Standard antivirus software scans static files on disk. ProxSuite Community Edition v3.2 inspects live process RAM,
.text Module Stomping, Process Ghosting, ntdll.dll syscalls, LOLBAS command lines, DNS DGA tunneling, and kernel ETW-TI streams with Hot-Reloadable JSON IOC Rules and SIEM/Webhook streaming. 100% Free & Open Source under MIT License.
| Engine Module | Severity | Target Process / Artifact | Forensic Telemetry & Syscall / Memory Details |
|---|
Filter by security domain below to explore how ProxSuite inspects every layer of Windows from user-mode RAM down to kernel ETW-TI, LOLBAS command lines, and DNS DGA tunneling.
Audits live ntdll.dll syscall stubs (4C 8B D1 B8) for user-mode rootkit/AV hooks and detects comsvcs.dll LSASS MiniDump attacks.
Scans MEM_PRIVATE RWX/WC regions across all processes for unbacked MZ/PE headers and reflective shellcode prologues with Authenticode JIT filtering.
Catches droppers that execute and immediately self-delete by cross-referencing Kernel BAM registry paths, Windows Prefetch (.pf), and USBSTOR history.
Monitors Chrome, Brave, Edge, Discord, Telegram, Exodus, and Electrum vaults while hunting unsigned Temp-staged infostealer processes.
Maps active TCP connections via native GetExtendedTcpTable to owning PIDs, flagging Metasploit/RAT ports and LOLBIN outbound sockets.
Inspects HKCU & HKLM registry startup vectors for encoded PowerShell, CMD, MSHTA, and AppData Roaming persistence.
Checks all loaded kernel drivers against the LOLDrivers vulnerable driver database (rtcore64.sys, gdrv.sys, dbutil_2_3.sys) and non-System32 rootkit paths.
Verifies ntdll!EtwEventWrite and amsi!AmsiScanBuffer prologues to detect single-byte 0xC3 RET telemetry blinding patches.
Exposes hidden Windows Defender exclusion folders added by stealers and audits System32\drivers\etc\hosts for security sinkholes.
Hunts silent Image File Execution Options (IFEO) debugger hijacks and unauthorized Winlogon\Shell replacements.
Audits & applies LSASS RunAsPPL, WDigest disabling, Event 4104 logging, Credential Guard (VBS), HVCI, UEFI Secure Boot, ASR, UAC, and PowerShell CLM.
Computes file Shannon Entropy (0.00 - 8.00) and SHA-256 hashes to detect UPX, Themida, VMProtect, or custom crypters.
Extracts binary EXIF tags, decodes GPS coordinates with live street reverse-geocoding, detects AI provenance, and carves hidden post-EOF steganography payloads.
Enumerates root\subscription & root\default to catch fileless CommandLineEventConsumer and ActiveScriptEventConsumer backdoors.
Scans \\.\pipe\ for Cobalt Strike (MSSE-*, postex_*), Sliver (status_*), Havoc, and Covenant C2 channels invisible to TCP monitors.
Inspects process tokens via GetTokenInformation to flag non-system processes holding SeDebugPrivilege, SeTcbPrivilege, or SeLoadDriverPrivilege.
Audits HKCU\Software\Classes\CLSID InprocServer32 registrations for unsigned or Temp-staged DLL overrides with Authenticode filtering.
Analyzes Chrome, Edge, and Brave extension manifests for high-risk stealer permissions and rogue off-store update_url servers.
Scans live LOLBIN process memory for Discord webhooks, Telegram bot C2 endpoints, Ngrok tunnels, and reflective PowerShell stagers.
Correlates anomalies across all active engines to automatically detect multi-stage Cobalt Strike, credential dumping, and stealer attack chains.
Deploys monitored canary files to detect ransomware encryption instantly while guarding your clipboard against BTC/ETH/USDT wallet address swaps.
Detects Module Stomping (.text byte mismatch vs. disk), Process Ghosting & Herpaderping, and unbacked thread Win32StartAddress call-stack spoofing.
Audits WMI\Autologger kernel/security ETW sessions against rootkit blinding and inspects live Event ID 7045 kernel service/driver loads.
Audits Lsa\Security Packages against SSP DLL injection (mimilib) and catches LOLBINs loading dbgcore.dll for PssCaptureSnapshot dumps.
