Open-source, all-in-one cybersecurity platform for Windows.
EDR / XDR / SIEM / Forensics / Threat Intelligence / Active Response in a single agent.
Features • Quick Start • Architecture • Structure • Security • Configuration • Build • Contributing • License
RoyalSecurity is a real, working, compilable cybersecurity platform written in Rust with a Tauri 2 + React 19 frontend. It provides endpoint detection and response (EDR/XDR), SIEM, forensic triage, threat intelligence, active response, vulnerability management, compliance auditing, and privacy tools — capability typically locked behind expensive commercial products.
The agent runs as a Windows SYSTEM service with a modern desktop UI. Zero cloud dependency. Zero telemetry. Your data stays on your machine.
| Metric | Value |
|---|---|
| Test suite | 1,415+ passing |
| Rust crates | 50+ |
| Tauri IPC commands | 49 (frontend) / 48 (backend) |
| Windows collectors | 20+ |
| Detection rules | 42 YARA + 23 Sigma |
| MITRE ATT&CK techniques | 112 across 14+ tactics |
| Release binary | 6.83 MB |
| RAM (idle) | ≤80 MB |
| CPU (idle) | ≤0.3% |
| Event throughput | 100k+ events/sec |
| P99 latency | <5 ms |
- 20+ Windows Collectors: ETW, Sysmon, WFP, Registry, WMI, DNS, USB, Bluetooth, WiFi, PowerShell, HTTP, Memory, Audio, Webcam, Firmware, Boot, Email, Log, USN Journal, API Hook detection
- Real-time Event Bus: Lock-free ring buffer processing 100k+ events/sec with <5ms P99 latency
- Process Protection: Process tree tracking, injection detection (DLL injection, process hollowing, APC injection), credential dump detection, LOLBin detection, fileless malware analysis
- Network Security: DNS monitoring, C2 beacon detection, DGA analysis, port scan detection, JA3/JA3S TLS fingerprinting, certificate anomaly detection
- Memory Protection: Inline hook detection, IAT hook detection, detour detection, code cave detection, module tampering detection
- Behavioral Analysis: Runtime Indicators of Attack (IOA) detection, process chain analysis, UEBA risk scoring
Windows Filtering Platform (WFP) integration with rule management via UI, network connection monitoring and blocking, and DNS proxy with filtering.
Real-time process tree visualization with CPU/memory tracking, command-line inspection, and parent-child relationship mapping. Suspicious process detection via heuristics and known-bad signature matching.
- CVE database with 25+ critical CVEs (2017–2024) and detection signatures
- CVSS v3.1 calculator for scoring vulnerabilities
- Software inventory via Windows Registry
- Network service scanning for exposed services
- Configuration auditing against security baselines
- Patch assessment with missing update detection
Full forensic triage comparable to Velociraptor, Hayabusa, Chainsaw, and KAPE:
- EVTX Parser — Windows Event Log binary format parser
- MFT Parser — NTFS Master File Table parser
- Prefetch Parser — Windows Prefetch file parser
- Registry Hive Parser — SAM, SYSTEM, SOFTWARE, SECURITY hive parser
- Shimcache Parser — Application Compatibility Cache parser
- Amcache Parser — Amcache.hve program execution artifact parser
- SRUM Parser — System Resource Usage Monitor parser
- LNK Parser — Windows Shortcut file parser
- USN Journal Parser — NTFS Change Journal parser
- Timeline Builder — Unified forensic timeline from multiple artifact sources
- Response actions: TerminateProcess, BlockIp, IsolateHost, QuarantineFile, BlockHash, KillConnection
- Automated playbooks: Ransomware Response, C2 Communication, Credential Theft, Privilege Escalation
- Host containment with escalation levels (monitor, alert, contain, isolate)
- File quarantine with SHA3-256 integrity verification
Centralized event correlation and analysis with multi-format export:
- ECS NDJSON (Elastic Common Schema)
- CEF (Common Event Format)
- Syslog RFC 5424
- JSON / CSV
- Splunk HTTP Event Collector (HEC)
- 112 real techniques mapped across all 14+ tactics
- Detection rule mapping (40+ YARA/Sigma technique mappings)
- Coverage analysis with gap detection
- ATT&CK Navigator layer export for visualization
- Technique database with detection recommendations
SHA3-256 hash-chained immutable audit log for tamper-evident event recording. Every entry contains the hash of the previous entry, making modification detectable. Verify chain integrity at any time.
