Neo23x0/process-watcher

Monitor linux processes without root permissions

A Linux version of the ProcDump Sysinternals tool

Sysmon for Linux

A Linux version of the Procmon Sysinternals tool

A CIA tradecraft technique to asynchronously detect when a process is created using WMI.

Monitor network traffic per executable

Detects process injection and memory manipulation used by malware. Finds RWX regions, shellcode patterns, API hooks, thread hijacking, and process hollowing. Built in Rust for speed. Includes CLI and TUI interfaces.

eBPF Security Monitoring and Sandboxing Agent Based on Aya

SysTrace - Linux System Call Monitor using PTRACE API , It traces system calls, monitors process, file, network, and memory activity, detects suspicious behavior, run target in lightweight namespace isolation , and generates detailed security reports.