build1 publisher
Fifty openat calls in one second is the whole ransomware rule in talus-process-monitor
The eBPF side of the MIT-licensed talus-process-monitor just reports file opens; the counting, the per-PID rate window and the SIGKILL all live in a userspace loop, a perf-buffer hop after the syscall.
Publishers:dev.to
Reality
- Evidence56
- Adoption
- Insufficient
- Hype gap+30
- Incentives84
- Confidence45