Owlyshield - Owlyshield is an EDR framework designed to safegua

项目说明

<div id="top"></div>

Translations (obsolete):

<di="center">
<a href="
<img src="./resources/logo_transparent.png" alt="Logo" width="150" height="150">
</a>

<h2 align="center">Owlyshield</h2>
<p align="center">
An EDR framework written in Rust
</p>
<p align="center">
<img src="
<img src="
</p>

<p align="center">
:test_tube: <a href=" training data</a>
·
:book: <a href=" the Documentation</a>
·
:speech_balloon: <a href=" Feature</a>
</p>
</div>

:fast_forward: TL;DR

Owlyshield is an open-source EDR (Endpoint Detection and Response) solution for Linux and Windows servers. It analyzes how processes use files to detect intrusions through exploitation, with a particular focus on detecting Command and Control, exfiltration and impact tactics. The project is de by SitinCloud, a French company.

The main idea behind Owlyshield is to learn the normal behavior of applications (essentially trees of processes) and use this knowledge to identify weak signals of an attack through the use of novelty detection.

:question: An EDR Framework...

Owlyshield's extensibility is a key feature that sets it apart from other EDR solutions. As a framework you can add new algorithms for malware detection, UEBA (User and Entity Behavior Analytics), and novelty detection. You can also use Owlyshield to record and replay file acti for training machine learning models, as we do with our autoencoder feature.

Owlyshield provides powerful and efficient endpoint detection and response capabilities for Linux, Windows, and IoT devices. Its unique focus on file acti makes it highly effective at detecting fileless malware and C&C beacons that may go unnoticed by other EDR solutions.

<p align="right">(<a href="#top">back to top</a>)</p>

:ballot_box_with_check: ...that's comes with pre-built features

Although Owlyshield is a framework designed to be customized and extended, it also comes with pre-built, powerful features that are immediately usable :

<p align="center">
<img src="./resources/pca_3d.gif" alt="Gif Demo Owlyshield" style="align:center; width: 75%">
</p>

<p align="right">(<a href="#top">back to top</a>)</p>

:see_no_evil: Real-Life Examples

Owlyshield provides a powerful solution for detecting and responding to threats in real-time. Here are three real-life examples of how Owlyshield protected our customers:

<p align="right">(<a href="#top">back to top</a>)</p>

:arrow_forward: 2 minutes install

Installation instructions for Owlyshield can be found in the Releases section of the project's GitHub repository. For usage instructions, please refer to the project's Wiki or see the Contributing section if you prefer to build Owlyshield yourself.

<p align="right">(<a href="#top">back to top</a>)</p>

:money_mouth_face: Business

:arrow_upper_right: Free vs Pro editions

The Pro Edition (commercial edition) includes the following features:

Within the scope of free usage, we will do our best to help you find a solution for any issues you may
encounter. However, we prioritize support for subscribers to our commercial and added resellers.

:moneybag: Business model

While our products and services can be purchased directly from us (feel free
to contact us for a quotation that meets your needs), we believe that it is best for
our products to be distributed to end customers indirectly.

Please contact us if you:

<p align="right">(<a href="#top">back to top</a>)</p>

:mechanical_arm: Contributing

We offer free access to the Owlyshield Pro Edition to our contributors.

If you discover an undetected ransomware, please open an issue with the tag "undetected" to help us improve the AI
engine and understand the new techniques used to avoid detection.

If you ha on how to impro, you can fork the repository and create
a pull request or simply open
an issue with the tag "enhancement".

Don't forget to give the project a :star:! Thank you for your contributions.

To contribute:

1. Fork the project.
2. Create a feature branch: git checkout -b feature/AmazingFeature.
3. Commit your changes: git commit -m 'Add some AmazingFeature'.
4. Push to the branch: git push origin feature/AmazingFeature.
5. Open a pull request.

<p align="right">(<a href="#top">back to top</a>)</p>

:book: License

Distributed under the EUPL v1.2 license. See LICENSE.txt for more information.

<p align="right">(<a href="#top">back to top</a>)</p>

:lo: Contact

Damien LESCOS -

Project Link:

Company Link: SitinCloud

<p align="right">(<a href="#top">back to top</a>)</p>

:pray: Acknowledgments

* RansomWatch
* Beha machine activity for benign and malicious Win7 64-bit executables

<p align="right">(<a href="#top">back to top</a>)</p>

项目信息

开发语言：Rust

Star 数：435

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Owlyshield is an EDR framework designed to safeguard vulnerable applications from potential exploitation (C&C, exfiltration and impact).展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。