procscope

procscope is an eBPF-based process tracer for Linux that enables real-time observation of process behavior, including lifecycle events, file activity, and network connections, with minimal overhead and configuration. It is primarily designed for security researchers and incident responders to trace malware behavior and audit container workloads without the complexities of traditional monitoring tools like EDR. Notable features include support for various process-related events, file operations, and privilege transitions, allowing users to effectively monitor and analyze runtime activity.