Four shields.
One kernel companion.
Aegis is a Windows antivirus built around Avast-style core shields, live threat-intel feeds, and an optional kernel mini-filter that blocks malware before it executes. It does everything Avast does — plus a kernel pre-execution blocker and true tamper-proof self-defense. Free to run — no license, no phoning home.
Core Shields
Each shield has a global master switch and its own per-shield toggle — the same model as a commercial AV, but you stay in control of every layer.
Real-time file scanning
Scans files on write and on execution.
- YARA rule matching + ClamAV signature DB
- SHA-256 deny-list enforcement
- Kernel pre-exec block via the companion driver
Process behavior monitoring
Watches what running processes try to do.
- Ransomware burst detection (mass file rename/encrypt)
- Suspicious child-process / injection heuristics
- ETW + WMI process-create telemetry
Malicious-domain blocking
Stops connections to known-bad infrastructure.
- Live blocklists: URLhaus, Feodo, SSLBL, ThreatFox, Spamhaus
- DNS + connection-level interception (WFP-ready)
- IP / URL reputation scoring
Attachment & script screening
Inspects what arrives through mail flows.
- Attachment hash + archive unpacking checks
- Script/macro payload detection via AMSI
- Quarantine on hit, never auto-execute
Your tunnel, surfaced
Aegis does not run VPN servers — it shows the live state of your Windows VPN connection so you can confirm you're protected.
- Reads your OS VPN profile (no account, no backend)
- Flags when you're exposed on an untrusted network
- Same honest approach as commercial AVs that resell a tunnel
More than Avast — for free
Everything a commercial suite ships, plus the layers they keep behind a paywall or can't reach from user mode.
| Capability | Avast Free | Aegis |
|---|---|---|
| Real-time file + behavior scanning | Yes | Yes |
| Web / mail shield | Yes | Yes |
| Built-in VPN status | Resells third-party | Surfaces OS VPN state, no servers |
| Kernel pre-execution block | No (user-mode only) | Yes (aegis-kernel) |
| Tamper-proof self-defense | Partial | ObRegisterCallbacks + Protected Process |
| Telemetry / account lock-in | Sells data, nags | None, no account |
The Kernel Companion
A separate, source-only driver + agent pair (aegis-kernel)
pushes protection below user mode — where malware can't yet fight back.
- ▸Pre-execution file block. A mini-filter denies launch of deny-listed hashes before a single instruction runs.
- ▸Ransomware IRP block. Mass-encrypt patterns are stopped at the I/O-request level, not after the fact.
- ▸True self-defense. ObRegisterCallbacks deny tamper on the protected Aegis PID; a signed build runs as a Protected Process.
aegis-kernel
C mini-filter driver · C++ user-mode agent · bridges to the Python engine over a custom comm port.
Open aegis-kernel →Threat Intelligence
Aegis pulls from public, no-cost feeds and refreshes its local blocklists on a schedule.
Kernel-like, without a signature?
You don't need a code-signing certificate (EV + WHQL) to get most of a kernel driver's power. Windows already ships Microsoft-signed enforcement layers you can orchestrate from user mode.
| Layer | What it gives you | Needs signing? | Secure Boot |
|---|---|---|---|
| AppLocker / WDAC | Kernel-enforced allow/deny of executables, DLLs, scripts | AppLocker: no · WDAC enforced: policy-signed | Yes |
| WFP | Kernel-enforced network/DNS blocking (the Web Shield) | No — registered from user mode | Yes |
| Defender CFA + Tamper | Ransomware folder guard + self-protection | Microsoft-signed | Yes |
| AMSI | Real-time script / PowerShell payload scanning | No | Yes |
| aegis-kernel .sys | IRP-level file block + true Protected-Process self-defense | Test-sign (free, SB off) or EV+WHQL (SB on) | Only with cert |
The honest line: AppLocker/WDAC + WFP + Defender + AMSI get you kernel-enforced
protection with Secure Boot fully on and zero signing cost. What they can't do for free is
IRP-level file interception and tamper-proof self-defense — those truly need a signed driver,
which is exactly what aegis-kernel provides (test-signed, free, or WHQL for production).
Build it. Run it. Own it.
Source, drivers, and CI are all public. No account, no telemetry, no paywall.