Microsoft has ported Sysmon to Linux and opened its source code.
Microsoft has ported the Sysmon system activity monitoring service to the Linux platform. The eBPF subsystem, which allows for running handlers at the operating system kernel level, is used for monitoring Linux operations. Additionally, the SysinternalsEBPF library is being developed, incorporating functions useful for creating BPF handlers for monitoring events in the system. The toolkit's code is open under the MIT license, while the BPF programs are licensed under GPLv2. In […]
