⚡ ABYSSAL WATCHER (v1.04-HARDENED) ⚡

Enterprise Host-Based Intrusion Detection (HIDS) & Endpoint Detection and Response (EDR)

A mission-critical endpoint defense hypervisor fusing low-level assembly anti-analysis traps, in-memory SHA-256 cryptographic verification, pure-Rust YARA/Sigma correlation, dynamic rotating KMS envelopes, and real-time WebSocket telemetry.

---

🛡️ 1. Executive Summary

Abyssal Watcher is an industrial-grade, defense-in-depth Host-Based Intrusion Detection System (HIDS) and Endpoint Detection and Response (EDR) engine. Engineered for operation in untrusted, hostile, or contested host environments, it actively denies reverse-engineering attempts, identifies complex memory injections and process hollowing, correlates parent-child telemetry via Sigma rules, and streams structured alerts mapped to the MITRE ATT&CK matrix directly to Security Operations Centers (SOC).

 ┌────────────────────────────────────────────────────────────────────────────────────────┐
 │                      ABYSSAL WATCHER MULTI-VECTOR ARCHITECTURE                         │
 │                                                                                        │
 │  ┌───────────────────────────┐    MemoryGuard / ASM Traps   ┌───────────────────────┐  │
 │  │ Hardware & OS Layer       │ ───────────────────────────► │ Low-Level Defenses    │  │
 │  │ (x86_64 CPUID / ptrace)   │ ◄─────────────────────────── │ (TF / RDTSC / Anti-VM)│  │
 │  └─────────────┬─────────────┘                              └───────────────────────┘  │
 │                │                                                                       │
 │                ▼                                                                       │
 │  ┌───────────────────────────┐    Pure-Rust YARA & Sigma    ┌───────────────────────┐  │
 │  │ Multi-Vector Threat Engine│ ───────────────────────────► │ MITRE ATT&CK Taxonomy │  │
 │  │ (Shannon Entropy / Heur)  │                              │ (T1055, T1059, T1027) │  │
 │  └─────────────┬─────────────┘                              └───────────────────────┘  │
 │                │                                                                       │
 │                ▼                                                                       │
 │  ┌───────────────────────────┐    Tokio / Actix-Web / AES   ┌───────────────────────┐  │
 │  │ Telemetry & KMS Layer     │ ───────────────────────────► │ SIEM / SOC Dashboard  │  │
 │  │ (45s Key Rotation / Log)  │                              │ (CEF / ECS / WS Live) │  │
 │  └───────────────────────────┘                              └───────────────────────┘  │
 └────────────────────────────────────────────────────────────────────────────────────────┘

---

🏗️ 2. Architecture & Defense-in-Depth

The platform is structured into four distinct, hardened architectural tiers:

🔹 Phase 1: Low-Level Engine & Anti-Analysis Hardening

• NASM Assembly Modules:
  • anti_vm.asm: Interrogates CPUID leaf 1 (bit 31) and leaf 0x40000000 hypervisor vendor signatures (KVM, VMware, Hyper-V, Xen).
  • hook_detect.asm: Fast opcode scanner identifying prologue hooks, 0xE9 (JMP rel32), 0xEB (JMP rel8), 0xFF 0x25 (JMP indirect), 0x48 0xB8 (MOV RAX; JMP RAX), and 0x68 ... 0xC3 (PUSH/RET) trampolines.
  • anti_debug_ultra.asm: Direct CPU register polling (RFLAGS.TF), RDTSC timing latency delta thresholds, and memory INT3 scans.
• MemoryGuard Integrity Engine: core/memory_guard.rs calculates standalone SHA-256 checksums over .text code segments to detect unauthorized runtime patching. Includes a Shannon entropy calculator ($0.0 - 8.0$) to flag encrypted/packed payloads ($>7.0$).
• Zero-Exposure Mode (ZE_MODE): defense/ze_mode.rs enforces atomic lockdown and memory zeroization stubs using write_volatile.

