MECCA SEC // DEFENSE ENGINE //
Security that watches behavior, not signatures.
Echo is a real-time agent for Windows and Linux servers. It monitors every running process, scores suspicious behavior against MITRE ATT&CK-mapped rules, reconstructs the attack chain, and automatically stops high-confidence threats on Windows — with a live dashboard and instant phone alerts on both. It runs locally; nothing leaves your machine.
Rule-based detection. No cloud, no accounts, no telemetry.
How it works
Four steps from process start to threat stopped
Watch
Every process, continuously
Sees every process: name, command line, parent process, code-signing status, file entropy, and network connections.
Score
Behavior against MITRE ATT&CK rules
Rules mapped to MITRE ATT&CK score behavior; the threat score decays over time so noise fades and real activity stands out.
Reconstruct
Attack chain as a readable story
Links parent-to-child process lineage into a readable attack story — what spawned what, in what order, and which rules fired at each step.
Respond
Terminate or alert
Auto-terminates high-confidence threats and logs every action; sends a phone alert for everything else so you can review and decide.
Detection coverage
What Echo watches for
Detection rules are mapped to MITRE ATT&CK techniques. These are the categories currently covered.
Credential dumping
Mimikatz and LSASS credential-dump techniques — comsvcs MiniDump, procdump, and similar command-line patterns.
Ransomware precursors
Shadow-copy and backup deletion, boot-recovery tampering.
Persistence
Run keys, Windows services, scheduled tasks, and WMI event subscriptions.
Data exfiltration
Upload and transfer commands, posts to known drop sites, and outbound traffic from flagged processes.
Defense evasion
Encoded or hidden PowerShell, LOLBins, name masquerading, and Office apps spawning a shell.
Browser credential theft
Processes reaching into browser login and cookie stores — Chrome, Edge, and Firefox.
Removable-media execution
Programs launched from USB and removable drives.
Suspicious binaries
Unsigned, packed executables running from Downloads, Temp, and AppData.
Live dashboard
See every threat in real time
Echo's local dashboard surfaces threat scores, process trees, and behavioral signals — no cloud required.
Features
What you get
Live dashboard
See every running process, its current threat score, and the rules that have fired — updated in real time.
Phone push alerts
Get notified on your phone when Echo flags a process. Quiet hours supported. Review the detection chain and respond from anywhere.
Automatic response
High-confidence detections are terminated automatically. Toggleable. Every action is logged.
Microsoft Defender integration
See Defender's current status and trigger an on-demand scan directly from the Echo dashboard.
Allow-list control
Silence trusted programs in one click. Useful for security research tools and dev environments.
Local-first
No data leaves your machine. No cloud account. No internet required. No telemetry.
Linux & Cloud Servers
Now protecting Linux servers, too
The same behavior-based approach, built for Linux cloud servers. Echo for Linux watches every process on your VM and flags what actually happens when a server is compromised. Early access — in active development.
What it watches for on Linux
Reverse & bind shells
/dev/tcp redirects, netcat, interpreter socket-to-shell
Crypto-miners
Known miners, mining-pool connections, miner flags
Download-and-execute
curl|sh, base64-decoded payloads, staging in /tmp
Credential access
Reading /etc/shadow, SSH keys, process memory dumps
Anti-forensics
Wiping logs or history, disabling auditd, firewall, or SELinux
Persistence
Cron, systemd services, SSH authorized_keys, shell rc files, ld.so.preload
Suspicious execution
Binaries run from /tmp or /dev/shm, deleted-binary execution
Installs as a systemd service, logs to the journal, with a local dashboard over SSH and the same phone alerts. Alert-only today — automatic response comes once it's proven on real workloads.
Who it's for
Real-time visibility without an enterprise budget
Individuals
Behavioral monitoring on your personal Windows machine — without paying enterprise prices or sending your data to a cloud.
Developers & power users
You run untrusted code, build tools, and work in environments where signature AV generates noise. Echo watches behavior, not file hashes.
Small teams
Real detection capability without the overhead of an enterprise EDR deployment or a dedicated security team to run it.