Most host intrusion detection projects stop at "it parses logs." I wanted something that actually caught something - not a toy that prints alerts on synthetic test data, but a tool I could point at a real exploit and watch it work.

That's what Heimdallr is: a Linux HIDS built entirely with Python's standard library, no external dependencies, tested against a live Metasploit exploit until it generated a real alert.

Why standard-library only

Every dependency is one more thing that can break, one more supply chain risk, one more thing to explain in an interview when someone asks "why did you pick that library." Sticking to os, subprocess, socket, and friends forced a constrain I actually wanted: understand exactly what each sensor is doing at the syscall level, rather than trusting a library's abstraction.

It also mirrors a real constraint in OT/ICS environments, where you often can't just pip install whatever you want on a production system sitting on a plant floor.

What it actually watches

Heimdallr is organized as a set of independent sensor modules, each watching one thing:

  • auth.py - brute-force attempts, new IP logins, sudo usage
  • network.py - known C2 port signatures, unexpected listening ports
  • process.py - suspicious outbound processes, Meterpreter/reverse shell signatures
  • persistence.py - new services, NIC changes, anything trying to survive a reboot
  • canary.py - USB connections, kernel OOM events
  • ioc.py - indicator matching against known-bad signatures

Splitting it this way meant I could test and validate each sensor in isolation before worrying about how they'd eventually feed into a correlation layer.

The test that mattered

Anyone can write code that should detect something. The real questions is whether it does, against something real. So I set up an isolated lab, ran Metasploitable 2, and targeted the vsftpd 2.3.4 backdoor - CVE-2011-2523, a well-known planted backdoor in that package's source that gives an attacker a root shell on port 6200 after a specific login string.

I ran the exploirt through Metasploit Framework while Heimdallr was watching. The process sensor picked up the reverse shell signature, correlated it against the known C2 port pattern, and generated an alert identifying exactly what happened - not a generic "suspicious activity" alert, but one that named the behavior.

That's the moment this stopped being a class exercise and became a tool I trust to actually notice something.

What v1 deliberately doesn't do

Heimdallr v1 is detect-and-report only. No active response, no automatic blocking, no killing processes. That's a deliberate scope decision, not a missing feature - active response is EDR territory, and bolting it onto a HIDS that hasn't proven its detection logic yet is how you end up automatically blocking your own SSH session at 2am.

What's next

The roadmap from here is an event correlation/case layer - turning a pile of individual sensor alerts into an actual incident story - and a SOC-style console to view them in, rather than reading raw log lines. Cross-platform support (macOS, then Windows) comes after that, once the Linux-only core is solid.

If you want to see the code, it's on GitHub.