Your Antivirus Only Watches. Mine Kills: Building a Detect-and-Respond Agent in Rust + eBPF
Most ransomware "solutions" stop at detection: an alert, a dashboard row, an email you'll read tomorrow. By then the attacker has already encrypted the shares. I wanted the other thing: the process dies the moment the verdict fires. This post is about how Talus does that in Rust, with eBPF doing the watching and a response layer doing the killing — and what it took to keep the whole pipeline at…
The ransomware threat requires an antivirus that takes action, not just detects and alerts. The Talus project, MIT-licensed and open source, delivers just that. It uses Rust and eBPF to build a "detect-and-respond" agent that watches kernel-level events, scores file opens in real-time, and kills ransomware processes before they can encrypt files.
Talus achieves high performance by staying in the kernel for syscall hooking, using per-CPU buffers to avoid lock contention, and employing zero-copy handoffs to userspace for minimal copying. The architecture separates kernel watching, userspace detection, and response, allowing the system to handle up to 280,000 events per second on approximately 7.6% CPU on a live desktop.
The project is flexible, allowing users to adjust thresholds for watching or auto-killing, and is documented in detail in its GitHub repository and landing page.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
