project

talus-process-monitor

MIT-licensed Linux process monitor written in Rust. It uses eBPF tracepoints to watch process starts and file opens, and ships a terminal UI and a ransomware heuristic in its community edition alongside a paid build.

Known aliases

Talus process monitor

Relationships

No evidence-backed relationships are recorded.

Current clusters

build1 publisher

Fifty openat calls in one second is the whole ransomware rule in talus-process-monitor

The eBPF side of the MIT-licensed talus-process-monitor just reports file opens; the counting, the per-PID rate window and the SIGKILL all live in a userspace loop, a perf-buffer hop after the syscall.

Publishers:dev.to

Reality

Evidence56
Adoption: Insufficient
Hype gap+30
Incentives84
Confidence45