← Polymath.OS // Captain's Log

Resume Tech and Windows Defender Enhancer Script

2026-09-08

Wow this came out way better than I thought. The new Gemini Flash model is really something. May be better than the pro model for coding. Not too sure yet, but I'm sure they have the results already. Ok I checked: TLDR it's better in every way besides in some niche complex or legacy use cases.

Most of this stuff you can do IN Windows manually. It just sucks, and no one wants to do that, easy to make mistakes. That's basically the reasoning behind this. In the end it should be way faster and easier to do secure your Windows PC - with basically no hit to performance, like other antivirus seems to do in a huge way.

All consumer antivirus is trash honestly (95% of the time you're better of it without it), besides Windows Defender; that's peak. You don't need more than Windows Defender, you need more education. If you don't know what you're doing online nothing will protect you from yourself! Even the experts get caught lacking all the time; numerous expensive mistakes were made (many we never hear about, they usually pay the ransom) and I guarantee will continue to get made, probably at an accelerated pace now with how good the AI is.

Oh and funny side note: many cybercriminal organizations even have Yelp like pages where companies who got hacked can leave reviews 😂😂😂. I wonder what those look like!

"Paid ransom, and everything was fixed!" or "Great service from Fyodor, would get hacked by his friends again!" 😂😂😂😂😂

The solutions to these problems are looking VERY bleak as well, unless you're like the AI companies, or Google etc. Hugging face needed AI to counteract and to even begin to understand the AI swarm attack on their infrastructure. That may be where it's all headed to.

2. Is AegisClean (NAME IS WIP) Actually Useful in a Real Cybersecurity Sense? (Defense-in-Depth vs. Snake Oil)

Yes, significantly so. Many consumer "optimizers" or "debloaters" are essentially snake oil—they disable essential security services to artificially reduce idle RAM by a few megabytes while weakening system security.

AegisClean is engineered from the ground up to do the exact opposite: it systematically reduces attack surfaces while hardening enterprise-grade Windows defenses.

Here is the technical reality of how AegisClean delivers real cybersecurity defense:

+-----------------------------------------------------------------------------------------+

| REAL-WORLD CYBER DEFENSE IN AEGISCLEAN |

+-----------------------------------------------------------------------------------------+

| 1. Proactive Threat Containment (ASR Rules) |

| -> Blocks Office child processes (T1059: Emotet, Qakbot macro droppers) |

| -> Blocks LSASS memory dumping (T1003: Mimikatz credential theft) |

| -> Blocks unsigned USB executables (T1091: Stuxnet/worm propagation) |

| -> Blocks Adobe child processes & BYOVD vulnerable drivers |

+-----------------------------------------------------------------------------------------+

| 2. Persistence Forensics & Safe Vaulting (T1547) |

| -> Audits HKCU/HKLM Run keys, 32-bit Run, startup folders, and scheduled tasks |

| -> Quarantines malware autostarts non-destructively (.aegis_disabled & reg vaults) |

+-----------------------------------------------------------------------------------------+

| 3. Firmware, Bootkit & CPU Microcode Hardening |

| -> Validates UEFI Secure Boot & TPM 2.0 (T1542.003: BlackLotus bootkit defense) |

| -> Verifies CPU mitigations (Spectre v2, Meltdown, Downfall, Zenbleed, VBS/HVCI) |

+-----------------------------------------------------------------------------------------+

| 4. Driver Integrity & Cloud Threat Intelligence |

| -> Authenticode verification of active kernel drivers in System32\drivers |

| -> Sysinternals sigcheck + VirusTotal query against 70+ antivirus engines (BYOVD) |

+-----------------------------------------------------------------------------------------+

| 5. Network Privacy & Anti-Snooping (DoH) |

| -> Enforces encrypted DNS via Cloudflare/Quad9 over HTTPS (Port 443) |

| -> Prevents plaintext UDP 53 DNS poisoning, ISP profiling, and MITM hijacking |

+-----------------------------------------------------------------------------------------+

Detailed Breakdown of Threat Mitigations:

