A comprehensive, real-time cybersecurity solution for Windows that detects, prevents, and responds to malicious activities including malware, ransomware, keyloggers, and advanced persistent threats (APTs).
HIDR Agent is a lightweight yet powerful endpoint detection and response (EDR) tool designed for real-time threat monitoring and automated incident response. It combines behavioral analysis, file integrity monitoring, process surveillance, and automated quarantine capabilities to provide enterprise-grade security for Windows systems.
- Process Monitoring: Continuous surveillance of process creation with advanced heuristic analysis
- File Integrity Monitoring: SHA256-based hash verification with automatic backup and restore
- Behavioral Analysis: Detection of suspicious patterns including ransomware, keyloggers, and APTs
- Network Activity Monitoring: Identification of malicious network communications
- Ransomware Detection: Real-time detection of file encryption activities
- Keylogger Prevention: Identification and termination of keystroke capture attempts
- Process Injection Defense: Detection of DLL injection and process hollowing
- Rootkit Detection: Identification of system-level malware and persistence mechanisms
- Instant Quarantine: Automatic isolation of suspicious files
- Process Termination: Real-time blocking and termination of malicious processes
- File Recovery: Automatic restoration from clean backups
- Incident Logging: Comprehensive forensic trail with timestamps and details
- Live Dashboard: Real-time metrics and system status monitoring
- Event Monitoring: Color-coded process and file event tracking
- Quarantine Management: Easy management of isolated threats
- Analytics & Reporting: Interactive charts, statistics, and exportable reports
- Multi-Stage Attack Simulation: Comprehensive testing of detection capabilities
- Ransomware Simulation: File encryption and mass deletion testing
- Keylogger Simulation: Keystroke capture and data theft testing
- APT Simulation: Advanced persistent threat behavior testing
- Windows 10/11 (Administrator privileges required)
- Python 3.8 or higher
-
Clone the Repository
git clone https://github.com/SecuVortex/hidr-agent.git cd hidr-agent -
Install Dependencies
pip install -r requirements_gui.txt
-
Launch HIDR Agent
python run_gui.py
- Start Protection: Click "Start Protection" in the dashboard
- Test Detection: Use "Quick Test" to verify functionality
- Monitor Activity: Watch real-time events in the Live Monitoring tab
- Review Reports: Generate security reports in the Analytics tab
- OS: Windows 10 (1903 or later)
- RAM: 4GB minimum, 8GB recommended
- Storage: 500MB free space
- Python: 3.8+ with pip
- OS: Windows 11
- RAM: 16GB for optimal performance
- Storage: 2GB for logs and quarantine
- Network: Internet connection for threat intelligence updates
- Watched Directories: Customize monitored file locations
- Process Allowlist: Configure trusted application paths
- Detection Sensitivity: Adjust heuristic thresholds
- Quarantine Policy: Set automatic response actions
- WMI Monitoring: Enable/disable Windows Management Instrumentation
- File Hash Database: Configure integrity monitoring scope
- Network Monitoring: Set communication pattern detection
- Logging Level: Adjust forensic detail capture
- Ransomware: File encryption patterns, mass deletion, ransom notes
- Keyloggers: Keystroke capture, screen recording, clipboard monitoring
- Trojans: Remote access tools, backdoors, data exfiltration
- Rootkits: System-level persistence, process hiding, file masquerading
- Process Injection: DLL injection, process hollowing, thread hijacking
- Persistence Mechanisms: Registry modifications, scheduled tasks, startup entries
- Anti-Analysis: VM detection, debugger evasion, sandbox escape
- Lateral Movement: Network scanning, credential harvesting, privilege escalation
- Integrity Monitoring: Real-time hash verification
- Decoy System: Honeypot files for early ransomware detection
- Backup & Recovery: Automatic file restoration from clean copies
- Quarantine System: Secure isolation of suspicious files
- System Status: Current protection state and health metrics
- Live Metrics: Process events, file events, threats blocked
- Activity Log: Real-time security event stream
- Performance Monitoring: Resource usage and system impact
- Threat Timeline: Chronological view of security events
- Attack Patterns: Statistical analysis of threat types
- Risk Assessment: System vulnerability and exposure metrics
- Compliance Reporting: Security posture documentation
- Automated Containment: Immediate threat isolation
- Forensic Collection: Detailed evidence preservation
- Recovery Procedures: Automated system restoration
- Notification System: Real-time alerts and notifications
-
Quick Test
python test_attack.py
- Basic ransomware simulation
- Process injection testing
- File modification detection
-
Advanced Attack Simulation
python test_attack.py --full
