| Description | Requesting inclusion of procscope in Kali Linux.
Upstream:
https://github.com/Mutasem-mk4/procscope
Latest release:
https://github.com/Mutasem-mk4/procscope/releases/tag/v1.1.0
What it is:
procscope is a process-scoped eBPF runtime investigation tool for Linux malware triage, incident response, and deep
process analysis. It lets the user launch a command under observation or attach to an existing PID and collect
process, file, network, privilege-transition, and namespace activity for that process tree.
Why it belongs in Kali:
This is useful for malware analysis, incident response, reverse engineering support, and forensic investigation on
Linux systems. It fills a narrower process-scoped investigation role compared with broader system-wide runtime
security tools.
Similar tools:
- strace
- sysdig
- Falco
-
Tetragon
Key differences:
- focuses on a single process tree instead of whole-system monitoring
- produces evidence bundles and Markdown summaries
- uses eBPF for lower-overhead runtime observation
-
intended for investigation/triage, not EDR or policy enforcement
Packaging status:
- upstream repository is public
- Debian packaging exists in-tree under debian/
- DEP-8 autopkgtests exist
- man page and shell completions are included
-
Arch/BlackArch packaging also exists upstream
Repository contents:
- Debian packaging: https://github.com/Mutasem-mk4/procscope/tree/master/debian
-
Packaging docs: https://github.com/Mutasem-mk4/procscope/blob/master/docs/packaging.md
Basic usage:
sudo procscope -- /bin/true
sudo procscope -p <pid>
License:
MIT
If needed, I can help provide additional packaging validation logs, autopkgtest results, and Linux runtime smoke-test
output.
|
|---|