  1. Attack Surface Reduction (ASR) — Microsoft's Enterprise Exploit Guard:

    • The Problem: Standard Windows Defender relies heavily on reactive signatures (scanning files after they drop or executing heuristic memory scans). If a zero-day dropper lands on disk, reactive scanning may not catch it in time.
    • The AegisClean Defense: ASR enforces proactive behavioral containment:
      • Rule d4f940ab-401b-44c7-aadc-313c4c4b4614: Kills any process spawned by Word, Excel, or PowerPoint. When a phishing email contains a macro attempting to launch cmd.exe or powershell.exe, Windows kills the process before a single instruction runs.
      • Rule 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2: Strips debug/read handles to lsass.exe. Untrusted programs cannot read memory to harvest plaintext NTLM hashes or Kerberos tickets (defeating Mimikatz).
      • Rule 56a863a9-875e-4185-98a7-b882c60b3ce5: Blocks the execution of known vulnerable signed drivers, directly blunting BYOVD (Bring Your Own Vulnerable Driver) attacks used by BlackCat/ALPHV and Cuba ransomware.
    • Why AegisClean's Approach is Unique: Most users avoid ASR because corporate policies can break legitimate tools (like a game launcher or custom compiler). AegisClean monitors the Windows Defender event log (Event IDs 1121 & 1122), displays blocked events in real time, and provides 1-Click [✅ Trust & Allow] and [❌ Revoke] allowlisting.

  2. Persistence & Autostart Forensic Auditing (MITRE ATT&CK T1547):

    • 99% of malware, info-stealers (RedLine, Lumma), and remote access trojans (RATs) must survive a reboot. They hide in HKCU/HKLM Run, RunOnce, Startup folders, or logon scheduled tasks.
    • AegisClean inventories every persistence vector across user and system scopes, checks digital signatures, and provides non-destructive quarantining (.aegis_disabled extensions and registry vaulting) rather than destructive deletion.

  3. Firmware & Kernel Isolation Posture (Bootkit Defense):

    • Validates UEFI Secure Boot, TPM 2.0 readiness, and Hypervisor Code Integrity (HVCI). If Secure Boot is off, rootkits like BlackLotus or CosmicStrand can hijack the boot sequence before Windows even loads. AegisClean flags this immediately.

  4. Driver Authenticode & Cloud Verification (Sysinternals + VirusTotal):

    • Modern threat actors frequently deploy validly signed, but dangerously vulnerable, third-party kernel drivers (e.g., Process Hacker or ancient motherboard utility drivers) to terminate antivirus software directly from Ring 0.
    • AegisClean verifies Authenticode certificates of drivers in System32\drivers and queries their SHA-256 hashes against 70+ antivirus engines on VirusTotal.

3. How We Made It Even Better: Built-In In-App Self-Auditing

You asked: "how can we make it even better and more robust, maybe so it can audit itself?"

We took that concept and wired it directly into the application:

  1. In-App Self-Audit Card in ⚙️ Settings:
    • Added a dedicated card in the GUI: 🛡️ Application Self-Integrity & Cryptographic Audit with an interactive button: [🔍 Run Application Self-Audit Now].
  2. Live Asynchronous Verification Engine:
    • When clicked from within the GUI, AegisClean launches its self-audit engine, reads checksums.sha256, and streams each step directly into the real-time activity log:
      • [1/4] Cryptographic Hash Verification: Re-computes SHA-256 for all 25 source files to guarantee zero on-disk tampering or corruption.
      • [2/4] AST & XAML Parser Zero-Defect Audit: Parses all 21 PowerShell scripts and the XAML layout.
      • [3/4] Pre-Flight Diagnostics: Checks free disk space (≥5 GB≥5 GB), VSS service, System Restore, and DISM store.
      • [4/4] Immutable OS Lock Verification: Simulates tampering with protected kernel services (RpcSs) and verifies that the safety lock blocks modification.
    • If any file has been modified, corrupted, or infected by file-infector malware, the audit immediately flags the exact file and alerts the operator.

4. Future Evolution: The Kernel-Level Frontier (Ring 0 vs. Ring 3 Deep Dive)

This part is a big IF - maybe sometime in the future. Right now it's just blind speculation/ideation. Wayyyy too risky to attempt, and not needed for my use case at least. Last time I had a virus was 20 years ago trying to bot on RuneScape.

It would be pretty crazy... Ideally it won't be needed in the future, Non-scummy antivirus like Window Defender will just be that good automatically, and probably agentically.

