loyal-studio
Honami-Animation-System
Honami is a visual, UI-first animation system for Unity 6 that replaces Mecanim with timeline editors, node graphs, and a zero-allocation runtime, letting animators author animations with almost no code.
Process-Shield-EDR-Framework
ProcessShield is an open-source, user-mode behavioral endpoint agent for Windows that detects and contains RAT and infostealer activity using ETW monitoring, cross-signal correlation, and suspend-first quarantine.
Stars
128
7-day growth
No data
Forks
4
Open issues
0
License
MIT
Last updated
2026-07-24
AI repository intelligence
FR-AI / ANALYSISWhy it is worth attention
It combines ETW/WMI monitoring, YARA memory scanning, Authenticode trust verification, a kernel minifilter, tamper-evident audit logging, and hot-reloadable policy into a single open-source project, serving as a realistic prototype for learning and testing EDR concepts.
Who it is for
- Security researchers studying endpoint detection techniques
- Red teams evaluating behavioral detection against RATs/infostealers
- Windows endpoint administrators seeking an open-source detection tool for lab environments
- Educators and students learning about threat detection and response internals
Use cases
- Lab testing of behavioral detection against real malware samples
- Learning how ETW, WMI, and kernel minifilters integrate for process monitoring
- Evaluating tamper-evident audit log mechanisms for forensic readiness
- Practicing incident response workflows with suspend-first containment and quarantine
Strengths
- Comprehensive detection chain monitoring collect→archive→exfil with cross-signal correlation
- Suspend-first containment that freezes the process before applying firewall/quarantine, preventing PID reuse attacks
- Tamper-evident audit log with HMAC-SHA256 hash chain and integrity verifier
- Hot-reloadable configuration and policy without restarting the agent
Considerations
- Requires Administrator rights at runtime for ETW and process access
- Kernel minifilter driver cannot be loaded on production systems without Microsoft-approved signing (ELAM/WHQL)
- Base audit log key resides on disk, vulnerable to same-privilege attacker without off-box forwarding
- Archive quarantine may fail for ETW-detected files due to device path limitations
README quick start
Quick start
Description
Open Source EDR framework for new development - CLI without GUI
Related repositories
Similar projects matched by category, topics, and programming language.
aakk007
RogueCleaner
A Windows tool that detects and removes malicious leftovers from right-click menus, startup items, services, scheduled tasks, browser extensions, and file associations.
ThioJoe
Thio-Background-App-Notifier
A lightweight Windows tool that notifies you about new auto-starting background services and scheduled tasks that Windows normally doesn't alert you about.