Hey HN, I got frustrated with heavy proprietary sandboxes for malware analysis, so I built my own.
Azazel is a single static Go binary that attaches 19 eBPF hook points to an isolated Docker container and captures everything a sample does — syscalls, file I/O, network connections, DNS, process trees — as NDJSON. It uses cgroup-based filtering so it only traces the target container, and CO-RE (BTF) so it works across kernel versions without recompilation.
It also has built-in heuristics that flag common malware behaviors: exec from /tmp, sensitive file access, ptrace, W+X mmap, kernel module loading, etc.
Stack: Go + cilium/ebpf + Docker Compose. Requires Linux 5.8+ with BTF.
This is the first release — it's CLI-only for now. A proper dashboard is planned. Contributions welcome, especially around new detection heuristics and additional syscall hooks.
Show HN: Azazel – Lightweight eBPF-based malware analysis sandbox using Docker | Heykuki News