🛡️ ZShield — Sovereign Industrial Windows EDR + UEBA Suite

ZShield (formerly ThreatMesh) is the sovereign Endpoint Detection and Response (EDR) and User & Entity Behavior Analytics (UEBA) suite of ZeroUniverse. It transforms raw endpoint events into context-rich, explainable attack stories using Kernel ETW telemetry, in-memory process graph lineage, MITRE ATT&CK rules, statistical UEBA baselines, and active containment backed by ZeroSecurity.

---

🎯 Core Philosophy: Beyond Signature Matching

Traditional open-source security tools (Wazuh, OSQuery, Velociraptor) focus on raw log collection and static signature matching, causing severe analyst fatigue with thousands of disconnected alerts.

ThreatMesh is built around Graph-Centric Attack Storytelling:

                ┌─────────────────────────────────┐
                │ 1. Telemetry Stream (ETW/Logs)  │
                └────────────────┬────────────────┘
                                 │
                                 v
                ┌─────────────────────────────────┐
                │ 2. Telemetry Performance Gate   │
                │  • Fast Filter (< 1µs Zero-Alloc│
                │  • Hash & Reputation Cache      │
                │  • Event Coalescer (100ms Win)  │
                │  • Adaptive Resource Mgr (CPU)  │
                │  • Priority Queue (P0-P4 Budget)│
                └────────────────┬────────────────┘
                                 │
                                 v
                ┌─────────────────────────────────┐
                │ 3. In-Memory Process Graph      │
                │    (GUID Lineage & Ancestors)   │
                └────────────────┬────────────────┘
                                 │
                 ┌───────────────┴───────────────┐
                 │                               │
                 v                               v
       ┌───────────────────┐           ┌───────────────────┐
       │ 4A. Threat Engine │           │ 4B. UEBA Engine   │
       │  • Sigma / LOLBAS │           │  • Dynamic Profile│
       │  • BloomFilter IOC│           │  • Z-Score Anomaly│
       │  • Behavior Chains│           │  • Rare Execution │
       └─────────┬─────────┘           └─────────┬─────────┘
                 │                               │
                 └───────────────┬───────────────┘
                                 │
                                 v
                ┌─────────────────────────────────┐
                │ 5. Heterogeneous Entity Graph   │
                │    (User ↔ Host ↔ Proc ↔ Net)   │
                └────────────────┬────────────────┘
                                 │
                                 v
                ┌─────────────────────────────────┐
                │ 6. Explainable Risk Engine      │
                │    (0..100 + 12h Time Decay)    │
                └────────────────┬────────────────┘
                                 │
                                 v
                ┌─────────────────────────────────┐
                │ 7. Incident Story Narrative     │
                │    (Attack Timeline & Graph)    │
                └────────────────┬────────────────┘
                                 │
                                 v
                ┌─────────────────────────────────┐
                │ 8. Response Actions (Isolate/Kill│
                └─────────────────────────────────┘

---

🏗️ Solution Architecture (Universe Plugin v4.0 + Clean Layered)

