TL;DR talus-process-monitor is an eBPF-based ransomware detector for Linux: it traces execve / openat from the kernel, streams events over per-CPU perf buffers, and flags behavioural patterns — mass file rewrites plus extension churn — in real time. The hard part is not the tracing; it's scoring patterns without crying wolf on every cargo build . Why behaviour, not signatures Signature detection on Linux ransomware is nearly useless — most samples are short-lived, often sc...