Behavioral ransomware detection and automated response for Linux. eBPF-based tracing at ~280k events per second, sliding-window verdicts, automated kill response — with seccomp and Landlock self-sandboxing and a single static binary. No kernel modules.
pip install talus-process-monitordocker pull ghcr.io/hartwell-labs/talus-process-monitor:latestEvery capability below ships in the open-source core — MIT licensed, CI on every push.
Sliding-window scoring of file-operation patterns — entropy jumps, rename storms, mount probing — instead of static signature lists.
Ring-buffer eBPF pipeline sized for production fleets; watchdog-side aggregation keeps host overhead negligible.
Confident verdicts trigger immediate process kill and response hooks — containment inside the detection window.
The agent confines itself with seccomp and Landlock before touching the event stream. The sensor is not a new attack surface.
No kernel modules, no DKMS, no agent framework. Ship it with systemd, a container, or a USB stick.
Signed releases, SBOM (SPDX), build provenance and OpenSSF Scorecard on the flagship repository.