AEGIS — Open-Source Autonomous Ransomware Defense and EDR Platform

AEGIS is an open-source, self-hosted autonomous defense platform that detects ransomware, lateral movement, and intrusions in real time — without depending on a cloud AI service.

It owns your firewall, watches your logs, runs deception honeypots, and evaluates 163 enabled Sigma rules + 4 chain detections in <1 ms per event. When it sees an attack — brute-force, shadow-copy delete, mass file encryption, ransom note drop, SMB lateral movement — it auto-blocks the attacker IP and writes a structured incident postmortem. Process termination and snapshot recovery are in development (gated by AEGIS_REAL_RECOVERY=1).

The enabled count is the number of enabled: true files under backend/app/rules/sigma/. Of the 163, 42 are endpoint rules (process command lines, file, registry, DLL-load, service-install, RDP-logon and canary detections) and 8 more match outbound connections (2 port heuristics and 6 C2 indicator lists). These see events only when an AEGIS endpoint agent (node-tauri or the Python agent) reports for the host, or, for process/file events and IOC peers, on the AEGIS host itself through its built-in host monitor. With no agent enrolled they evaluate nothing on your endpoints. Several sensors are opt-in builds (node-tauri's ETW/eBPF feature supplies file, registry, DLL-load and connection events; release builds send process start/stop only). Each disabled rule says in its description what agent change or external log source would revive it.

Set AEGIS_AI_MODE=disabled and the entire stack runs on deterministic rules and Jinja2 templates. AI enrichment is available but never required.

Three modules:

• Surface — attack-surface management (nmap + nuclei, scheduled scans, CVSS history)
• Response — fully autonomous incident response: confirmed threats block permanently, unconfirmed ones block provisionally and expire themselves (see Autonomous Response)
• Phantom — deception layer (SSH honeypot on :2222, HTTP decoy on :8888, breadcrumb credential traps)

git clone https://github.com/alejadxr/AEGIS.git && cd AEGIS
docker compose up -d
# Dashboard: http://localhost:3007 · API: http://localhost:8000

AEGIS v1.6 ships 12 ransomware-specific Sigma rules + 1 kill-chain mapped to MITRE ATT&CK techniques T1490, T1486, T1105, T1218, and T1021. The correlation engine evaluates each event in <1 ms using an O(1) type-indexed rule lookup.

Specific behaviors detected:

• Shadow-copy deletion — vssadmin delete shadows, wbadmin delete catalog, bcdedit /set {default} recoveryenabled No, tmutil, btrfs snapshot delete
• Mass file encryption — ≥50 write events/second via the Rust endpoint agent; entropy analysis (≥7.5 bits/byte) is in development
• Canary file trips — 10 hidden sentinel files in Documents/Desktop/Downloads; any modification triggers an immediate critical incident
• Ransom note drop — filename pattern detection for README.txt, HOW_TO_DECRYPT, RECOVER_FILES, and 40+ known ransom note variants
• LOLBin staging — certutil -urlcache, rundll32 abuse for payload delivery (MITRE T1105/T1218)
• RDP-then-encrypt lateral movement — T1021.001 RDP session followed by encryption events on the same host
• SMB lateral movement — T1021.002 file-share writes to remote hosts
• WinRM remote execution — T1021.006 wsmprovhost.exe spawning suspicious child processes

The RaaS threat intel feed (refreshed every 6 hours from RansomLook + CISA) supplies current C2 IP ranges, onion addresses, file extensions, and ransom note artifacts for known groups: LockBit, Akira, REvil, BlackCat/ALPHV, Babuk, Conti, WannaCry, and others.

Yes. Set AEGIS_AI_MODE=disabled and every AI call site falls back to a deterministic path:

The RaaS intel feed, Sigma rules, chain detections, and all firewall blocking continue to operate with no external API calls.

See the comparison table below. The short answer: AEGIS trades unlimited enterprise scale for deterministic-first detection at machine speed and zero licensing cost.

Yes. AEGIS is tested in production on a Mac Pro (FastAPI + Next.js via PM2) with a Raspberry Pi 5 as a Tailscale relay. A Mac mini, a Pi, or any Linux VPS with Docker is sufficient. The Rust endpoint agent builds for macOS arm64, Linux x64, and Windows x64.

