Kestrel is a self-hosted endpoint detection and response (EDR) product for Windows, built to catch infostealers (Lumma, Vidar, StealC, Rhadamanthys and similar malware) while they work. These programs read browser passwords, cookies, crypto wallets and messenger sessions, then upload them. Kestrel watches for exactly that behaviour, contains the process, and gives IT one incident that says what was taken and what to rotate.
Since v1.1 it also covers the steps around a hands-on intrusion: ransomware preparation and encryption, credential dumping (LSASS, hives, NTDS) and persistence (Run keys, Startup, tasks, services, WMI, IFEO, Winlogon, COM), plus a curated SigmaHQ pack in Audit.
It has four parts:
- Agent (
kestrel-agent): a Windows service written in Rust. It reads ETW sensors, runs the detection engine on the device, and contains threats.
- Server (
kestrel-server): one Docker Compose stack per organisation, with PostgreSQL and optional ClickHouse. All telemetry stays on your own infrastructure.
- Admin console: a React app served by the server.
- Tray app: a small Tauri app for employees. It shows status, explains blocks in plain language and lets the employee request a review. An IT technician can turn protection off for a limited time from the tray with the device's uninstall token (detection only by default; every turn-off is a
TP-06 alert and an audit entry, and IT can turn it back on from the console).
Status: v1.1.7 (release candidate), user-mode only. Validated on Windows 11 (26100) in a disposable lab VM. Read the limits section before you rely on it.
Screenshots
Console screenshots use the built-in demo data (npm run dev:mock). The tray and remote-desktop images marked "real" come from a Windows 11 lab VM. Every console page, in light and dark, is in the console tour.
What it does
- Detection on the device. 55 built-in behavioural rules: stealer (
ST-01…ST-16), ransomware (RW-xx), credential dumping (CD-xx), persistence (PS-xx) and tamper (TP-01…TP-06), plus 70 SigmaHQ rules in Audit. They run in the agent, so detection and containment still work while the device is offline.
- Suspend on suspicion. When an untrusted process opens a credential store or decrypts browser secrets with DPAPI, the agent freezes it for a short window (3 s by default). It kills the process if a stronger rule confirms the theft, and resumes it otherwise.
- Response actions. These can be automatic (rules in Protect mode) or issued by an analyst from the console:
- kill or suspend/resume a process or process tree
- quarantine a file into an encrypted vault, then restore or delete it
- block a destination IP or an image's network access through WFP
- isolate the host so that only the Kestrel server stays reachable (released automatically after
isolation_auto_release_hours without server contact, default 72 h; local break-glass kestrel-agent release-isolation --token …)
- scan with YARA-X
- collect a triage package
- re-apply hardening
This is the beginning of the README. Read the rest at the original. Read the full README ↗
