Security firm Cybereason has open-sourced owLSM, an EDR-like agent for Linux, an eBPF LSM agent to run Sigma rules
https://github.com/Cybereason-Public/owLSM
Sigma Rules Engine inside the Linux Kernel using eBPF. Focusing on prevention capabilities - Cybereason-Public/owLSM