🔹 Phase 2: Detection Engine Overhaul

• Pure-Rust YARA Engine: analyzer/yara_engine.rs evaluates multi-string patterns and hex signatures without native C bindings or external dependencies.
  • Ruleset: data/rules/yara/edr_signatures.yar (Reflective DLL loaders, process hollowing API chains, XOR shellcode loops).
• Sigma Event Correlation: analyzer/sigma_parser.rs inspects process spawn trees (e.g. w3wp.exe $\rightarrow$ powershell.exe) and command-line arguments (-enc, bypass, iex).
  • Ruleset: data/rules/sigma/process_creation.yml.
• MITRE ATT&CK Matrix Resolver: analyzer/mitre_matrix.rs enriches all detections with standard Enterprise Tactics (TA0001 - TA0040) and Technique IDs (T1055.001, T1055.012, T1027.002, T1059.001, T1003.001, T1622).
• Adaptive Threat Cache: analyzer/threat_cache.rs provides a thread-safe LRU cache with temporal exponential decay ($e^{-\lambda t}$) and sliding hit counters.

🔹 Phase 3: Backend & Telemetry Maturation

• Dynamic Ephemeral KMS: infra/secure_kms.rs automatically rotates 256-bit AES keys every 45 seconds (epoch_id) and immediately scrubs retired keys from memory.
• Tamper-Evident Hash-Chained Logging: infra/secure_logger.rs wraps log records in authenticated AES-256-GCM AEAD envelopes bound via sequential SHA-256 chain hashes: $$\text{ChainHash}n = \text{SHA-256}(\text{EpochID} \mathbin{\Vert} \text{Nonce} \mathbin{\Vert} \text{ChainHash}{n-1} \mathbin{\Vert} \text{Ciphertext})$$
• Non-Blocking Asynchronous EventBus: infra/event_bus.rs uses Tokio broadcast channels with a 2,048-message buffer for zero-lag alert dissemination.
• SIEM Forwarding Pipeline: infra/siem_exporter.rs formats structured events for Splunk, Elastic Common Schema (ECS) JSON, and ArcSight Common Event Format (CEF:0).

🔹 Phase 4: UI/UX Operations Console & Deployment Packaging

• React 18 SOC Dashboard: frontend/src/App.jsx built with TailwindCSS, dark cybersecurity styling, live WebSocket event consumption, interactive threat injection simulator, and host quarantine controls.
• Hardened Docker Distribution: Multi-stage Dockerfile running an unprivileged system daemon on minimal attack surface Debian Bookworm Slim with Link-Time Optimization (LTO).
• Linux Sandboxing Service: infra/systemd/abyssal_watcher.service with ProtectSystem=strict, NoNewPrivileges=true, and strict cgroup resource constraints.

---

🧰 3. Prerequisites & Toolchain

Component	Minimum Version	Purpose
Rust Toolchain	1.75+ (2021 Edition)	Core binary compilation (cargo, rustc)
Node.js / npm	v18.0.0+	React 18 Frontend Console (vite, tailwindcss)
NASM	2.15+	x86_64 Assembly Traps Compiler
Docker & Compose	24.0+ / v2.20+	Containerized Multi-Stage Cluster Deployment

---

🚀 4. Execution & Deployment Guide

A. Run the Standalone Security Scanner

Inspects system integrity, executes anti-debug/anti-VM traps, and runs multi-vector heuristic evaluation:

cargo run --bin abyssal_entrypoint

B. Run the Telemetry & EDR Backend Daemon

Launches the Actix-Web REST API server and WebSocket broadcast engine on 0.0.0.0:8080:

cargo run --bin abyssal_watcher

C. Spin Up the React SOC Console (Development)

cd frontend
npm install
npm run dev
# Operations console available at http://localhost:3000

D. Production Container Cluster (One-Command Deployment)

Builds optimized binaries, bundles the frontend, and deploys the hardened EDR container:

docker-compose up -d --build
# REST API & Console exposed on http://localhost:8080

E. Run Full Integration Verification Suite

cargo test --test integration_test -- --nocapture

---

📡 5. API & SIEM Integration

Core REST Endpoints

Method	Endpoint	Description	Sample Output
GET	/api/status	Host engine health & defense status	{"system":"Abyssal Watcher","ze_mode_enabled":true,"memory_guard_status":"SEALED"}
POST	/api/heartbeat	Ingests agent telemetry heartbeat	{"status":"ACK","acknowledged_at":1723224000000}
GET	/api/alerts	Paginated threat alerts (?page=1&limit=20)	{"total":1,"items":[{"id":1,"assessment":{...}}]}
POST	/api/threats	Submits memory buffer/process for scan	Returns full normalized ThreatAssessment JSON

