#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>

SEC("tracepoint/syscalls/sys_enter_execve")
int bpf_prog(struct trace_event_raw_sys_enter *ctx) {
    char comm[16];
    bpf_get_current_comm(&comm, sizeof(comm));
    bpf_printk("[MAHZEN-AUDIT] Execve tetiklendi: %s\n", comm);
    return 0;
}
char _license[] SEC("license") = "GPL";