Search Results for "ransomware"

talus is an endpoint detection & response agent for Linux, written in Rust. Ransomware on Linux is usually detected when the backup job starts encrypting the backups. Talus watches file operations at the kernel level and reacts in seconds — not after the fact. - eBPF tracepoints: execve / openat / unlink / mkdir — no kernel module, no LSM patching - per-PID scoring with a 1-second sliding window over file-operation rates - automated response: SIGKILL the offending process the moment the threshold breaks - per-CPU perf buffers, zero-copy handoff: ~280k events/s at ~7.6% CPU - optional neural engine (MeMLP) trained online from heuristic verdicts - self-sandboxing agent: CAP_BPF|CAP_PERFMON|CAP_NET_ADMIN, seccomp + Landlock - TUI with live syscall stream, per-PID scores and verdicts Install: pip install talus-process-monitor && talus-monitor install License: MIT — free for commercial use.