> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/misc/detecting-lol-python-techniques-with-opendr.md).

# Detecting LOL Python Techniques with OpenDR

I came across [OpenDR](https://github.com/opendr-io/opendr) during a workshop at Boston OWASP 2025 with [Craig Chamberlain](https://www.linkedin.com/in/craigchamberlain/), a security consultant in the greater Boston area. Rather than treating endpoint detection like a black box, OpenDR is open-source and allowed me to learn how to identify threats and suspicious activity.

<figure><img src="https://2618442973-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmGhYQRY1OEeL4zywZ9zS%2Fuploads%2FcDA2dpYdEwCwfFpAErc1%2Fopendr.jpg?alt=media&amp;token=ce16de91-c2c2-4c15-97e9-9a561517a198" alt="" width="384"><figcaption></figcaption></figure>

OpenDR is a free and open source endpoint detection and response project. It gives you host visibility without forcing you into a heavyweight commercial stack. The project is implemented in Python and uses `psutil` alongside platform-specific modules to collect endpoint telemetry.

### OpenDR collects...

* Process events with parent process context
* Network events tied to processes
* Endpoint metadata, including IP addresses and instance IDs
* Endpoint SID on Windows and UUIDs on Linux
* Services
* Installed software

When I chatted with Craig, it seemed like future work would include malware detection, sigma rules, and expansion for MacOS agents.