Meow Security

A Windows process, memory and network monitor — and a host intrusion detector. Runs entirely offline. Sends nothing, anywhere.

Most monitors tell you what is running. This one is built around why — because modern intrusions rarely drop a novel binary. They drive trusted, signed Windows tools, and a clean hash proves very little. What gives them away is context: who launched a process, from where, and with what arguments.

• Behavioural detection. Rules score each process on its parent chain, command line, image location and masquerading, and tag findings with MITRE ATT&CK ids. An encoded PowerShell command is decoded and judged by what it actually contains — hiding an attack scores worse than running one in the open; hiding an ordinary command is merely logged.
• Live capture from the kernel. Processes are judged the moment they are created, so a one-liner that runs and exits in 300 ms is not missed the way any one-second poll would miss it.
• Per-process network throughput. Windows keeps no such counter — even Task Manager's network column is machine-wide. This one adds up the kernel's own send and receive events, so you can see which program is uploading.
• Credential-theft detection. Every cross-process handle on the machine is resolved to the process it names. A handle to LSASS with read access is how credentials are stolen, whatever the tool is called and whoever signed it — the handle is the act, not a clue about it.
• Hidden process detection. Every process is enumerated through two independent sources and the lists are diffed; anything visible to one and not the other is surfaced.
• Injected code detection. Executable memory with no file behind it, PE headers implanted in another process's address space, and threads whose entry point lies outside every mapped image — code running from nowhere on disk.
• Library hijacking. A signed program with an unsigned library loaded from a folder anything can write to. Nothing is injected and nothing is patched, so no rule that judges a process by its own image can see it — the lie is one directory down.
• Privilege inspection. Integrity level, an enabled debug privilege, a thread running under somebody else's token. A binary that ends up as administrator is usually the same binary that started as the user; what changed is the token.
• Autoruns, with control. Registry Run keys, Startup folders, auto-starting services and drivers, scheduled tasks, and WMI event subscriptions — the persistence that appears in none of the other four, so checking all of them and stopping is checking nothing. All signature-checked, and each one can be opened, disabled or removed. Disabling writes the same flags Task Manager uses, so the machine agrees with itself and every change can be undone. WMI subscriptions are reported, not removed.
• Accounts and sessions. Every local account, which of them are administrators, which can still sign in, and who is signed in right now — with where a remote session is coming from. An account is the most durable foothold there is: it survives killing every process, clearing every startup entry and deleting the malware itself. Nothing here is ever changed automatically, because a wrong automated action on an account locks the owner out of their own machine.
• Known control channels. Named pipes matching the defaults that post-exploitation frameworks ship with — recognised by name alone. The pipes are never connected to: doing so would take a single-instance server away from a working program, and a monitor that damages what it watches has failed.
• A durable event log, so "what happened while I was away" has an answer.
• Plain-language alerts. Every finding comes with what it means and what to do about it, in two sentences, with the buttons to do it.

Overview · Processes · Network · Autoruns · Threats · Alerts · Events · Settings. Arabic interface, light and dark themes.

It collects nothing and transmits nothing. There are no accounts, no keys, no telemetry and no servers. See PRIVACY.md for exactly what is written to disk and where.

Requires the .NET 10 SDK on Windows.

dotnet build MeowSecurity.Gui/MeowSecurity.Gui.csproj
dotnet run   --project MeowSecurity.Cli -- --rule-test

Run elevated for full visibility: the live kernel capture, protected processes and machine-wide autoruns all need administrator rights. Without them the monitor still runs and tells you which parts are limited.

Meow Security is a monitor and an analyser. It is not a replacement for Microsoft Defender or any antivirus, and it does not try to be one.

GNU General Public License v3.0. You may use, study and modify this freely; any copy you distribute must remain open source under the same licence.

Copyright © 2026 Mohammed Abd Alrahman mohmadev.com · github.com/dvlinuxx-max