Download
talus is an endpoint detection & response agent for Linux, written in Rust.
Ransomware on Linux is usually detected when the backup job starts encrypting the backups. Talus watches file operations at the kernel level and reacts in seconds — not after the fact.
- eBPF tracepoints: execve / openat / unlink / mkdir — no kernel module, no LSM patching
- per-PID scoring with a 1-second sliding window over file-operation rates
- automated response: SIGKILL the offending process the moment the threshold breaks
- per-CPU perf buffers, zero-copy handoff: ~280k events/s at ~7.6% CPU
- optional neural engine (MeMLP) trained online from heuristic verdicts
- self-sandboxing agent: CAP_BPF|CAP_PERFMON|CAP_NET_ADMIN, seccomp + Landlock
- TUI with live syscall stream, per-PID scores and verdicts
Install: pip install talus-process-monitor && talus-monitor install
License: MIT — free for commercial use.
Features
- eBPF-based behavioral ransomware detection
- Automatic SIGKILL response in seconds
- Single static Rust binary — no kernel module
- MeMLP neural engine with online learning
- Self-sandboxing (seccomp whitelist + Landlock)1
- Live TUI monitor
Project Samples
