---
layout: default
title: "procscope — eBPF Process Tracer for Linux Malware Triage"
description: "Process-scoped eBPF process tracer for Linux. Trace malware, investigate incidents, and audit process behavior without using ptrace or EDR complexity."
keywords: "eBPF, process tracer, malware triage, Linux security, incident response, golang, syscall monitoring, container security, Kubernetes"
---

<!-- Schema.org structured data for Google rich results -->
<script type="application/ld+json">
{
  "@context": "https://schema.org",
  "@type": "SoftwareApplication",
  "name": "procscope",
  "description": "Process-scoped eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network connections, file activity and privilege escalations per-process.",
  "applicationCategory": "SecurityApplication",
  "operatingSystem": "Linux",
  "programmingLanguage": "Go",
  "license": "https://opensource.org/licenses/MIT",
  "url": "https://github.com/Mutasem-mk4/procscope",
  "downloadUrl": "https://github.com/Mutasem-mk4/procscope/releases/latest",
  "codeRepository": "https://github.com/Mutasem-mk4/procscope",
  "author": {
    "@type": "Person",
    "name": "Mutasem Kharma",
    "url": "https://github.com/Mutasem-mk4"
  },
  "keywords": [
    "eBPF", "process tracing", "malware triage", "Linux security",
    "incident response", "Go", "syscall monitoring", "container security",
    "Kubernetes", "strace alternative", "runtime security"
  ],
  "offers": {
    "@type": "Offer",
    "price": "0",
    "priceCurrency": "USD"
  }
}
</script>