Hardens own process security, locks binary with FILE_SHARE_READ, hot-reloads prox_rules.json, and streams CEF/JSON SIEM alerts.
1-click SHA-256 hash lookup querying the official VirusTotal v3 REST API (or instant browser fallback) directly from selected telemetry rows.
Real-time 0–100 risk scoring across running processes combining network sockets, unsigned code, Temp/AppData launch, Shannon entropy, and parent PID anomalies.
Moves active malware into %ProgramData%\ProxQuarantine encrypted via reversible multi-byte XOR (.pqv / .pqm) with 1-click restoration.
Periodically ingests active Botnet & C2 IP feeds from Feodo Tracker and SSLBL, correlating against open ESTABLISHED TCP sockets in real time.
Performs zero-knowledge k-Anonymity (5-character SHA-1 prefix) queries against HaveIBeenPwned to verify password leaks without exposing credentials.
Integrates natively with Windows Task Scheduler to trigger headless daily /autoscan runs, producing Executive HTML dashboards and SIEM dispatches.
Low-overhead FileSystemWatcher watching Documents, Desktop, and Downloads for rapid mass extension shifts (5+ in 10s) with automated NtSuspendProcess freezing.
Visualizes parent-child execution chains as an ASCII attack graph via WMI and provides an encrypted Dark / Minimal Light theme switcher.
WMI MITRE ATT&CK command-line auditor flagging LOLBIN abuse (certutil -urlcache, powershell -enc, mshta, rundll32 Squiblydoo, bitsadmin, wmic).
Audits active DNS client resolution cache, computes Shannon entropy on root labels, and exposes DGA botnet domains (>3.85 entropy) and DNS tunneling exfiltration.
See how ProxSuite PRO (Apex v3.2 Enterprise) compares against Windows Defender, Malwarebytes, Bitdefender, Kaspersky, CrowdStrike Falcon, and Sysinternals across 15 critical threat-hunting vectors.
| Forensic Capability / Attack Vector | ⚡ ProxSuite PRO v3.2 (33-in-1) | 🛡️ Windows Defender | 🦠 Malwarebytes Premium | 🔒 Bitdefender / Kaspersky | 🦅 CrowdStrike / SentinelOne | 🧰 Sysinternals Suite |
|---|---|---|---|---|---|---|
| Unbacked Private RWX Memory & Process Hollowing | ✓ Live MZ/PE & Shellcode RAM Scanner | ✗ Bypassed via AMSI/ETW patch | ⚠️ Signature / heuristic only | ⚠️ Misses custom LOLBIN hollowing | ✓ Kernel sensor (Enterprise) | ✗ Manual hex dump required |
| Module Stomping (.text), Process Ghosting & Herpaderping | ✓ Disk vs. RAM .text Diff & Thread Stack Audit | ✗ Trusts MEM_IMAGE backed modules | ✗ Blind to Module Stomping | ✗ Misses Herpaderped PE headers | ✓ Kernel image telemetry | ✗ None |
| NTDLL Syscall Unhooking & SSN Prologue Audit | ✓ Audits 4C 8B D1 B8 & SSNs live | ✗ Blind to user-mode NTDLL hooks | ✗ Not inspected | ✗ No user-visible syscall audit | ⚠️ Internal sensor only | ✗ Requires WinDbg |
| LSASS Deep Shield (SSP Injection, PssCaptureSnapshot & comsvcs) | ✓ LSA SSP Audit + Snapshot/dbgcore Hunter | ⚠️ Bypassed when RunAsPPL is off | ✗ No LSA SSP registry verification | ⚠️ Partial LSASS protection | ✓ Enterprise credential guard | ✗ Manual inspection only |
| AMSI & ETW Single-Byte (0xC3 RET) Patch + AutoLogger Audit | ✓ Byte Prologue + Kernel AutoLogger Check | ✗ Blinded once patched in RAM | ✗ No prologue verification | ✗ Not reported to user | ⚠️ Partial TI-ETW | ✗ None |
