The shape of a Linux ransomware hit Ransomware on Linux does not usually announce itself with a GUI. It looks like a normal process that, in a short window, opens a large number of files for writing, writes to them, and renames them to a new extension. The signatures are always new; the shape is stable. That shape is what eBPF is built to score. This is the same material I wrote up in ebpf-ransomware-monitor-lessons , but here I focus on the detection steps you can implement yo...