Multi-endpoint agent registry with command relay, policy engine for centralized configuration, agent grouping, and fleet monitoring/statistics.
- Data Loss Prevention (DLP) — Sensitive data detection, file operation tracking, USB device control, clipboard monitoring
- Compliance — CIS Benchmarks, STIG Controls, NIST Framework automated checks
- Threat Intelligence — 15-source IOC feed aggregator (VirusTotal, AlienVault OTX, Abuse.ch, CISA KEV, etc.), STIX 2.1, TAXII 2.1 server
- Privacy — VPN integration (WireGuard), Tor integration (Arti), tracker blocking, metadata removal, anti-fingerprinting
- Cryptography — AES-256-GCM, TPM seal support, ChaCha20-Poly1305, X25519/Ed25519
- Windows 10 or 11 (x64)
- WebView2 (included with Windows 11, installable on Windows 10)
- Rust toolchain 1.75+ (MSVC toolchain — install via
rustup) - Node.js 20+ (for UI development)
- Inno Setup 6+ (optional, for installer creation)
1. Download RoyalSecurity-Setup-0.1.0.exe from Releases
2. Run as Administrator
3. Follow the Setup Wizard
4. The agent starts automatically
# Clone & enter
git clone https://github.com/kayde/RoyalSecurity.git
cd RoyalSecurity
# Build the Rust backend (release, ~6.83 MB)
cargo build --release
# Build the React frontend
cd royalsecurity-ui
npm install
npm run build
cd ..
# Binary: target/release/royalsecurity.exe# Terminal 1: Rust backend (quick iteration)
cargo build
# Terminal 2: React frontend (hot-reload)
cd royalsecurity-ui
npm install
npm run dev
# Run all tests (workspace + UI)
cargo test --workspace
cd royalsecurity-ui && npx vitest run
# Type checking
cd royalsecurity-ui && npx tsc --noEmit
# Linting
cd royalsecurity-ui && npm run lintinstaller\build-installer.bat
# Output: installer/output/RoyalSecurity-Setup-0.1.0.exe- System Scan — Detects OS version, TPM support, PPL support, hardware info
- Module Selection — Enable/disable EDR, Ransomware Protection, Network Security, Threat Intelligence, Firewall, DLP, Privacy, and more
- Scan Schedule — Configure real-time, quick, and full scan intervals
- Threat Intelligence Feeds — Select which of the 15 intelligence sources to activate
┌─────────────────────────────────────────────────────────────┐
│ React 19 UI (Next.js 16) │
│ Dashboard │ Threats │ Processes │ Network │ Rules │
│ Compliance │ Audit │ Forensics │ Settings │ Fleet │ Vulns │
└──────────────────────────┬──────────────────────────────────┘
│ Tauri 2 IPC (49 bridge functions)
┌──────────────────────────▼──────────────────────────────────┐
│ Tauri 2 Backend (Rust) │
│ src-tauri/src/main.rs — 48 #[tauri::command] handlers │
│ Process & Network caches, Alert store, Scan state │
└──────────────────────────┬──────────────────────────────────┘
│
┌──────────────────────────▼──────────────────────────────────┐
│ Core Engine (crates/core/) │
│ SecurityEngine │ EventBus (lock-free ring buffer) │
│ ModuleRegistry │ CryptoVault │ AuditLog │ AppConfig │
│ PPL │ TpmManager │ ProcessProtection │
└──────────────────────────┬──────────────────────────────────┘
│
┌──────────────────────────▼──────────────────────────────────┐
│ Security Modules (40+ crates) │
│ Defense: EDR, XDR, AV, Behavior, ASR, Exploit, Memory, │
│ Fileless, Ransomware, Injection, Hijack, Credential, │
│ Persistence, Beacon, DGA, JA3, Cert, YARA, Rules, │
│ Hardening, Device, Firewall, Network, DNS, WiFi, VPN, │
│ Tor, Leak, Encryption, FDE, DLP, Backup, ITDR, UEBA, AD, │
