How to Detect Ransomware Activity on Linux with eBPF

Linux ransomware typically mimics normal processes by rapidly writing to and renaming numerous files. While traditional monitoring via /proc polling or auditd logs is often lossy and delayed, eBPF provides a superior detection method. eBPF utilizes kernel callbacks and tracepoints to offer lossless, fleet-capable monitoring without the overhead of ptrace. This technology allows for scoring the stable shape of ransomware activity, a capability integrated into Talus to eliminate the need for manual maintenance.