Rustinel: Open-source endpoint detection for Windows and Linux

Rustinel is an open-source, Rust-based cross-platform endpoint telemetry agent that uses ETW on Windows and eBPF on Linux to normalize events and run detections via Sigma rules, YARA signatures, and deterministic IOCs; the article describes its user-mode design trade-offs, supported telemetry types, active response options, and current coverage gaps such as memory-only payloads and telemetry tampering.