Rustinel

Abstract

1. Introduction

rustinel sigma doctor explains which rules can fire, while rustinel doctor reports runtime health and events dropped under load.

Open-source endpoint detection. Three platforms. Your rules. Run Sigma, YARA, and IOC detections on native Windows, Linux, and macOS telemetry. Written in Rust, with local alerts and no cloud account required.

Sigma for behavior, YARA for executables and process memory, and IOC lists for hashes, IPs, domains, and paths.

2. Objective

Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.

This project demonstrates how Rust can be applied to a real-world Cybersecurity & Ethical Hacking problem.

4. Technology Stack

5. System Requirements

General requirements for this technology stack — check the README for exact versions.

• Rust toolchain (rustup / cargo)
• Git (to clone the repository)

6. Installation & Setup

git clone https://github.com/Karib0u/rustinel.git
cd rustinel

curl -fsSL https://rustinel.io/install.sh | sh
cd rustinel && sudo ./rustinel run

irm https://rustinel.io/install.ps1 | iex
Set-Location rustinel; .\rustinel.exe run

curl -fsSL https://rustinel.io/install.sh | sh
cd rustinel && sudo ./rustinel run

Full setup instructions are in the project README.

7. Future Enhancements

Suggested extensions you can add to make this your own project.

• Add logging and alert notifications (email / Telegram)
• Write a threat model document for the tool
• Package it with Docker for safe lab testing

8. Viva / Review Questions

Common questions examiners ask for projects in this domain.

1. Which threat or attack does this project defend against?
2. What detection or protection technique is used and what are its limits?
3. How are false positives and false negatives handled?
4. Which cryptographic algorithms or security standards are involved?
5. What legal and ethical rules apply when testing a tool like this?

9. Source Code & License

This project is developed by Karib0u and published on GitHub under the Apache License 2.0. Please follow the license terms and credit the original author when you use or modify this code.