Repolode
Submit
87owo

87owo/PYAS

A Windows endpoint security app combining YARA rules, PE machine-learning inference, signature checks, optional cloud analysis, and a kernel minifilter driver.

Open-source alternative to:Microsoft DefenderKaspersky Internet Security

View on GitHubWebsite
Stars
582
Forks
50
Open issues
0
Last commit
2 days ago

What is it?

PYAS Security is a Windows endpoint security application that bundles several detection and protection layers into one desktop program. Local scanning uses YARA rules, PE feature extraction with ONNX model inference, and Authenticode signature verification. Users can optionally submit files for cloud analysis, which is configured separately from the local engines.

For real-time protection, the project monitors processes, files, process memory, TCP connections, and system settings from user mode. It also includes a native C++ minifilter driver that enforces configurable rules covering file, process, thread, registry, memory, image-load, and boot/disk operations. A Blockly-based visual editor is provided for building those driver rules.

The application also includes quarantine, allow and block lists, startup management, system repair, cleanup, and MBR backup and check tools. Its model-training utilities and rule files make it usable as a base for studying malware detection and Windows internals. Running the driver and remediation features requires administrator rights and is recommended only in a test environment.

Key features

  • 01Scans files with YARA rules and local PE machine-learning models run through ONNX Runtime.
  • 02Verifies Authenticode digital signatures using Windows trust APIs.
  • 03Monitors new processes, file changes, process memory, and TCP connections.
  • 04Includes a C++ minifilter driver with configurable protection rules.
  • 05Provides quarantine, allow/block lists, startup management, and system repair tools.

Use cases

  • Studying malware detection with YARA rules and PE feature-based models.
  • Experimenting with Windows minifilter drivers and kernel-level protection rules in a test VM.
  • Scanning suspicious files locally before deciding whether to submit them to cloud analysis.

Quick start

  1. 1

    Clone the repository

    git clone https://github.com/87owo/PYAS.git
  2. 2

    Enter the project folder

    cd PYAS
  3. 3

    Create and activate a virtual environment

    .\.venv\Scripts\Activate.ps1
  4. 4

    Install dependencies and run the app (run as administrator for full features)

    pip install pystray pefile requests pywebview Pillow yara-python numpy onnxruntime && python PYAS.py

Things to know

  • Windows 10 or 11 only, and full protection requires administrator privileges.
  • Kernel driver features need a WDK build environment and proper signing for production use.
  • The public repository does not include the cloud server implementation.
  • The README says the project is source-available and asks users to review third-party licenses; the license is unclear (NOASSERTION).

Topics

#security#antivirus#windows#yara#machine-learning#malware-detection#kernel#cpp#lightgbm#pefile

FAQ

What is PYAS?
A Windows endpoint security app combining YARA rules, PE machine-learning inference, signature checks, optional cloud analysis, and a kernel minifilter driver. PYAS Security is a Windows endpoint security application that bundles several detection and protection layers into one desktop program. Local scanning uses YARA rules, PE feature extraction with ONNX model inference, and Authenticode signature verification. Users can optionally submit files for cloud analysis, which is configured separately from the local engines.
Is PYAS free to use? What license does it have?
PYAS is open source under the Other license. Check the license terms before using it in commercial products.
Is PYAS still maintained?
Actively maintained. The last commit to PYAS was on Oct 17, 2026.
What can I use PYAS for?
Studying malware detection with YARA rules and PE feature-based models. Experimenting with Windows minifilter drivers and kernel-level protection rules in a test VM. Scanning suspicious files locally before deciding whether to submit them to cloud analysis.
How do I install PYAS?
Clone the repository: git clone https://github.com/87owo/PYAS.git Enter the project folder: cd PYAS Create and activate a virtual environment: .\.venv\Scripts\Activate.ps1 Install dependencies and run the app (run as administrator for full features): pip install pystray pefile requests pywebview Pillow yara-python numpy onnxruntime && python PYAS.py
Where can I get PYAS?
The source code and installation instructions are on GitHub: https://github.com/87owo/PYAS

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects