VK AI Sensor

Voight-Kampff: a host-based EDR for Windows that catches compromise on the machine, including the AI-driven kind.

vk-ai-sensor is a host-based EDR for Windows. It runs as a service on the machine and watches process, file, network, account, and PowerShell activity for the behavior that compromise produces, with more than sixty detection rules mapped to MITRE ATT&CK. All of it runs locally, with no network access and no API keys required for the core to work.

What pushed it into being was a specific worry: attackers using AI to move faster and at scale, autonomous agents that probe and pivot on their own, and AI-generated malware that matches nothing on a signature list. You do not catch those with signatures. You catch them the way you catch a careful human intruder, by watching what actually happens on the host. An optional AI layer can explain and rank what the sensor finds, but the core never depends on it.

The name is a nod to the Voight-Kampff machine from Blade Runner, the device built to tell a human from a machine pretending to be one. That is the job here too.

What it watches for

The sensor ships with more than sixty detection rules, mapped to MITRE ATT&CK. Some of the ground it covers:

• Process attacks. Code injection, process hollowing and image tampering, DLL side-loading, living-off-the-land binaries, and processes pretending to be something they are not.
• Credential theft. Reading LSASS memory by known tool, by dump file, and by direct handle access, plus browser credential stores, Kerberoasting, AS-REP roasting, DCSync, Golden Ticket forgery, and copying the NTDS.dit domain database off a domain controller.
• Persistence. Scheduled tasks, run keys, services, WMI subscriptions, startup folders, and UAC-bypass tricks.
• Defense evasion. Clearing event logs, turning off auditing, disabling protections, loading known-vulnerable drivers, and anti-forensics like prefetch wiping and timestamp tampering.
• Ransomware and wipers. Mass file encryption and mass deletion, shadow-copy deletion, and canary files. Tuned to fire on real user data, not an installer or a browser clearing its own cache.
• Command and control. Beaconing patterns, suspicious DNS, connections to known-bad indicators, and traffic to countries you would not expect.
• Lateral movement and web attacks. Remote execution, web shell drops, and IIS configuration tampering.

Digging into what fired

An alert is a starting point, not the end of the story. The sensor pulls extra context so you are not left staring at a process name wondering what it actually did.

• Memory forensics. When a high-severity alert fires, the sensor scans the offending process's own memory, classifies each region, and disassembles anything that looks like injected shellcode. The web console shows you the disassembly, and the optional AI layer can walk through what the code is doing before you have to.
• IP reputation. Outbound destinations and the addresses tied to an alert are checked against public reputation sources (DNSBLs, Team Cymru, Shodan's InternetDB, AbuseIPDB), and each alert captures a point-in-time reputation snapshot so a later cleanup does not erase what the address looked like when it mattered.
• A bundled decompiler. A suspicious binary can be pulled apart in place: native disassembly, .NET decompilation, and a pass for suspicious API combinations, embedded strings, and packer tells, so triage does not mean shipping the sample off to a third-party sandbox.

Where the signal comes from

Detection does not lean on a single source. The sensor reads several, so an attacker cannot dodge it by avoiding one:

• ETW. A kernel Event Tracing session for process, file, network, and thread activity.
• The Windows Security log. Logons, account and group changes, Kerberos ticket requests, and audit-log clears. This is ground truth Windows records no matter which tool made the change.
• PowerShell script-block logging. The actual deobfuscated script content, not just the command line.
• Sysmon, if you run it. When Sysmon is installed the sensor picks it up on its own and uses it for signals ETW cannot see, such as a process opening a handle to read LSASS memory. If Sysmon is not there, nothing breaks, and the web console shows you how to turn it on.

Design principles

• Local-first, always on. Core detection runs with zero network access and zero API keys. If the AI layer is offline, mis-keyed, or rate-limited, detection is unaffected.
• AI is augmentation, not the engine. The optional AI layer analyzes alerts after the fact. It explains them, ranks what matters, and flags likely false positives. It is an opinion-giver, never in the critical path.
• Bring your own provider. AI access sits behind an abstraction, so it can point at a cloud model or a fully local model. The AI help can itself stay 100% on-box.
• Explicit opt-in for data leaving the machine. Every feature that phones home is disabled by default and clearly documented.
• Secrets stored properly. API keys are encrypted at rest using Windows DPAPI. Plaintext keys never touch a config file.

Running a fleet

One box or many, the pieces are the same.

• Self-hosted updates. New builds publish to your own update feed, signed with an offline Ed25519 key so a compromised feed cannot push a tampered or downgraded build, and each sensor verifies and installs them. No third-party update service in the path.
• Ask the fleet in plain language. The hub exposes an MCP server (Model Context Protocol), so an AI assistant like Claude can query every host for you: what fired and where, what a machine is running right now, whether anything touched a known indicator. You ask a question, it pulls the answer from the sensors live.
• A daily report that writes itself. The same MCP tools drive a scheduled, headless run that reviews the fleet and emails a plain security summary each morning.
• A watchdog on the watcher. A separate service on each host notices if the sensor stays stopped too long and alerts you, then tells you again when it comes back.

At a glance

• Runs as an elevated Windows Service. Detection comes from ETW, the Windows event logs, and Sysmon when it is present.
• Ships a separate, unelevated Blazor web console for reviewing what the sensor has seen: activity, alerts, network connections, the rules in effect, and Sysmon setup.
• Built on .NET 10, targeting Windows 10 / Server 2016 and later.
• Dual-licensed: AGPL-3.0, with a commercial license available.

Back to home