- Multi-stage APT simulation
- Persistence mechanism testing
- Network reconnaissance simulation
-
Keylogger Simulation
python advanced_keylogger_sim.py --full
- Keystroke capture simulation
- Screen recording testing
- Data exfiltration simulation
- Process monitoring active
- File integrity verification working
- Quarantine system functional
- Backup/restore operational
- Real-time alerts enabled
- Reporting system active
hidr-agent/
├── gui_monitor.py # Main GUI application
├── monitor.py # Core HIDR agent engine
├── run_gui.py # Application launcher
├── test_attack.py # Attack simulation framework
├── advanced_keylogger_sim.py # Keylogger testing suite
├── interactive_report.py # Report generation system
├── requirements.txt # Core dependencies
├── requirements_gui.txt # GUI dependencies
├── watched/ # Monitored directory
│ └── decoys/ # Honeypot files
├── backups/ # Clean file backups
├── quarantine/ # Isolated threats
├── reports/ # Generated reports
└── README.md # This file
- Administrator Rights: Required for process termination and system monitoring
- Antivirus Exclusions: Add HIDR directory to AV exclusions to prevent conflicts
- Network Security: Monitor outbound connections for threat intelligence
- Data Protection: Quarantine files are encrypted and access-controlled
- Log Management: Regular rotation and secure storage of incident logs
- Update Management: Keep detection signatures and heuristics current
- Access Control: Restrict configuration changes to authorized personnel
- Backup Strategy: Regular backup of configuration and detection rules
- Threat Detection: Real-time identification of malicious activity
- Immediate Containment: Process termination and file quarantine
- System Recovery: Automatic restoration from clean backups
- Evidence Collection: Forensic data preservation and logging
- Notification: Real-time alerts to security personnel
- Threat Analysis: Review detection details and attack vectors
- Impact Assessment: Evaluate system compromise and data exposure
- Containment Verification: Confirm threat isolation and removal
- System Hardening: Apply additional security measures
- Recovery Validation: Verify system integrity and functionality
- CPU Usage: < 5% during normal operation
- Memory Footprint: < 200MB RAM usage
- Disk I/O: Minimal impact with efficient monitoring
- Network Overhead: Negligible for local monitoring
- Response Time: < 100ms for threat detection
- False Positive Rate: < 1% with tuned heuristics
- Detection Accuracy: > 99% for known threat patterns
- Coverage: Comprehensive protection across attack vectors
HIDR Agent Won't Start
- Verify administrator privileges
- Check Python installation and dependencies
- Review Windows Defender exclusions
High False Positive Rate
- Adjust detection sensitivity in configuration
- Update process allowlist with trusted applications
- Review and tune heuristic rules
Performance Issues
- Reduce monitoring scope to critical directories
- Adjust polling intervals for better performance
- Monitor system resources and optimize accordingly
Quarantine Recovery Issues
- Verify backup integrity and availability
- Check file permissions and access rights
- Review quarantine policies and procedures
- Documentation: Comprehensive guides and tutorials
- Community: User forums and discussion groups
- Issue Tracking: GitHub issues for bug reports
- Professional Support: Enterprise support options available
We welcome contributions from the cybersecurity community! Here's how you can help:
- Detection Rules: Improve heuristic accuracy and coverage
- Performance: Optimize monitoring efficiency and resource usage
- Features: Add new detection capabilities and response actions
- Testing: Expand attack simulation and validation frameworks
- Fork the repository
- Create a feature branch
- Implement changes with tests
- Submit a pull request
- Participate in code review
- Python Style: Follow PEP 8 guidelines
- Documentation: Comprehensive docstrings and comments
- Testing: Unit tests for all new functionality
- Security: Secure coding practices and vulnerability assessment
This project is licensed under the MIT License - see the LICENSE file for details.
HIDR Agent is designed for legitimate cybersecurity testing and protection purposes only. Users are responsible for ensuring compliance with applicable laws and regulations. The authors assume no liability for misuse or damage resulting from the use of this software.
- Security Research Community: For threat intelligence and detection techniques
- Open Source Projects: For foundational libraries and frameworks
- Beta Testers: For validation and feedback during development
- Contributors: For ongoing improvements and feature additions
- Project Contributors: [Lakshay Agarwal]
- Project Contributors: [Ayush Gaur]
- Project Contributors: [Ansh Pratap]
- Project Contributors: [Paras varshney]
Built with ❤️ for the cybersecurity community
Protecting systems, one threat at a time.