| Self-Deleting Droppers (Kernel BAM & Prefetch) | ✓ GhostTrace BAM + .PF Post-Mortem | ✗ Reports "0 Threats" if file deleted | ✗ Only scans existing files on disk | ✗ Misses post-execution deleted files | ✓ Cloud EDR timeline | ✗ No automated BAM correlation |
| Cobalt Strike / Sliver / Havoc / BRC4 Named Pipe C2 | ✓ Dedicated \\.\pipe\ C2 + Dynamic Rules | ⚠️ Basic static signatures | ✗ Checks TCP/IP web domains only | ✗ Network socket focus only | ✓ Enterprise IPC telemetry | ⚠️ Lists raw pipes without C2 rules |
| LOLBIN RAM Discord / Telegram Webhook C2 Scan | ✓ Live RAM String IOC Hunter | ✗ HTTPS traffic looks like normal chat | ✗ Cannot block legitimate Discord API | ✗ Allows outbound HTTPS to Discord | ⚠️ Requires custom YARA rule | ⚠️ Manual Strings search per PID |
| Vulnerable Kernel Drivers (BYOVD / LOLDrivers + Event 7045) | ✓ Built-in LOLDrivers + Kernel Event 7045 | ⚠️ Blocklist often disabled by admin | ✗ Trusts signed WHQL drivers | ✗ Trusts valid digital signatures | ✓ Kernel driver telemetry | ⚠️ Shows drivers without CVE match |
| Fileless WMI Subscriptions & HKCU COM Hijacks | ✓ Authenticode-Filtered Zero-FP Audit | ⚠️ Misses custom HKCU InprocServer32 | ⚠️ Scans standard Run keys only | ⚠️ Partial startup inspection | ✓ Full persistence telemetry | ⚠️ Dumps 4,000+ noisy legit rows |
| Self-Defense (Kernel DACL Anti-Kill + Binary File Lock) | ✓ Deny Terminate/VM_Write DACL + File Lock | ⚠️ Bypassed via Exclusion/Tamper scripts | ⚠️ Service can be stopped by Admin | ✓ Kernel self-protection driver | ✓ Enterprise tamper protection | ✗ Easily killed by any malware |
| Hot-Reloadable Dynamic IOC Rules & SIEM / Webhook Streaming | ✓ prox_rules.json + CEF/Webhook & EventLog | ✗ No custom user JSON rules or Webhook | ✗ Closed signatures, no SIEM webhook | ✗ Consumer tier lacks SIEM/Webhook | ✓ Enterprise SOC console | ✗ None |
| Real-Time Crypto Clipboard Hijack Shield | ✓ 600ms BTC/ETH/USDT Vault & Revert | ✗ Zero clipboard protection | ✗ Zero clipboard protection | ✗ No wallet auto-restore | ✗ Not built for crypto traders | ✗ None |
| RAM Footprint & System Performance Impact | ~95 KB EXE / ~25 MB On-Demand | ~350 MB RAM (Constant CPU spikes) | ~450 MB RAM + Background Service | ~700 MB RAM + Heavy Filter Drivers | ~300 MB RAM + 24/7 Cloud Upload | ~45 MB (20 separate binaries) |
| Licensing Cost & Availability | $24.99 One-Time (or 24h Free Trial) | Included in OS (#1 Bypass Target) | $44.99 - $59.99 / Year Subscription | $59.99 - $89.99 / Year Subscription | $100+ / Endpoint / Year (Corp Only) | Free (Manual CLI/GUI tools) |
No bloated installers, no registration forms, zero telemetry tracking, and 100% verified clean by Windows Defender.
Download ProxSuitePRO.exe directly (or the source package) and run it as Administrator on Windows 10/11 x64.
Boot directly to the Command Center and launch any of the 35 built-in forensic engines — from NTDLL unhooking to LOLBAS & DGA detection.
Generate an executive dark-mode HTML report in 1 click or stream real-time JSON alerts to your SOC SIEM / Webhook.
ProxSuite is permanently free and open source. All 35 enterprise forensic & EDR modules are fully unlocked with zero DRM, zero paywalls, and zero cloud lock-in.
/srccsc.exe (Zero Visual Studio required)prox_rules.jsonprox_rules.json without recompiling the executable. SOC analysts can also stream alerts in real time to Windows EventLog (Event ID 2050) and any HTTP/HTTPS Webhook (Splunk, Elastic, Discord, or Slack).