ThreatMesh.sln
│
├── src/
│   ├── Shared/
│   │   ├── Edr.Shared.Contracts/       # EventEnvelope, Enums, DTOs, Story & Risk Models
│   │   ├── Edr.Shared.Common/          # HashHelper (SHA256), FastJson, Result<T>, SystemInfo
│   │   └── Edr.Shared.Universe/        # Universe Plugin v4.0 (IFeatureModule, IEventBus)
│   │
│   ├── Agent/                          # Windows Service Endpoint Agent
│   │   ├── Edr.Agent.Collectors/       # Process, File, Network, Logon, Registry, USB Collectors
│   │   ├── Edr.Agent.ProcessTree/      # In-Memory Process Tree Tracker (PID/PPID Lineage)
│   │   ├── Edr.Agent.Storage/          # Offline SQLite Ring Buffer (Network drop resilience)
│   │   ├── Edr.Agent.Transport/        # GZip-compressed HTTP batch transport client
│   │   ├── Edr.Agent.Response/         # Firewall Isolation, Process Tree Kill, Quarantine
│   │   ├── Edr.Agent.Core/             # AgentCoordinator (Bounded Channel Backpressure)
│   │   └── Edr.Agent.Service/          # Windows Background Worker Service Entrypoint
│   │
│   ├── Engines/                        # Autonomous Detection & Analytics Engines
│   │   ├── Edr.Engine.Rule/            # Sigma-compatible YAML AST compiler & LOLBAS rules
│   │   ├── Edr.Engine.Ioc/             # Sub-millisecond Radix & BloomFilter Hash/IP/Domain Matcher
│   │   ├── Edr.Engine.Behavior/        # Temporal Multi-Stage Attack Chain Correlation
│   │   ├── Edr.Engine.Ueba/            # Statistical Profiler (Z-score anomaly, rare processes)
│   │   ├── Edr.Engine.Risk/            # Explainable Entity Risk Scoring with Exponential Decay
│   │   └── Edr.Engine.Incident/        # Graph-to-Story Correlator & Mermaid Flow Generator
│   │
│   ├── Server/                         # Backend Management & Ingestion Server
│   │   ├── Edr.Server.Domain/          # Domain Entities (Endpoint, Alert, Incident, ActionLog)
│   │   ├── Edr.Server.Application/     # Ingestion Pipeline Service & Storage Abstractions
│   │   ├── Edr.Server.Infrastructure/  # SQLite / PostgreSQL Store, Action Logger
│   │   └── Edr.Server.ManagementApi/   # REST WebAPI (BaseApiController), Swagger UI & Dashboard
│   │
│   └── Web/
│       └── wwwroot/                    # Cyberpunk Dark-Themed SOC Dashboard UI
│
└── tests/
    ├── Edr.Tests.Unit/                 # Unit tests (ProcessTree, Rule, IOC, Behavior, UEBA, Risk)
    └── Edr.Tests.Integration/          # Full Pipeline Integration Tests (E2E)

---

🚀 Quickstart Guide

Prerequisites

• .NET 8 SDK
• Windows 10/11 or Windows Server (for Agent Windows Service)

1. Build and Run the Management API Server

dotnet build EdrPlatform.slnx
dotnet run --project src/Server/Edr.Server.ManagementApi

• Dashboard Web UI: http://localhost:5000 (or https://localhost:5001)
• Swagger / OpenAPI Documentation: http://localhost:5000/swagger

2. Start the Windows Endpoint Agent

Open an administrative PowerShell terminal:

dotnet run --project src/Agent/Edr.Agent.Service

The agent will:

1. Initialize local offline SQLite buffer.
2. Hook Windows WMI / EventLog collectors.
3. Continuously track process hierarchies and stream GZip-compressed batches to the server.

---

🔍 Key Capabilities

1. In-Memory Process Tree Reconstruction

Tracks parentage across PID recycling with unique GUIDs and creation timestamps:

explorer.exe (PID: 1040)
  └── WINWORD.EXE (PID: 2840)
       └── powershell.exe (PID: 4920)
            └── certutil.exe (PID: 7180) -> [Downloaded payload.exe]

2. Explainable Entity Risk Engine (XAI)

No black-box scores. Every point is explainable:

• +35 pts: LOLBAS certutil -urlcache download execution
• +50 pts: Destination IP matches known Tor Exit Node C2
• +25 pts: UEBA: User executed rare administrative tool outside baseline
• Decay: Halves every 12 hours of inactivity to prevent permanent false-positive tagging.

3. Automated Attack Story Narrative

Synthesizes correlated alerts into a chronological attack story:

• Step 1 [Initial Access]: User alice logged on at abnormal time 03:12 UTC ($Z = 3.2$).
• Step 2 [Execution]: WINWORD.EXE spawned script interpreter with Base64 payload.
• Step 3 [C2 & Impact]: Outbound connection established to 185.220.101.5:443.

4. Active Containment & Response

• Host Isolation: Drops all network traffic via Windows Firewall except EDR server communication.
• Process Tree Kill: Recursively terminates malicious processes and all spawned child processes.
• File Quarantine: Scrambles and isolates malware binaries with revoked ACL permissions.
• Audit Logging: Mandatory tracking of all issued actions in compliance with OWASP Top 10.

---

🧪 Verification & Test Results

dotnet test

Passed!  - Failed: 0, Passed: 8, Skipped: 0, Total: 8, Duration: 164 ms - Edr.Tests.Unit.dll
Passed!  - Failed: 0, Passed: 1, Skipped: 0, Total: 1, Duration: 1 s - Edr.Tests.Integration.dll
Total: 9/9 tests passed (100%)

---

📄 License

MIT License. Open-source for personal and commercial cybersecurity defense.