Live exec-provenance monitor. Flags execs from tmp/shm, fileless binaries, and setuid privilege jumps, all in-kernel.
By chatting or signing in you agree to the Terms and chat-message logging (revocable in History).