// HARTWELL_LABS

+/ STATUS: OPERATIONAL · EBPF_TRACING · LINUX_5.8+ · HARTWELL_LABS

TALUS_PROCESS
_MONITOR

// SYS: RUST · eBPF · GO · KERNEL_TRACING · AUTO_RESPONSE

// WHY: FILE_ENCRYPTION_EVENTS // CAUGHT_IN_KERNEL

A sliding-window heuristic over the syscalls ransomware cannot hide — execve, openat, unlink — traced live in-kernel. Detection and response in one binary, before the encryption finishes.

VIEW_SOURCE ENTERPRISE_REPORT CI_GREEN_4_WORKFLOWS

/ What it is

Talus is a Rust eBPF monitor that watches filesystem-destroying syscall patterns in real time and acts on them — no signatures, no daemon sprawl, one GHCR image. The detection core scores a sliding window over traced syscalls; when the pattern of a ransomware run shows up, response fires automatically.

Built
Rust core, Go collector, eBPF probes
Target
Linux 5.8+, CI-built GHCR image
Detection
Sliding-window heuristics, no signatures
Status
Open source, MIT, CI green

// POINTERS:

github.com/BartoszOsiej/talus-process-monitor

Enterprise upgrade report

Main site

280000
events per second
4
CI workflows green
2
languages: rust + go
1
ghcr deployable image

[01] // FEATURES

WATCH_THE_KERNEL,
KILL_FAST.

ALL_REPOSITORIES

eBPF probes

execve/openat/unlink traced live in-kernel — zero-copy ringbuffers.

RUSTEBPFKERNEL_5.8+ZERO_COPY

Sliding-window core

Heuristic scoring over syscall streams — no signatures to update.

HEURISTICREALTIMERUST

Automated response

When the ransomware pattern fires, response actions run without a human in the loop.

RESPONSEAUTOSEC

Live TUI

Terminal dashboard with the alert stream as it happens.

TUIALERTSRATATUI

GHCR deploy

CI-built container image — pull and run on any 5.8+ host.

DOCKERGHCRCI

Open source

MIT, four green workflows: Rust CI, CI, GHCR, Scorecard.

MITCI_GREENSCORECARD

[02] // DEPTH

HOW_IT
WATCHES.

ENTERPRISE_REPORT

« Encryption leaves a fingerprint in the syscall stream. Talus reads it before the last file dies. »

Probe layer — cover
Layer_01

Probe layer

eBPF programs attach to the syscall surface and stream events into ringbuffers — no LD_PRELOAD, no patching.

KERNEL_SPACE EBPF ↗
Detection core — cover
Layer_02

Detection core

Rust scores a sliding window over the stream; bulk-rename/encrypt/delete patterns rise above the noise floor.

HEURISTIC RUST ↗
Response engine — cover
Layer_03

Response engine

On detection: automated response actions plus the live TUI alert stream for the operator.

AUTO_RESPONSE TUI ↗

[03] // HUB

FIND_IT_
AROUND_THE_WEB.

▮ GitHub github.com/BartoszOsiej/talus-process-monitor ▮ Enterprise License — $35 WEEK30 code = −30% at checkout till Sat · reg. $50 · lifetime updates ▮ Support Session — $105 WEEK30 code = −30% at checkout till Sat · reg. $150 · 60-min deploy call ▮ Issues github.com/…/talus-process-monitor/issues ▮ Install — pip install talus-process-monitor talus-monitor install → prebuilt agent, no Rust toolchain ▮ Field Guide — deployment & tuning playbook install → diagnose → threshold tuning → systemd → EDR mode → runbook ▮ Talus vs Falco vs Wazuh vs Tracee comparison — which ransomware tripwire fits your fleet ▮ Changelog release history — every version, honestly documented ▮ Enterprise report bartoszosiej.github.io/talus-process-monitor/… ▮ Telegram t.me/hartwell_info ▮ Email thethreadcalls@outlook.com

[04] // SUBPAGES

DEPLOYED_ON_
GH_PAGES.

▮ / (main site) bartoszosiej.github.io ▮ /Docs bartoszosiej.github.io/Docs ▮ /linux-aegis bartoszosiej.github.io/linux-aegis ▮ /fortis bartoszosiej.github.io/fortis ▮ /externum bartoszosiej.github.io/externum ▮ /quantum-shield bartoszosiej.github.io/quantum-shield

[05] // PROOF // SHIPPED_AND_RUNNING

PROOF_OF_WORK.

Real captures from running the tool on this machine. No mockups.

talus-process-monitor running live with eBPF probes loaded
talus-process-monitorLIVE // EBPF TUI

[06] // BLOG // WRITEUPS

Write-ups live in /blog/ — full archive with reddit-grade voting, accounts and discussions under every post.