│ Deception, TPM, Boot, VSS, Hardware │
│ Offense: Vuln Scan, Config Audit, Adversary Sim, Exploit │
│ Privacy: Anti-fingerprint, Tracker Block, Metadata Min, │
│ VPN/Tor │
└──────────────────────────┬──────────────────────────────────┘
│
┌──────────────────────────▼──────────────────────────────────┐
│ Windows Data Collectors (20+) │
│ ETW │ Sysmon │ WFP │ Registry │ WMI │ DNS │ USB │ Bluetooth│
│ WiFi │ PowerShell │ HTTP │ Memory │ Audio │ Webcam │
│ Firmware │ Boot │ Email │ Log │ USN Journal │ Hooks │
└──────────────────────────┬──────────────────────────────────┘
│ Win32 API / Windows Kernel
┌──────────────────────────▼──────────────────────────────────┐
│ Windows OS / Kernel │
│ ETW, WFP, Registry, Process/Thread, File System, Network │
└─────────────────────────────────────────────────────────────┘
- Zero cloud dependency — everything runs locally, no telemetry
- SYSTEM-level service with user-level UI separation via Tauri IPC
- Lock-free ring buffer event bus for 100k+ events/sec throughput
- SHA3-256 hash-chained immutable audit log (tamper-evident)
- PPL (Protected Process Light) self-protection against tampering
- TPM-sealed encryption keys for hardware-backed security
| Layer | Technology |
|---|---|
| Frontend | Next.js 16 (static export), React 19, TypeScript 5, Tailwind CSS 4 |
| UI Components | shadcn/ui (Radix primitives), Framer Motion, GSAP |
| 3D Visualization | Three.js, React Three Fiber (R3F), Drei |
| Charts | Recharts |
| Desktop Shell | Tauri 2 (Rust backend), custom protocol |
| Backend Language | Rust 1.75+, edition 2021 |
| Async Runtime | Tokio (full features) |
| Windows API | windows crate 0.58 |
| Embedded Database | redb (ACID, zero-copy) |
| Crypto | AES-256-GCM, ChaCha20-Poly1305, SHA3-256, X25519, Ed25519 |
| Serialization | serde, serde_json, bincode, rmp-serde |
| State Management | TanStack React Query, tRPC |
| Form Validation | Zod |
RoyalSecurity/
├── Cargo.toml # Workspace root (50+ crates)
├── Makefile # Build targets
├── config/
│ └── default.toml # Default configuration
├── src-tauri/
│ ├── Cargo.toml # Tauri app crate
│ ├── src/main.rs # 48 IPC commands, app state
│ └── tauri.conf.json # Tauri configuration
├── royalsecurity-ui/ # React 19 + Next.js 16 frontend
│ ├── src/
│ │ ├── app/ # App Router pages (15+ routes)
│ │ │ ├── page.tsx # Landing page
│ │ │ ├── dashboard/ # Overview with charts & alerts
│ │ │ ├── threats/ # Active threat management
│ │ │ ├── processes/ # Process monitor
│ │ │ ├── network/ # Network connections
│ │ │ ├── rules/ # YARA & Sigma rule mgmt
│ │ │ ├── compliance/ # CIS/STIG/NIST scores
│ │ │ ├── audit/ # Hash-chained audit log
│ │ │ ├── forensics/ # Forensic triage tools
│ │ │ ├── response/ # Active response & playbooks
│ │ │ ├── fleet/ # Multi-endpoint fleet mgmt
│ │ │ ├── settings/ # Configuration & modules
│ │ │ ├── siem/ # SIEM export & visualization
│ │ │ └── vuln-scan/ # Vulnerability management
│ │ ├── components/ # UI components
│ │ │ ├── ui/ # shadcn/ui primitives
│ │ │ ├── command-center/ # Security command center
│ │ │ └── react-bits/ # Advanced components
│ │ ├── lib/
│ │ │ ├── tauri-bridge.ts # 49 bridge functions + types
│ │ │ └── utils.ts # Utility functions
│ │ └── __tests__/ # Vitest test suite
│ ├── vitest.config.ts
│ └── package.json
├── crates/ # 50+ Rust crates
│ ├── core/ # EventBus, SecurityEngine, PPL, TPM, config