• Docker + Docker Compose (for the full stack)
• 2 GB RAM minimum; 4 GB recommended
• AEGIS_REAL_FW=1 + root/sudo for real pfctl/iptables enforcement (optional — defaults to in-memory NoopFirewall)
• No external services required in offline mode

v1.6 ships full ransomware defense end-to-end. Everything below ships in the open-source free tier.

12 Sigma rules cover the complete ransomware kill-chain:

Chain rule ransomware_chain: fires a CRITICAL incident when ≥3 of the above rules trigger for the same host within a 10-minute window.

• Source: RansomLook API + CISA Known Ransomware Advisories
• Refresh interval: every 6 hours (with offline cache)
• Per-group data: aliases, C2 IPs, onion addresses, known file extensions, ransom note artifacts
• Groups tracked: LockBit, Akira, REvil, BlackCat/ALPHV, Babuk, Conti, WannaCry, Locky, and 20+ others
• Cached to backend/app/data/raas/*.json — survives restarts

# Query recovery options for an incident
GET /api/v1/ransomware/recovery-options/{event_id}

# Trigger restore from snapshot
POST /api/v1/ransomware/restore

# Look up decryptors (NoMoreRansom seed)
GET /api/v1/ransomware/decryptors

SnapshotManager wraps: tmutil (macOS), btrfs/zfs (Linux), VSS via Rust agent (Windows), Noop (default). Gated by AEGIS_REAL_RECOVERY=1.

DecryptorLibrary ships a NoMoreRansom seed list for: Akira, Babuk, REvil, LockBit, WannaCry, Conti, Locky, and others.

The hardened Rust agent in agent-rust/ provides:

• Canary watcher — filesystem notify on 10 hidden sentinel files
• Entropy classifier — sliding-window entropy analysis (mean ≥7.5 bits/byte at ≥50 writes/s) is in development
• Process killer — forensic snapshot captured before SIGKILL (Linux) / TerminateProcess (Windows)
• Self-protection — prctl(PR_SET_DUMPABLE, 0) on Linux; SetProcessMitigationPolicy on Windows
• Rollback — calls SnapshotManager via API (gated by AEGIS_REAL_RECOVERY=1)

The node agent (node-tauri/) is one binary with an optional GUI console. An endpoint sensor has to run with the screen locked, before login and on servers, so the window is not required:

aegis_node --headless          # or AEGIS_NODE_HEADLESS=1; no window, no tray. Ctrl-C to stop
aegis_node --install-service   # Windows, elevated prompt: registers "AEGISNode" (LocalSystem, auto-start, restart on failure)
aegis_node --uninstall-service # Windows, elevated prompt
sc start AEGISNode

• Headless logs to <data dir>/logs/aegis-node.log (rotated at 10 MB; AEGIS_NODE_LOG=debug raises verbosity). The Node agent started -- ... code: C6-XXXX-XXXX line and every regenerated enrollment code are logged there.
• Data directory: Windows GUI %APPDATA%\aegis-node; Windows headless/service %ProgramData%\aegis-node (restricted to SYSTEM and Administrators, since it holds the node token); macOS/Linux ~/.config/aegis-node in every mode.
• As a service, ransomware canaries are seeded and watched in every real user profile under C:\Users (Documents, Desktop, Downloads), not in the SYSTEM profile. Profiles created after start are picked up on the next restart.

/dashboard/ransomware provides:

• RaaS group activity timeline (recharts)
• Recent ransomware events table with MITRE technique links
• Decryptor lookup widget (NoMoreRansom)
• Recovery options panel per incident

AEGIS_LIVEFIRE=1 python -m pytest backend/tests/e2e/test_livefire.py

Generates 100 entropy-padded dummy files in a tempdir, drops a ransom note, races the agent. Asserts: kill within 500 ms, incident reaches API, chain rule fires, ≥1 recovery snapshot available, synthetic C2 IP blocked.

Where AEGIS wins: solo operators, indie SaaS teams, and homelabs that need deterministic ransomware kill-chain detection with sub-50 ms automated blocking and zero per-seat licensing. docker compose up -d and you have rules + honeypots + firewall enforcement in 3 minutes.

Where to choose Wazuh/Elastic instead: large multi-site enterprise deployments, regulated environments requiring Magic-Quadrant vendor relationships, or teams with dedicated SOC staff.

See docs/seo/comparison.md for the full side-by-side analysis.

