{"repo":"AlSch092/DetectionEngine","free":true,"listed":false,"github":"https://github.com/AlSch092/DetectionEngine","clone":"git clone https://github.com/AlSch092/DetectionEngine.git","description":"A generic detection engine (.lib) for Windows which uses downloadable custom rulesets to detect & block processes. Can be used in anti-virus, anti-cheat, anti-crypto mining, etc.","language":"C++","stars":20,"topics":["anti-virus","anticheat","detection","detection-engineering","edr","monitoring","monitoring-tool","telemetry-collection"],"license":null,"category":"analytics","readme_excerpt":"DetectionEngine What is this? A generic detection engine implemented as a static library in C++ 14 (.lib) for Windows, which uses downloadable custom rulesets to detect and block processes. Can be used in anti-virus, anti-cheat, anti-crypto mining, etc. The code has been tested for memory & resource leaks, and can run successfully as a Windows Service for multiple weeks at a time. It uses as little CPU as possible, and most often never goes above 3% usage (tested on an Intel 6700K). WoW64 and 32-bit build are supported for most, if not all detections. The program makes use of inheritance, where a Detection base ( IDetector ) is derived from to create each specific detection. Settings for each detection are created in a .JSON file which is grabbed over HTTP at runtime, allowing you to add new detection fragments without re-compiling the program (for example, you can add or remove blacklisted CRC32's on the server-side). The library can be combined with other libraries, such as UltimateDRM (in this case, using both DetectionEngine and UDRM will give you a crude anti-cheat/anti-virus program). Included Detections - ByteSignatureScan.hpp - Byte pattern in process .text - CommandLineScan.hpp - Command line of process - CoreIsolationScan.hpp - Check if HVCI is enabled - DriverSignatureEnforcementScan.hpp - Check if DSE/Test mode is enabled - FileHashScanner.hpp - Check CRC32 of files & processes - HypervisorScan.hpp - Check if system running under hypervisor - IATScan.hpp - Check i","default_branch":null,"files":null,"tree":[],"storefront":"/r/AlSch092","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/AlSch092/DetectionEngine/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}