│ ├── common/ # Event types, MITRE definitions
│ ├── state-store/ # redb embedded database
│ ├── rule-engine/ # YARA + Sigma rule engine
│ ├── threat-intel/ # 15-source IOC aggregator, STIX 2.1
│ ├── stix-taxii/ # STIX 2.1 objects, TAXII 2.1 server
│ ├── audit-log/ # SHA3-256 hash-chained immutable log
│ ├── crypto-vault/ # AES-256-GCM encryption, TPM sealing
│ ├── agent-service/ # Windows SCM service (SYSTEM)
│ ├── windows-bridge/ # Win32 API: process, network, registry
│ ├── compliance/ # CIS/STIG/NIST benchmark engine
│ ├── siem/ # SIEM event processing
│ ├── siem-export/ # ECS NDJSON, CEF, Syslog, Splunk HEC
│ ├── scheduler/ # Cron-based task scheduler
│ ├── automation/ # Automated playbook engine
│ ├── action-executor/ # Response action execution
│ ├── ai-engine/ # ML inference (ONNX Runtime ready)
│ ├── forensic/ # Legacy forensic parsers
│ ├── forensic-triage/ # EVTX, MFT, Prefetch, Registry, etc.
│ ├── active-response/ # Quarantine, termination, isolation
│ ├── mitre-attack/ # 112 techniques, coverage analysis
│ ├── vuln-management/ # CVE database, CVSS v3.1
│ ├── fleet-management/ # Agent registry, policy engine
│ ├── rest-api/ # Axum REST API (port 9443)
│ ├── collectors/ # 20 Windows data collectors
│ │ ├── collector-etw/ # Event Tracing for Windows
│ │ ├── collector-sysmon/ # Sysmon integration
│ │ ├── collector-wfp/ # Windows Filtering Platform
│ │ ├── collector-hooks/ # API hook detection
│ │ ├── collector-usn/ # USN Journal monitoring
│ │ ├── collector-wmi/ # WMI event subscription
│ │ ├── collector-usb/ # USB device monitoring
│ │ ├── collector-bluetooth/ # Bluetooth device monitoring
│ │ ├── collector-wifi/ # WiFi connection monitoring
│ │ ├── collector-dns/ # DNS query logging
│ │ ├── collector-http/ # HTTP request monitoring
│ │ ├── collector-powershell/ # PowerShell script block logging
│ │ ├── collector-registry/ # Registry change monitoring
│ │ ├── collector-memory/ # Memory allocation monitoring
│ │ ├── collector-audio/ # Audio device monitoring
│ │ ├── collector-webcam/ # Webcam access monitoring
│ │ ├── collector-firmware/ # Firmware integrity checks
│ │ ├── collector-boot/ # Boot integrity monitoring
│ │ ├── collector-email/ # Email activity monitoring
│ │ └── collector-log/ # Windows Event Log collection
│ ├── modules/ # 40+ security modules
│ │ ├── defense/ # 30+ defense modules
│ │ ├── offense/ # 4 offensive modules
│ │ └── privacy/ # 4 privacy modules
│ └── network-stack/ # Network infrastructure
│ ├── firewall/ # Packet filtering firewall
│ ├── dns-proxy/ # DNS proxy with filtering
│ ├── tls-inspect/ # TLS inspection
│ ├── vpn-wireguard/ # WireGuard VPN
│ └── tor-arti/ # Tor (Arti) integration
├── rules/ # YARA and Sigma rule files
│ ├── yara/ # 42 YARA rules
│ └── sigma/ # 23 Sigma rules
├── tests/ # Integration tests
├── installer/ # Inno Setup installer scripts
├── docs/ # Documentation
│ ├── ARCHITECTURE.md # System architecture
│ ├── BRIDGE.md # IPC bridge documentation
│ ├── DEVELOPMENT.md # Developer guide
│ └── ... # Extended docs
├── plugins/ # Plugin system
├── browser-extension/ # Browser extension
├── intel/ # Threat intelligence data
├── config/ # Configuration files
├── SECURITY.md # Security policy
├── CONTRIBUTING.md # Contribution guidelines
└── LICENSE # AGPL-3.0
- SYSTEM service with user-level UI separation via Tauri IPC — the UI runs as the logged-in user while detection runs as SYSTEM