Every detection capability tested against real attack patterns:

Prerequisites: Docker and Docker Compose.

git clone https://github.com/alejadxr/AEGIS.git
cd AEGIS

# Configure
cp .env.example .env
# Edit .env — set AEGIS_SECRET_KEY and POSTGRES_PASSWORD at minimum
# OPENROUTER_API_KEY is optional; omit it and AEGIS runs fully offline

# Launch
docker compose up -d

# Dashboard at http://localhost:3007
# API at http://localhost:8000

No default credentials. The setup wizard at /setup walks you through creating your admin account.

# Backend
cd backend && pip install -r requirements.txt
uvicorn app.main:app --host 0.0.0.0 --port 8000

# Frontend
cd frontend && npm install && npm run build && npm start

AEGIS is built to run unattended, so it does not hold decisions for an operator. An approval queue on an unwatched system is not caution — it is an attacker walking free while rows accumulate in a dashboard nobody is reading.

What replaces human review is reversibility, not confidence:

A confirmed attack is a judgement the system can stand behind indefinitely. An unconfirmed one is a guess, and a guess made with nobody watching has to be able to undo itself. A genuinely hostile source re-offends and is re-blocked — usually with the evidence to confirm it permanently the second time. A false positive clears on its own instead of quietly locking a real user out forever.

The expire_provisional_blocks job runs every 10 minutes and is the only thing that undoes an autonomous mistake. Safe IPs are never blocked at all, by either path — they short-circuit in the guardrail before any verdict is reached.

The shipped thresholds are conservative defaults, not calibrated values. Calibrate against your own traffic before enabling AEGIS_DOS_MODE=active, and separate browsers from tooling by user-agent when you do — mixing them makes the numbers meaningless.

On the reference deployment (50,395 events, 1,238 IPs), that separation produced a clean gap:

real browsers   ──►  5.7 rps max   (p99 4.8, across 3,245 windows)
                        │
                 35 rps │ ← per_ip threshold: 6.1x the browser ceiling
                        │
scanners/bots   ──► 42-77 rps

Two traps worth knowing before you trust your own numbers:

• Shared NAT collapses the signal. The largest burst in that dataset (77 rps) looked like heavy dashboard use but was a pentest box egressing through the same NAT as the admin workstation. Per-IP rate alone cannot separate them.
• A polling dashboard raises your own floor. If your legitimate traffic approaches the threshold, the fix is not a bigger number — it is limiting public paths separately from authenticated ones (AEGIS_DOS_EXPENSIVE_PATHS).

Incoming Event
     |
[Layer 1] Attack Detector Middleware ──────────── runs on EVERY request
     |     6 regex categories + double URL-decode + breadcrumb detection
     |     Auto-block after 3 attacks/IP (5 min sliding window, <1 ms detection)
     |
[Layer 2] Log Watcher ────────────────────────── PM2/journalctl log tail
     |     7 security patterns, brute-force tracker, rate limiter
     |
[Layer 3] Sigma Correlation Engine ───────────── event correlation
     |     163 enabled Sigma rules + 4 chain rules + campaign tracker
     |     O(1) type-indexed lookup, 10K event sliding window
     |
[Layer 4] Response Engine (dual-mode) ──────────── classification + decision
     |     Fast path: Sigma → IOC cache → Playbook → done (<1 ms)
     |     AI path: triage → classify → incident → actions (2–5 s, optional)
     |     MITRE ATT&CK mapping on every incident
     |
[Layer 5] Auto-Response ──────────────────────── execution
          10 deterministic playbooks (<50 ms each)
          Verdict: confirmed → permanent block | unconfirmed → provisional (self-expiring)
          Guardrails gate each action type; safe IPs short-circuit before any verdict
          Three-layer blocking: external agent → FastAPI 403 → local pfctl/iptables

+-------------+     +---------------+     +----------------+
|   Desktop   |     |   Dashboard   |     |   Node Agent   |
|   Manager   |     |   (Next.js)   |     |  (Tauri+Rust)  |
|   (Tauri)   |     |   Port 3007   |     |   Per-host     |
+------+------+     +-------+-------+     +-------+--------+
       |                    |                      |
       +---------+----------+----------------------+
                 |
          REST API + WebSocket (real-time push)
                 |
+----------------+------------------+
|       AEGIS Backend (FastAPI)     |
|            Port 8000              |
|  +---------+  +----------+       |
|  | Surface |  | Response |       |
|  |  (ASM)  |  |  (SOAR)  |       |
|  +---------+  +----------+       |
|  +---------+  +----------+       |
|  | Phantom |  | Ransomware|      |
|  | (Decoy) |  | Defense  |       |
|  +---------+  +----------+       |
+----------+-----------+-----------+
           |
+----------+--+
| PostgreSQL  |
|   (data)    |
+-------------+

PM2/System Logs  → Log Watcher  → Sigma Engine  → Response Actions  → Audit Log
nmap/nuclei      → Scheduler    → Assets DB     → Risk Score
Honeypots        → Interactions → Attacker Profiler → Threat Intel
RaaS Feed        → Intel Cache  → Correlation Engine → Block/Alert
Rust Agent       → Events       → Chain Detection → Kill-chain response

Continuous discovery and vulnerability assessment.

