amberchalia/norm-edrExperimental kernel-mode EDR research project focused on explainable detection of suspicious in-memory execution patterns, producing human-readable alerts instead of opaque scoring or blocking.
NORM (Normal EDR) is an experimental kernel-mode EDR research project focused on explainable detection rather than silent blocking.
Instead of assigning scores or killing processes, NORM answers one question:
Why does this binary look suspicious?
This project is built step-by-step in public as a learning and research journey into how modern EDRs reason about behavior.
This release introduces a memory scanning routine capable of detecting a common in-memory execution pattern used by many commodity malware samples.
The driver now enumerates process memory regions and identifies suspicious memory with the following characteristics:
MEM_PRIVATEAllocationProtect = PAGE_READWRITEProtect = PAGE_EXECUTE_READThis pattern is commonly observed when shellcode is written to memory and later marked executable.
The driver performs the following steps:
KeStackAttachProcess.ZwQueryVirtualMemory.[ALERT] PID 4120 AllocationProtect: RW Protect: RX Type: PRIVATE
Instead, NORM produces clear, human-readable kernel alerts such as:
NORM is a kernel-mode driver and requires a dedicated lab environment.
A complete walkthrough covering:
is available here:
📺 How to Compile & Run NORM (Kernel Lab Setup)
👉 YouTube: https://www.youtube.com/watch?v=8NHgK_OSKj8
Written build steps are intentionally omitted to keep documentation in sync with the video series.
This project is:
Not production-ready. Do not deploy on real systems.
If you find this project useful and want to support continued development, you can help by buying me a coffee.
Your support helps cover:
👉 Support me on Buy Me a Coffee
Read about my challenges and technical insights on my blog: rootfu.in.