talus is an endpoint detection & response agent for Linux, written in Rust.
Ransomware on Linux is usually detected when the backup job starts encrypting the backups. Talus watches file operations at the kernel level and reacts in seconds — not after the fact.
- eBPF tracepoints: execve / openat / unlink / mkdir — no kernel module, no LSM patching
- per-PID scoring with a 1-second sliding window over file-operation rates
- automated response: SIGKILL the offending process the...