Live WebSocket Stream

• Endpoint: ws://localhost:8080/ws/telemetry
• Protocol: JSON event frames pushed over low-latency Tokio broadcast channels.
• Payload Structure:

{
  "topic": "threat.detection",
  "level": "CRITICAL",
  "timestamp": 1723224150000,
  "payload": "{\"composite_score\":85,\"confidence_level\":\"CRITICAL\",\"mitre_techniques\":[{\"id\":\"T1055.001\",\"name\":\"DLL Injection\"}]}"
}

SIEM Formats

# ArcSight Common Event Format (CEF:0)
CEF:0|AbyssalWatcher|EDR|1.04|THREAT_DETECTED|Abyssal_Reflective_DLL_Loader|10|dhost=endpoint.corp cs1Label=MITRE cs1=T1055.001:DLL Injection cn1Label=CompositeScore cn1=85 cs2Label=Confidence cs2=CRITICAL

---

📄 6. Repository Layout

abyssal_watcher/
├── analyzer/                 # Threat evaluation, YARA, Sigma, and MITRE resolution
│   ├── mitre_matrix.rs       # MITRE ATT&CK taxonomy dictionary & lookup
│   ├── ml_analyzer.rs        # Behavioral keyword & n-gram heuristics
│   ├── sigma_parser.rs       # AST-based Sigma process correlation engine
│   ├── threat_cache.rs       # High-speed LRU cache with exponential score decay
│   └── yara_engine.rs        # Pure-Rust regex/bytecode YARA evaluator
├── core/                     # Low-level systems primitives and integrity seals
│   ├── asm_module/           # Assembly anti-analysis traps
│   │   ├── anti_debug.asm    # 16-bit Trap Flag inspector
│   │   ├── anti_debug_ultra.asm # 64-bit TF, RDTSC timing, and INT3 traps
│   │   ├── anti_vm.asm       # CPUID hypervisor bit & artifact checks
│   │   └── hook_detect.asm   # JMP/CALL/Trampoline prologue hook scanner
│   └── memory_guard.rs       # SHA-256 .text hashing & Shannon entropy engine
├── defense/                  # Runtime host defenses and sandbox reduction
│   ├── anti_debug.rs         # TracerPid, wchan, and PTRACE_TRACEME detection
│   ├── anti_vm.rs            # CPUID intrinsics & Linux DMI table inspection
│   └── ze_mode.rs            # Zero-Exposure Mode & volatile memory zeroization
├── engine/                   # Multi-vector threat aggregation
│   └── threat_detector.rs    # Unified composite score (0-100) calculation
├── entrypoint/               # Standalone verification scanner binary
│   └── main.rs
├── frontend/                 # React 18 + TailwindCSS SOC Console
│   ├── src/
│   │   ├── components/       # ThreatMatrix, LiveTelemetry, DefenseStatus
│   │   ├── App.jsx           # Master operations dashboard & simulator
│   │   └── main.jsx
│   ├── package.json
│   └── vite.config.js
├── infra/                    # Telemetry, cryptographic KMS, and SIEM pipeline
│   ├── event_bus.rs          # Async Tokio broadcast event bus
│   ├── secure_kms.rs         # 45s Ephemeral key rotation & zeroization
│   ├── secure_logger.rs      # Tamper-evident hash-chained AES-256-GCM logging
│   ├── siem_exporter.rs      # CEF:0 and Elastic Common Schema (ECS) exporter
│   └── systemd/              # Hardened Linux service unit
├── data/rules/               # Curated EDR detection rulesets
│   ├── sigma/process_creation.yml
│   └── yara/edr_signatures.yar
├── src/                      # Library & Actix-Web API Server
│   ├── api.rs                # REST router & alert store
│   ├── lib.rs                # Crate root definitions
│   ├── main.rs               # Backend server entrypoint
│   └── ws.rs                 # WebSocket streaming actor
├── tests/                    # Comprehensive integration verification
│   └── integration_test.rs
├── Cargo.toml                # Rust project manifest
├── Dockerfile                # Production multi-stage build container
└── docker-compose.yml        # Turnkey cluster orchestration

---

Abyssal Watcher — Fortified Endpoint Defense for the Modern Threat Landscape.
Developed & Maintained under CNO Architecture Directives.