-mapper audit
sudo ./owlzops-mapper audit --deep
sudo ./owlzops-mapper audit --deep --format excel --output report.xlsx
sudo ./owlzops-mapper audit --format json > snapshot.json
sudo ./owlzops-mapper audit --offline
Fleet scan - 20+ hosts in one command
Copies itself over SSH, scans in parallel, collects JSON, removes itself from each host. No agent, no open ports beyond SSH. Uses --ask-sudo-pass for password-based sudo, or bake a NOPASSWD rule for passwordless.
--hosts hosts.txt --ssh-user ubuntu \
--copy-binary --ask-sudo-pass \
--format excel --output fleet-report.xlsx
Snapshot & drift monitoring
sudo ./owlzops-mapper snapshot
./owlzops-mapper dir-compare ~/.owlzops/snapshots/<host>
# Or compare two files → colour-coded Excel
./owlzops-mapper compare before.json after.json --format excel --output diff.xlsx
Key flags
--deep- memory forensics + ghost-PID / LKM rootkit scan--offline- disable all network calls--hosts <file>/--host- remote / fleet--copy-binary- push the static binary over SSH--ask-sudo-pass- password-based sudo-f json|excel- output format
Exit codes (CI/CD ready)
0- clean, no critical issues1- one or more critical findings2- not running as root, or fleet produced zero reports3- active compromise detected (IoC findings)
Trust & Safety
Will this modify my system?
No. Every operation is read-only. No config written, no services installed, no agent left running. It treats the host as untrusted and exits cleanly.
Does --deep touch process memory safely?
Yes. It uses process_vm_readv instead of ptrace - no anti-debug conflicts - and memory reads are capped and budgeted.
Does anything leave the server?
Only an optional public-IP lookup and an optional package-cache refresh, both off by default. --offline guarantees zero outbound calls.
Is it really free for my company?
Yes. Apache 2.0 with the Commons Clause: free for commercial use, corporate audits, and internal security checks, forever. The Commons Clause only stops third parties from reselling it as their own product - it does not restrict you using it on your own infrastructure.
Can I verify the binary?
All releases are GPG-signed with published SHA256 checksums; the install script verifies automatically. CI pins every action by commit SHA and ships an SBOM per release.
Full security policy → SECURITY.md
The scanner flags the indicators. We confirm how deep it goes.
The mapper hunts for reverse shells, implants, and exposed doors - and tells you when something's wrong. It can't tell you how far an attacker got, or what evaded the scan. That's an Infrastructure Security Audit: we take your report, run deep forensics, and answer the one question that matters - who is in your servers right now, and how do we get them out.
Send your JSON report and get a free 30-minute findings call. The audit is $2,995 - $2,695 with your mapper report. If your scan comes back clean, we'll say so and we won't sell you the audit.
Security note: encrypt your report with our public PGP key before emailing, or redact IPs/hostnames with jq first.
We review your scan before the call. No pitch - just engineering facts.