Rust eBPF Tool Detects and Kills Ransomware by Monitoring File-Open Rate

A developer has built a lightweight ransomware detection tool called talus-process-monitor, released under the MIT licence on GitHub. The program uses eBPF — a Linux kernel feature that lets small sandboxed programs attach to kernel events without loading custom modules — written in Rust using the aya library. It hooks two syscalls, execve and openat, to track how many files a single process opens per second, a key behavioural signature of ransomware. When the file-open rate crosses a configurable threshold within a one-second window, the tool automatically sends a SIGKILL signal to terminate the offending process. The approach requires no machine learning model, relying instead on a simple rate metric to catch mass file-encryption activity in real time.