• Asset Discovery — nmap service detection with OS fingerprinting (-sV -O)
• Vulnerability Scanning — Nuclei integration with deterministic risk scoring
• Hardening Checks — Configuration audits with actionable remediation
• Scheduled Scans — Full scan (2 h), quick scan (30 min), discovery (1 h)

Deterministic-first alert triage with automated action execution.

• <1 ms Fast Path — Sigma check → IOC cache → playbook → done, no AI round-trip
• 10 Deterministic Playbooks — auto_block_brute_force, auto_block_sql_injection, auto_respond_c2_beacon, ransomware_kill_chain_response, and 6 more
• Guardrail System — Per-action-type policy (auto_approve / require_approval / never_auto) plus a safe-IP short-circuit that no verdict can override
• Full Audit Trail — Every decision logged: reasoning, confidence, timestamp, action taken

Deploy decoy services that attract, profile, and trap attackers.

• SSH Honeypot (port 2222) — Paramiko server with fake banner, captures credentials and commands
• HTTP Honeypot (port 8888) — Rotating decoy pages: Jenkins, WordPress, phpMyAdmin
• Breadcrumb Traps — Fake .env files with tracked credentials; attacker reuses them → CRITICAL incident

See Ransomware Defense above and docs/seo/ransomware-defense.md.

aegis/
├── backend/                    # FastAPI application
│   ├── app/
│   │   ├── api/                # 25 API routers (140+ endpoints)
│   │   ├── core/               # Auth, events, guardrails, attack detector, firewall engine
│   │   ├── models/             # SQLAlchemy models
│   │   ├── modules/
│   │   │   ├── surface/        # ASM: discovery, nuclei, risk scoring
│   │   │   ├── response/       # SOAR: ingestion, analysis, playbooks, responder
│   │   │   └── phantom/        # Deception: SSH/HTTP honeypots, profiler, rotation
│   │   ├── rules/              # 229 Sigma rule files (163 enabled) + 4 chain rules (YAML)
│   │   │   ├── sigma/          # Categorized by MITRE tactic
│   │   │   └── chains/         # Kill-chain detection rules
│   │   └── services/           # Background services: log_watcher, raas_intel, correlation_engine
│   └── tests/                  # pytest suite (125 Python tests)
├── frontend/                   # Next.js 14 dashboard (21 pages)
│   └── src/app/dashboard/
│       └── ransomware/         # RaaS timeline, events, decryptor lookup
├── agent-rust/                 # Standalone Rust EDR agent
│   └── src/ransomware/         # Canary, entropy, killer, rollback
├── desktop-tauri/              # AEGIS Manager desktop app (Tauri v2)
├── docs/                       # Documentation
│   └── seo/                    # Explainer pages (what-is, ransomware, comparison)
├── .well-known/
│   └── llms.txt                # LLM-discoverable site structure
├── docker-compose.yml
└── .env.example

All endpoints under /api/v1/ require X-API-Key header or JWT Bearer token.

WebSocket at /ws for real-time event streaming.

Full API reference: docs/api/

Contributions are welcome. See CONTRIBUTING.md.

Areas where help is especially valued:

• Sigma rules — detection rules for new ransomware families and attack patterns
• Threat feeds — integrating additional RaaS intelligence sources
• Endpoint agents — Linux and macOS agent builds
• Documentation — deployment guides, tutorials, attack scenario walkthroughs
• Testing — expanding coverage of the ransomware kill-chain path

Found a vulnerability? See SECURITY.md for our responsible disclosure policy.

AEGIS is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0).

Free to use, modify, and distribute. If you run a modified version as a network service, you must make the source code available to users.

• What is AEGIS? — Full explainer
• How AEGIS detects ransomware
• AEGIS vs Wazuh / OSSEC / Elastic Security
• Architecture deep dive
• Contributing