Malware detection using Linux perf? Anyone tried fingerprinting behavior via CPU metrics?

I came across this write-up that explores detecting malware purely through CPU performance counters using Linux’s perf tool — especially inside VM environments.

It doesn’t rely on memory or file inspection at all, just behavioral signals at the CPU level. Interesting direction, especially for detecting obfuscated/fileless payloads.

Curious if anyone here has experimented with similar techniques, or seen other research in this space?