Disclaimer: I'm the author of Grapl[0], which aims to do what you're talking about. Normally I don't really comment on the product on HN, but you're describing

Disclaimer: I'm the author of Grapl[0], which aims to do what you're talking about. Normally I don't really comment on the product on HN, but you're describing Grapl's raison d'être. So, audit is one subsystem people use. ebpf is another. OSQuery[1] is a tool that'll make it pretty easy to hook into audit and collect things like process executions. Once you have instrumentation you want to start writing those rules. This is where systems like ElasticSearch, Splunk, or in the case of my product, Grapl, come in. What Grapl makes particularly easy, and what other systems make quite hard, is the type of detection you're talking about - process tree analysis, or generally any kind of analysis that spans many events/ entities. This is because Grapl will take the instrumentation output and generate a graph, which makes joins across the data quite efficient, and it exposes the graph via Python, so you can express pretty arbitrary logic. Other systems make joins quite painful and slow[2][3] Grapl's not at the point where a power user could just get it up and running - though it will be very soon. I've written detection logic very much like what you're describing though[4]. Linux is actually doing fairly well here, in my opinion. OSX was probably the worst, but the ESF will change this. Windows, with Sysmon, is still probably the simplest and best solution for instrumentation (though ETW is pretty strong too). [0]https://github.com/insanitybit/grapl https://github.com/insanitybit/grapl [1]https://osquery.readthedocs.io/en/stable/ https://osquery.readthedocs.io/en/stable/ [2]https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchTutorial/Useasubsearch https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchTut... (ctrl + f 'In large production environments, it is possible that the subsearch in this example will timeout before it completes.') [3]https://www.elastic.co/guide/en/elasticsearch/reference/current/parent-join.html#_parent_join_and_performance https://www.elastic.co/guide/en/elasticsearch/reference/curr... [4] https://github.com/insanitybit/grapl-analyzers/blob/master/analyzers/suspicious_svchost/main.py#L9 https://github.com/insanitybit/grapl-analyzers/blob/master/a... , https://github.com/insanitybit/grapl-analyzers/blob/master/analyzers/word_child_process/main.py#L8 https://github.com/insanitybit/grapl-analyzers/blob/master/a...