LongLegs Module (Linux Intrusion Detection & Integrity Monitoring)
WidowMind's LongLegs is inspired by the long-bodied cellar spider: quiet, patient, and ever-present. Designed for Linux systems, LongLegs monitors system integrity and intrusion patterns from the kernel up, ensuring stealthy persistence, unauthorized elevation, or rootkits are detected and dismantled.
Key Features
- Kernel module change detection
- Filesystem integrity validation (checksum-based)
- Process tracing with escalation monitoring
- Integration with SELinux and AppArmor policies
Architecture
LongLegs uses inotify and eBPF-based monitoring tools, paired with custom log aggregators and threat classifiers from ArachnoCore. System calls are tagged and profiled in real-time. Integrity snapshots are periodically hashed and archived for audit trails.
Use Cases
- Web and application servers
- Container host systems and DevSecOps pipelines
- Security-hardened workstation environments
Compliance
- PCI-DSS integrity control compliance
- FIPS 199/200 audit readiness
- Supports immutable infrastructure auditing
Future Roadmap
- AI alert correlation between Docker/Podman environments
- Inline patch analysis and rollback support
- Syscall anomaly simulation training system
Tagline: “Integrity is silent—until it's broken.”