---
sidebar_position: 7
title: runfrom
---

# runfrom

> Every exec on your box, live. Catch the ones that shouldn't be running.

`runfrom` is a live exec-provenance monitor that catches every process launch system-wide and flags code running from scratch directories, binaries with no name on disk, and setuid privilege jumps — all caught in-kernel before the process gets a chance to run. One `tp_btf/sched_process_exec` probe captures the full `{parent, program, path, identity, inode}` tuple with no polling, no ptrace, no audit daemon.

## Running

```sh
yeet run github:yeet-src/runfrom
```

Pipe for a one-shot snapshot, or stream raw JSON:

```sh
yeet run github:yeet-src/runfrom | less -R
yeet run github:yeet-src/runfrom/dump.js | jq -c 'select(.ephemeral or .fileless)'
```

## Source

[`yeet-src/runfrom`](https://github.com/yeet-src/runfrom) on GitHub.