View Issue Details

IDProjectCategoryView StatusLast Update
0009645Kali LinuxNew Tool Requestspublic2026-04-17 21:03
Reportermutasem Assigned To 
PrioritynormalSeverityminorReproducibilityhave not tried
Status newResolutionopen 
Summary0009645: New tool request: procscope
Description

Requesting inclusion of procscope in Kali Linux.

Upstream:
https://github.com/Mutasem-mk4/procscope

Latest release:
https://github.com/Mutasem-mk4/procscope/releases/tag/v1.1.0

What it is:
procscope is a process-scoped eBPF runtime investigation tool for Linux malware triage, incident response, and deep
process analysis. It lets the user launch a command under observation or attach to an existing PID and collect
process, file, network, privilege-transition, and namespace activity for that process tree.

Why it belongs in Kali:
This is useful for malware analysis, incident response, reverse engineering support, and forensic investigation on
Linux systems. It fills a narrower process-scoped investigation role compared with broader system-wide runtime
security tools.

Similar tools:

  • strace
  • sysdig
  • Falco
  • Tetragon

    Key differences:

  • focuses on a single process tree instead of whole-system monitoring
  • produces evidence bundles and Markdown summaries
  • uses eBPF for lower-overhead runtime observation
  • intended for investigation/triage, not EDR or policy enforcement

    Packaging status:

  • upstream repository is public
  • Debian packaging exists in-tree under debian/
  • DEP-8 autopkgtests exist
  • man page and shell completions are included
  • Arch/BlackArch packaging also exists upstream

    Repository contents:

  • Debian packaging: https://github.com/Mutasem-mk4/procscope/tree/master/debian
  • Packaging docs: https://github.com/Mutasem-mk4/procscope/blob/master/docs/packaging.md

    Basic usage:
    sudo procscope -- /bin/true
    sudo procscope -p <pid>

    License:
    MIT

    If needed, I can help provide additional packaging validation logs, autopkgtest results, and Linux runtime smoke-test
    output.

Activities

There are no notes attached to this issue.

Issue History

Date Modified Username Field Change
2026-04-17 21:03 mutasem New Issue