Hash signatures
Is this exact content known? Flags it MALICIOUS with the threat name.
← Store · // product
cau
CAU EDR (“Certs Are Useless”) is a transparent, open-source malware-detection engine in Go. Six detectors read every file once; every finding is explained with a labelled class and an ATT&CK technique, and every report is machine-readable with CI exit codes.
Coming soonin development
⚠ Deploy & ownOpen-source defensive tooling you stand up and keep. Provided as-is, without warranty; what you pay for is setup, tuning and support.
// what it is
In development
cau is a Linux-first endpoint detection engine built on a simple idea: a detector you cannot inspect is a detector you cannot trust. Every file is read once and passed through six cooperating detectors, and every verdict comes with the reason — a labelled class and the ATT&CK technique behind it — instead of an opaque score.
It is built for automation as much as for analysts: machine-readable output in SARIF, OCSF and JSON, CI exit codes so a suspicious build can fail a pipeline, an ATT&CK Navigator coverage map, and an evaluation harness that gates every detection change against a measured baseline.
cau is in active development and not yet released for sale. Tell me you want it and I’ll let you know the moment it is ready.
// capabilities
What it does
YARA (in-process)
Per-file timeout; reports the rule, namespace, meta and the matched strings at their offsets.
Heuristics
Names suspicious capabilities with a capped score, the categories responsible and their ATT&CK techniques.
Static structure
Own PE and ELF parsers, entropy, TLSH / ssdeep / imphash — flags things built to hide (packers, RWX sections).
Machine-readable output
SARIF for code scanning, OCSF for a security lake, JSON for everything else — with CI exit codes.
ATT&CK coverage & eval
Navigator heat-map of coverage, and an evaluation harness that gates every change against a baseline.
// under the hood
Specifications
- Language
- Go 1.24+
- License
- MIT
- Platform
- Linux-first
- Output
- SARIF, OCSF, JSON; ATT&CK Navigator
- Status
- In development — coming soon
- Intended use
- Defensive malware detection and CI scanning
// the fine print
Terms & liability
As-is, without warranty. Open-source defensive tooling provided for you to deploy and run. To the maximum extent permitted by law, Cyber Sec and Stephan Botes accept no liability for any damage, data loss or disruption arising from its use.
What the fee buys. The engineer’s time — installation, tuning, documentation and support, so your team can run it without us. You keep the source.
Questions about scope, licensing or authorization? Get in touch first.