Here is an architectural breakdown of what a Ring 0 / Kernel-Level AegisClean would look like, the capabilities it would unlock, and the significant engineering trade-offs:

+-----------------------------------------------------------------------------------------+

| RING 3 (USER MODE) |

| [AegisClean v1.0 GUI / PowerShell Engine] |

| * High safety: A crash terminates only the process; cannot BSOD the PC. |

| * Queries Windows APIs (CIM, WMI, Event Logs). |

| * Subject to user-mode API hooking if an attacker already holds Ring 0 privileges. |

+-----------------------------------------------------------------------------------------+

                                  |  IOCTLs / Fast I/O

                                  v

+-----------------------------------------------------------------------------------------+

| RING 0 (KERNEL MODE) |

| [AegisClean.sys - Windows Kernel Driver / Minifilter] |

| |

| 1. Process Creation Callbacks (PsSetCreateProcessNotifyRoutineEx) |

| * Intercepts process launches BEFORE the first thread executes in memory. |

| * Returns STATUS_ACCESS_DENIED directly to the OS kernel scheduler. |

| |

| 2. Object Manager Callbacks (ObRegisterCallbacks) |

| * Intercepts handle creation to critical processes (lsass.exe, AegisClean.exe). |

| * Strips PROCESS_VM_READ/WRITE: Makes Mimikatz and process killing impossible. |

| |

| 3. File System Minifilter (FltRegisterFilter) |

| * Intercepts I/O Pre-Create/Pre-Write. |

| * Detects ransomware encryption bursts (entropy spikes) and blocks disk writes. |

| |

| 4. Registry Filter (CmRegisterCallbackEx) |

| * Intercepts registry key creation; locks persistence Run keys in real time. |

| |

| 5. Early Launch Anti-Malware (ELAM) |

| * Boots before all third-party drivers to block malicious bootkits. |

+-----------------------------------------------------------------------------------------+

What Kernel Level Would Enable (The Superpowers):

  1. Zero-Latency Process Interception (PsSetCreateProcessNotifyRoutineEx):
    • Instead of monitoring Defender event logs after an alert is generated, a kernel driver is called synchronously by the Windows NT executive whenever CreateProcess is invoked. The driver can inspect the binary's hash, digital certificate, and parent process, and deny execution before a single instruction reaches the CPU.
  2. True Anti-Tamper Shield (ObRegisterCallbacks):
    • Even an attacker with NT AUTHORITY\SYSTEM or local Administrator rights cannot kill a protected process if a kernel driver strips PROCESS_TERMINATE, PROCESS_VM_READ, and PROCESS_VM_WRITE permissions from any process handle opened against it.
  3. Real-Time Ransomware Heuristic Minifilter (FltRegisterFilter):
    • A file system minifilter sits in the I/O stack above NTFS. It monitors I/O requests. If a process starts rapidly overwriting documents with high Shannon entropy (encrypted garbage) or appending extensions (.locked), the driver terminates the process handle and rolls back the in-flight I/O buffer before files are lost.

Why Kernel Development Requires Extreme Caution:

  1. Zero Margin for Error (BSOD Risk):
    • In User Mode (where AegisClean runs now), an unhandled exception or null reference simply outputs an error string. In Kernel Mode, a single page fault or invalid pointer immediately triggers a kernel panic (BugCheck / Blue Screen of Death).
  2. The CrowdStrike Lesson (July 2024):
    • The July 2024 global CrowdStrike outage demonstrated the inherent risk of kernel-mode security agents: an invalid memory read in a kernel channel driver caused 8.5 million enterprise Windows machines to crash into boot loops.
  3. Mandatory WHQL & Extended Validation (EV) Code Signing:
    • Microsoft does not permit custom 64-bit kernel drivers to load unless they are signed with an expensive EV Hardware Token certificate and submitted to Microsoft Partner Center for WHQL (Windows Hardware Quality Labs) attestation.
  4. The Modern Industry Direction: eBPF for Windows:
    • Following the CrowdStrike outage, Microsoft launched the Windows Resiliency Initiative, pushing security software vendors out of Ring 0 and toward sandboxed eBPF (Extended Berkeley Packet Filter) for Windows. eBPF allows running verified, sandboxed bytecode programs in the kernel that are mathematically proven incapable of crashing the operating system.