runfrom
JavaScript
★ 1
updated 16d ago
Live exec-provenance monitor. Flags execs from tmp/shm, fileless binaries, and setuid privilege jumps, all in-kernel.
No plain-English explanation yet — one is being written right now. Check back in a minute.