- PPL (Protected Process Light) self-protection against tampering — prevents non-PPL processes from terminating or injecting into the agent
- TPM-sealed encryption keys for hardware-backed security — keys are sealed to the TPM and cannot be extracted
- SHA3-256 hash-chained immutable audit log — tamper-evident, any modification breaks the chain
- Zero-trust local-only architecture — no cloud dependency, no telemetry sent externally
- File quarantine with SHA3-256 integrity verification — quarantined files are encrypted and hashed
- Anti-tamper watchdog — continuous self-protection with periodic integrity checks
- Admin elevation required — the agent service and installer must run as Administrator
When available, RoyalSecurity uses the Trusted Platform Module (TPM 2.0) to:
- Seal encryption keys to the system hardware
- Attest to the integrity of the agent
- Prevent key extraction even from SYSTEM-level processes
The agent registers as a Protected Process Light (PPL) to:
- Prevent non-PPL processes from opening the agent process
- Block injection and tampering attempts
- Detect debugger attachment
- Monitor binary integrity via checksums
Edit config/default.toml or use the Settings page in the UI:
[general]
app_name = "RoyalSecurity"
version = "0.1.0"
log_level = "info"
telemetry_enabled = false
auto_update = true
[agent]
heartbeat_interval_secs = 30
max_memory_mb = 1024
max_cpu_percent = 80
[defense]
av_enabled = true
edr_enabled = true
xdr_enabled = true
behavior_enabled = true
ransomware_enabled = true
memory_protection = true
exploit_protection = true
credential_protection = true
device_control = true
deception_enabled = false
[network]
firewall_enabled = true
dns_proxy_enabled = true
dns_over_https = true
vpn_enabled = false
tor_enabled = false
leak_protection = true
tls_inspection = false
web_protection = true
[threat_intel]
update_interval_minutes = 15
auto_update = true
[logging]
retention_days = 90
level = "info"
[compliance]
cis_enabled = true
stig_enabled = true
nist_enabled = true
[forensics]
collector_schedule = "0 0 * * 0" # Weekly
[automation]
playbook_enabled = true
auto_remediate = false| Variable | Description | Default |
|---|---|---|
ROYAL_DATA_DIR |
Data directory override | %ProgramData%\RoyalSecurity |
ROYAL_CONFIG_DIR |
Config directory override | %ProgramData%\RoyalSecurity\Config |
ROYAL_LOG_LEVEL |
Log level override | info |
ROYAL_REST_PORT |
REST API port | 9443 |
- Rust 1.75+ (with MSVC toolchain via
rustup target add x86_64-pc-windows-msvc) - Node.js 20+ (LTS recommended)
- Windows 10/11 x64
- WebView2 runtime (included in Windows 11, available for Windows 10)
- Inno Setup 6+ (optional, for installer)
git clone https://github.com/kayde/RoyalSecurity.git
cd RoyalSecurity
# 1. Build Rust workspace (50+ crates)
cargo build --release
# 2. Build frontend
cd royalsecurity-ui
npm install
npm run build
cd ..
# 3. Run tests
cargo test --workspace
cd royalsecurity-ui && npx vitest run
# 4. Verify binary
.\target\release\royalsecurity.exe --helpmake setup # Install frontend dependencies
make test # Run UI tests
make lint # Run ESLint
make typecheck # TypeScript type checking
make build # Build frontend
make build-tauri # Full Tauri build (requires Rust)
make clean # Clean build artifactsRoyalSecurity exposes a REST API via Axum on port 9443 and 48 IPC commands via Tauri.
