What selected capabilities actually do.

File and execution signals feed layered local analysis.

File-system and execution observations feed exact-hash signatures, Yara rules, structural heuristics, and classifier evidence. Unknown results remain unknown, and destructive actions require canonical identity checks plus a durable quarantine path.

Windows firewall controls plus endpoint and destination evidence.

Network observations correlate endpoint, process, and destination evidence where Windows exposes it. Defendrix manages explicit Windows Firewall rules, reports actual runtime state, and treats novelty as a signal rather than proof of compromise.

Inserted volumes are scanned when Windows makes them accessible.

Defendrix detects newly accessible removable volumes, inspects autorun metadata and files it can read, and routes confirmed detections through the authenticated quarantine vault. It does not claim kernel-level pre-mount interception.

Decoy changes add high-confidence ransomware evidence.

Decoy files in common target locations generate evidence when modified. The ransomware correlator combines independent decoy, entropy, and behavior signals, then binds any suspension or remediation request to an exact process identity.

Per-process baselining flags signature-clean drift.

Process, file, and network behavior features establish a local baseline and flag drift. Behavior is supporting evidence in the composite decision pipeline; a single anomaly does not authorize destructive remediation.

Allowlist-based execution. Unknowns queued for approval.

Unknown binaries can be held for review after exact hashing and identity checks. Protected operating-system targets fail closed, while publisher, reputation, ML, and behavioral evidence determine whether an unfamiliar file is allowed, blocked, or queued.

PowerShell abuse, WMI, COM hijack, reflective injection.

Inspects PowerShell, WMI, script, LOLBin, and injection indicators and uses AMSI when available. The resulting evidence feeds the same composite policy and does not claim complete coverage of fileless techniques.

Entropy, decoy, and behavior evidence drive exact containment.

When independent ransomware signals converge on the same verified process identity, Defendrix can suspend it and create a durable Pending Review record. Resume or terminate actions revalidate PID, creation time, image path, and file identity before acting; Defendrix does not advertise nonexistent user-file rollback.

Unknown binaries require corroborated evidence before allow.

Zero-trust execution correlates exact hash reputation, publisher evidence, local ML scoring, and bounded behavioral evidence. Invalid or incomplete evidence never becomes an allow verdict; low-confidence signals require behavioral corroboration.

Per-file Merkle chain catches supply-chain substitutions.

Observed writes to executables and scripts add authenticated provenance records containing the prior hash, new hash, and writer identity. A mismatch raises tamper evidence for the decision pipeline instead of trusting a filename, folder, or certificate alone.

Detects AI-generated phishing + malicious scripts.

A statistical classifier scores text and scripts for adversarial automation indicators. It is deliberately a soft signal: it contributes to composite severity but never authorizes quarantine on its own.

Boot records and EFI-relevant state are audited for change.

Defendrix audits boot-record and EFI-relevant state that Windows exposes, correlates unexpected changes with Secure Boot and hardware-attestation evidence, and reports degraded visibility. This user-mode module is not advertised as a kernel storage filter.

Detects in-memory patches to running system DLLs.

Live Patch Guard compares selected loaded module code with its on-disk image and raises tamper evidence when they diverge. Any response remains subject to exact process identity and durable remediation gates.

Integrity checks and watchdog recovery protect client availability.

The directory guard, startup enforcer, and authenticated watchdog detect integrity and liveness failures and attempt recovery from validated local material. Protection Health reports a degraded state when recovery cannot be confirmed.

Process, startup, and directory tamper signals feed recovery.

Defendrix protects its install and startup resources where Windows ACLs permit, watches for process and file tampering, and uses an authenticated watchdog for recovery. Kernel compromise remains outside a user-mode shield's trust boundary.

DNS sinkholing, rogue DHCP detection, host quarantine.

Rogue DHCP servers, poisoned DNS responses, and hosts that contact known-C2 destinations surface as first-class events where the operating system exposes the required signal. Explicit firewall and isolation actions remain local, verify their runtime result, and report reduced coverage when the requested control cannot be confirmed.

Gateway mapping inconsistencies raise a LAN MITM signal.

Authenticated local observations cross-check expected gateway mappings. Inconsistent ARP evidence raises an alert and can feed an explicit containment rule; a single novel mapping is not treated as conclusive attribution.

Authenticated bounded messages share observations with eligible peers.

Eligible LAN peers can exchange bounded, authenticated incident observations with freshness, sender-pinning, and replay checks. The current receiver is deliberately observe-only: it validates and records the signal without changing local protection policy or accepting a remote verdict.

9-digit ID per device. E2E-encrypted admin sessions.

Every Defendrix install exposes a 9-digit ID, but remote support is off by default. An authenticated administrator can request a session only after local opt-in and consent; approved end-to-end encrypted sessions expire automatically.

Peers score authenticated incident similarity in observe-only mode.

A confirmed incident can publish an authenticated behavioral fingerprint to eligible LAN peers. Receivers reject stale, malformed, identity-mismatched, unpinned, or replayed messages, score similarity, and record the would-have-hardened decision. Automatic peer hardening is not active in the current consumer build.

Fake SMB shares + endpoints trap lateral movement.

Fleet devices expose controlled decoy resources such as SMB shares and local endpoints. A contact becomes high-confidence evidence tied to the exact source identity; destructive remediation still passes the same quarantine and identity-verification gates as other detections.

First-ever host-to-host edges surface as lateral movement.

Defendrix models source-process and destination-host relationships as a per-fleet graph. First-seen edges raise an anomaly signal; Behavior, Fileless, reputation, and identity evidence determine the composite response rather than novelty alone.

See activated devices and release eligible non-admin seats.

Sign in with the email you purchased with to review activated devices and last-seen dates. After a fresh password check, the dashboard can release eligible customer-managed seats; protected Owner or administrator seats are not releasable there. Permanent in-app self-deletion is a separate irreversible action.

Licensed devices synchronize bounded policy and health state.

Licensed devices synchronize bounded policy, engine-state, health, and audit data through the configured license service. Snapshots are identity-bound, content-addressed, idempotent, and acknowledged before the local crash-safe queue advances; direct peer policy mutation remains disabled.

One tool bakes Defendrix into your Windows base image.

Run deploy.exe on your reference PC once. It installs Defendrix, pre-loads your license key, and arms the unattended-activation flag. Then Sysprep and clone as usual: every deployed machine activates itself on first boot, with nothing to push, type, or set up on the targets.