Process-Shield-EDR-Framework

ProcessShield is an open source security tool for Windows that watches running programs and tries to catch two specific kinds of malware in the act: remote access trojans, which let an attacker control a computer from a distance, and infostealers, which grab saved passwords and other credentials and send them out to an attacker. The README is upfront that this is a hardened prototype with real working parts, not a finished commercial product ready to protect a business today.

The tool works by watching Windows at a low level for suspicious chains of events, such as a program reading stored credentials and then packaging and sending data out over the network. It scores what it sees by combining multiple signals together rather than reacting to any single event, and when something looks dangerous it can pause the offending program, block it at the firewall, or move its files into quarantine. There is a text based console for security analysts to review and manage what the tool has flagged, plus an optional graphical desktop dashboard.

Under the hood, the project includes a Windows service that runs continuously with a watchdog to help it restart itself, a kernel level filter driver that can block access to sensitive files before they are opened, and an optional scanning engine using YARA, a common format for describing malware patterns in memory. All actions the tool takes are logged to a tamper evident audit trail that uses chained hashes, so someone reviewing the logs later can tell if they were altered.

The README is direct about current limitations. Two features, tamper protection and production ready driver signing, require formal approval from Microsoft that this project does not have, so those parts cannot be fully delivered outside a lab setup. Some file quarantine actions do not yet work for a specific type of file path. The project has not yet been tested against live malware samples or gone through a security review of the kernel driver.

It is built in C# and requires Visual Studio 2022 to build, with a getting started guide for setting it up, running tests, and installing it as a Windows service.