| Method | Endpoint | Description |
|---|---|---|
| GET | /api/v1/system/info |
System information |
| GET | /api/v1/system/health |
Health check |
| GET | /api/v1/processes |
Running processes |
| GET | /api/v1/network/connections |
Active network connections |
| GET | /api/v1/alerts |
Alert list |
| GET | /api/v1/alerts/stats |
Alert statistics |
| GET | /api/v1/mitre/coverage |
MITRE ATT&CK coverage map |
| GET | /api/v1/compliance/status |
Compliance score |
| GET | /api/v1/audit/log |
Immutable audit log |
| GET | /api/v1/engine/stats |
Engine performance metrics |
| GET | /api/v1/rules |
Detection rules (YARA + Sigma) |
| POST | /api/v1/scan/trigger |
Trigger a scan |
| POST | /api/v1/threat-intel/update |
Force threat intel update |
| POST | /api/v1/events/evaluate |
Evaluate a security event |
| POST | /api/v1/rules/yara |
Add a YARA rule |
| POST | /api/v1/rules/sigma |
Add a Sigma rule |
| POST | /api/v1/crypto/encrypt |
AES-256-GCM encryption |
| POST | /api/v1/crypto/decrypt |
AES-256-GCM decryption |
| PUT | /api/v1/config |
Update configuration |
| GET | /api/v1/fleet/agents |
Fleet agent list |
See BRIDGE.md for the complete reference of all 49 bridge functions across 12 categories.
| Page | Route | Description |
|---|---|---|
| Dashboard | /dashboard |
Overview with charts, alerts, MITRE coverage visualization |
| Threats | /threats |
Active threat list with severity, status, and response actions |
| Processes | /processes |
Process monitor with tree view and detail inspection |
| Network | /network |
Connection monitor with IP flagging and DNS lookup |
| Rules | /rules |
YARA and Sigma rule management (add, edit, enable/disable) |
| Compliance | /compliance |
CIS/STIG/NIST benchmark results and scores |
| Audit Log | /audit |
Immutable, hash-chained event log viewer |
| Settings | /settings |
Configuration, module toggles, and scan scheduling |
| Forensics | /forensics |
Forensic triage tools (EVTX, MFT, Prefetch, Registry, Timeline) |
| Response | /response |
Active response, containment, playbooks, quarantine |
| Fleet | /fleet |
Multi-endpoint fleet management |
| SIEM | /siem |
SIEM export and event visualization |
| Vuln Scan | /vuln-scan |
Vulnerability scanning and CVE database |
| Metric | Target | Status |
|---|---|---|
| RAM (idle) | ≤80 MB | Achieved |
| CPU (idle) | ≤0.3% | Achieved |
| Event throughput | 100k+ events/sec | Lock-free ring buffer |
| P99 latency | <5 ms | Arena allocator + SPSC fast path |
| Binary size | ~7 MB | Stripped, LTO, size-optimized |
| Test coverage | 1,415+ tests | 0 failures |
Optimization details:
opt-level = "z"(size optimization),lto = true,codegen-units = 1,strip = true,panic = "abort"- Lock-free ring buffer with arena allocation for event processing
- SPSC (single-producer single-consumer) fast path for critical events
- Memory-mapped IOC store for zero-copy threat intelligence lookups
- Redb embedded database provides zero-copy reads
We welcome contributions! See CONTRIBUTING.md for full details.
# Fork & clone
git clone https://github.com/YOUR_USERNAME/RoyalSecurity.git
cd RoyalSecurity
# Verify build
cargo build
cargo test --workspace
# Frontend
cd royalsecurity-ui
npm install
npx vitest run- New collectors: Add support for additional Windows event sources
- Detection rules: Contribute YARA and Sigma rules
- MITRE mappings: Expand ATT&CK technique coverage
- Forensic parsers: Improve existing or add new artifact parsers
- UI/UX: Enhance the React frontend with new visualizations
- Documentation: Improve guides, API docs, and tutorials
- Testing: Increase coverage and add integration tests
AGPL-3.0-or-later — See LICENSE for full text.
This license requires that any modified version distributed externally must also be released under AGPL-3.0. If you modify RoyalSecurity and distribute it, you must make the source code available.
Built with Tauri, React, TailwindCSS, Rust, Tokio, Axum, and redb.
Detection rules inspired by Sigma, YARA, and MITRE ATT&CK.
Forensic parser design influenced by Velociraptor, Hayabusa, Chainsaw, and KAPE.
Disclaimer: RoyalSecurity is provided as-is for educational and defensive security purposes. It is not a substitute for commercial endpoint protection in production environments. Users are responsible for ensuring compliance with all applicable laws and regulations. The developers assume no liability for misuse.