https://github.com/greycloudss/greathelm
an open source WIP EDR
https://github.com/greycloudss/greathelm
armourer defender edr security
Last synced: 3 months ago
JSON representation
an open source WIP EDR
- Host: GitHub
- URL: https://github.com/greycloudss/greathelm
- Owner: greycloudss
- License: mit
- Created: 2025-09-08T13:22:22.000Z (4 months ago)
- Default Branch: main
- Last Pushed: 2025-10-06T23:30:15.000Z (3 months ago)
- Last Synced: 2025-10-07T01:13:03.790Z (3 months ago)
- Topics: armourer, defender, edr, security
- Language: C++
- Homepage:
- Size: 58.6 KB
- Stars: 1
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# GreatHelm
A modular, Windows-first Endpoint Detection & Response (EDR) service focused on real‑time telemetry, practical detections, and safe response actions.
> Work in progress: APIs and internals are evolving. Expect breaking changes across minor versions until v1.0.
>Part of the **Armour series**
---
## WIP Features
* **Real-time telemetry** via ETW (process/thread/image/file/registry/network) and Windows Event Log (PowerShell Operational 4103/4104).
* **Detection-first engine**: rule-based patterns (e.g., suspicious PowerShell flags), behavioral sequences (write→allocate→remote thread), and simple heuristics.
* **PowerShell visibility**: ScriptBlock logging ingestion and command-line pattern matching.
* **Pluggable responses**: terminate process, isolate host (egress block), alert/forward.
* **Efficient agent**: user-mode service, low overhead.
---
**Responses**
* `terminate` — kill offending PID/tree
* `isolate` — apply local egress deny (with allowlist)
* `alert` — push event to collector or file sink
---
## Getting Started
### Prerequisites
* Windows 10/11 or Server 2019+
* Visual Studio 2022 (v143 toolset) or compatible C++20 compiler
* Windows SDK (ETW, Event Log, Service APIs)
### Build
```bash
literally run the bat files: compileService.bat, compileAmsi.bat and then installAmsi.bat - run the service
```
---
## License
MIT — see [LICENSE](LICENSE).