Autonomous Rust endpoint security agent combining Ring-0 Windows driver and Linux eBPF pre-execution blocking, YARA detection, MITRE ATT&CK mapping, and P2P mesh threat sharing.
Quick Start • Siquery-RS 98-Table Engine • Spider-Web Continuum Mechanics • AgentOctopus Multi-Ring Containment • Windows Service (OsoosiEDR) • Ring-0 Driver & eBPF • Agent Anomaly & EmbeddingGemma 2 • LangGraph Swarm • Hybrid Decision Engine • Velociraptor Forensics • DNS & Sysmon Setup • Two-Host BFT Mesh • 6-Pillar RL Controller • Active Tarpit & Hollowing • Adversarial Testing • Canary Anti-Blinding • MITRE ATT&CK & ATLAS • Wire STIX Sync • Mesh Stability • Visual Tour • WikiSkill Evolution • Open-Source Governance & Roadmap • CLI Reference
Ọ̀ṣọ́ọ̀sì (oh-SHAW-aw-see) is the Yoruba Orisha of the Hunt, Tracking, and Justice. In the Yoruba cosmological tradition, Ọ̀ṣọ́ọ̀sì is the divine tracker who never misses his mark — the archer whose arrow always finds its target. He is invoked for precision, the relentless pursuit of wrongdoers, and the swift delivery of justice.
This is the spirit of this project: an autonomous security agent that hunts threats with unerring accuracy, tracks adversaries across the mesh, and delivers swift, proportionate justice through quarantine, isolation, and deception. Like Ọ̀ṣọ́ọ̀sì, it is both patient (observing context, reasoning before action) and decisive (acting with confidence when the target is clear).
Traditional endpoint security and user-mode EDR agents operate reactively (post-execution). When an adversary executes malicious code:
ntdll.dll) can be trivially bypassed via direct system calls (SysWhispers, Hell's Gate), unhooking (VirtualProtect), or early in-memory ransomware encryption before user-mode analysis completes.OpenỌ̀ṣọ́ọ̀sì fundamentally eliminates this vulnerability window through hardware-enforced, kernel-space pre-operation blocking:
driver/windows/): Hooks PsSetCreateProcessNotifyRoutineEx. The driver callback executes synchronously inside the kernel's process creation routine before process handles are returned to user mode and before the primary thread executes its first CPU instruction. By setting CreateInfo->CreationStatus = STATUS_ACCESS_DENIED (0xC0000022), the OS kernel aborts process instantiation immediately.ebpf/): Hooks the kernel's BPF Linux Security Module hook bprm_check_security (osoosi_bprm_check). When a binary path or hash matches the kernel-space BPF hash map, the hook instantly returns -EACCES (-EPERM), preventing binary mapping and execution entirely without requiring third-party out-of-tree kernel modules.sequenceDiagram
autonumber
participant A as Adversary / Process Caller
participant K as OS Kernel (NTOSKRNL / Linux VFS)
participant D as OpenỌ̀ṣọ́ọ̀sì Kernel Subsystem (Ring-0 / BPF LSM)
participant E as Traditional User-Mode EDR (Sysmon ETW)
participant M as Malicious Binary Payload
rect rgb(255, 235, 235)
Note over A,E: TRADITIONAL USER-MODE EDR (POST-EXECUTION GAP)
A->>K: NtCreateUserProcess("ransomware.exe")
K->>M: Allocates PEB & Launches Initial Thread
M->>M: Executes malicious shellcode / Encrypts files
K-->>E: Asynchronous Sysmon Event 1 (Process Create)
E->>E: User-mode analysis & detection delay
Note over M: Damage inflicted BEFORE EDR can react
end
rect rgb(235, 255, 235)
Note over A,D: OPENỌ̀ṢỌ́Ọ̀SÌ HARDWARE-ENFORCED PRE-OPERATION BLOCKING
A->>K: NtCreateUserProcess("ransomware.exe")
K->>D: Synchronous Kernel Intercept (PsSetCreateProcessNotifyRoutineEx / LSM bprm_check_security)
D->>D: Sub-microsecond Spinlock Path & SHA-256 Rule Match
D-->>K: Set CreationStatus = STATUS_ACCESS_DENIED (0xC0000022) / -EACCES
K-->>A: NTSTATUS 0xC0000022 (Access Denied)
Note over M: Zero CPU instructions executed in user space! PEB discarded.
D->>D: Enqueue Intercept Event in Circular Ring Buffer
end
driver/windows/)