Crash-Resilient Architecture: Closing the CrowdStrike Gap
Legacy EDR agents operate deep in ring 0 with monolithic kernel drivers that risk global operating system crashes upon malformed channel definition updates. BlackShield endpoint defense isolates detection logic in crash-proof userspace Go runtimes while leveraging verified eBPF ring buffers on Linux and structured ETW on Windows.
Sub-5ms Autonomous Edge
Evaluates IOA scoring directly in memory on the monitored host. Interdicts threats locally without cloud round-trip latency.
BYOVD & Rootkit Defense
Surveils vulnerable third-party drivers against the LOLDrivers catalog, blocking kernel exploit primitives before driver loading.
Cryptographic Audit Ledger
Every interdiction action emits a signed receipt with SHA-256 hash chains, proving non-repudiable SOC audit trails.
Autonomous Containment Primitives
When an observed process exceeds the IOA risk threshold (score ≥ 80), BlackShield executes progressive containment:
1. Process Tree Termination
Recursively sends uncatchable SIGKILL / TerminateProcess to the offending PID and all spawned child processes.
2. Ephemeral Cgroup Freezing
Freezes thread execution immediately in the kernel cgroup to preserve memory state for incident forensic analysis.
3. Network Namespace Isolation
Instantly drops active egress sockets and inserts temporary loopback-only iptables/WFP filter rules.
4. Volatile Memory Forensics Triage
Captures suspicious memory pages, unlinked VAD structures, and open file descriptors into encrypted tenant forensic bundles.
Dynamic Policy Delta Synchronization
Endpoint sensors and appliances maintain continuous behavioral protection without requiring full ruleset downloads. Agents poll the policy delta API with their active local version:
Responses contain new, updated, or disabled IOA behavioral rules (IOARuleRecord) with MITRE ATT&CK TTP mappings and scoring weights. Updates are applied in memory with atomic lock-free swaps.
Hybrid Pure-Go Antivirus Engine & Encrypted Vault
The endpoint sensor integrates a standalone pure-Go antivirus engine (CGO_ENABLED=0) running cross-platform without external C dependencies. It combines sub-millisecond cryptographic hash lookups (SHA-256 / MD5) with chunked byte-sequence pattern evaluation and real-time filesystem watchers.
Dual-Tier Threat Engine
Evaluates instant blocklist matches and chunked hex patterns across sliding buffers to catch polymorphic payloads.
Real-Time File Shield
Surveils file creation and modifications via OS-native events (inotify on Linux, USN/ETW on Windows, FSEvents on macOS) with polling fallback.
Encrypted Quarantine Vault
Quarantined binaries are XOR-scrambled, locked with chmod 0000, and issued cryptographic receipts with safe rollback support.
Deploying the Sensor in 60 Seconds
Deploy the endpoint sensor across your fleet with the interactive wizard in the SOC console or via automated configuration management:
$ curl -fsSL https://blackshield.chaplau.com/source-bundles/edr.sh | sudo bash -s -- --token YOUR_TOKEN --mode autonomous --enable-av