I actually just spent the last few months working on a new program called picosnitch that does almost exactly what you're looking for. And as you can probably tell from the name, it was inspired by Little Snitch.

It watches your system for new executables that connect to the internet, and notifies you whenever it detects the first connection from one, or when the hash changes for one it has seen before. It can also automatically check the hashes with VirusTotal. And unlike any of the other existing tools (that I know of), it can also properly detect connections from executables inside containers, although the reported exe path may be useless due to namespaces, it will still give you the correct hash.

However, where it is lacking when compared to Little Snitch is that it does not block anything, since I wanted to focus on doing performance and reliability really well, and my time is finite. Although I am open to making it easier to use in conjunction with something like fail2ban or your own custom scripts, modularity is a good thing.

I just recently got this program into a state where I feel it is ready to share, so I'd really appreciate any feedback, and am happy to discuss it further.