ExfilGuardian
Advanced Data Exfiltration Detection System - Documentation
Introduction
ExfilGuardian is a real-time data-exfiltration detection system with a distributed, multi-platform architecture. A kernel driver intercepts traffic and endpoint context (processes, files, DNS) on each machine, a local agent streams the telemetry to a central analysis server over gRPC/mTLS, and a desktop dashboard presents the correlated alerts.
By design — a Ring 0 endpoint sensor, process/file context, and centralized correlation — it resembles an EDR, but its scope is focused: detecting exfiltration rather than covering a general-purpose EDR's full response lifecycle. Windows is the primary platform (WFP kernel driver at Ring 0 + a Ring 3 user-space agent); Linux uses eBPF and macOS a passive capture agent. The entire backend is written in Rust for memory safety and performance; the desktop dashboard is built with Electron + Next.js.
Quick Links
- Getting Started - Set up your development environment
- Architecture - System design and data flow
- Conventions - Coding standards, naming, and best practices
- Backend - Rust workspace documentation
- Frontend - Desktop application documentation
- CI/CD - Continuous integration and deployment
Tech Stack
| Component | Technology | Purpose |
|---|---|---|
| Driver | Rust (WDK + windows-sys) | Ring 0 WFP kernel driver for packet interception |
| Agent | Rust (tokio + tonic) | Ring 3 flow tracking, pre-filtering, gRPC streaming to server |
| Server | Rust (Axum + Tonic) | gRPC ingestion, DPI, signatures, behavioral analysis, correlation |
| Analysis library | Rust (exfil-analysis) | Shared analysis crate: DPI, signatures, behavioral, correlation |
| Installer | Rust | Windows service + driver installer |
| Certificates | Rust (rcgen + rustls) | mTLS certificate generation for agent-server auth |
| Desktop app | Electron + Next.js 16 | GUI dashboard |
| UI components | coss ui (Base UI + Tailwind v4) | Design system |
| Documentation | Fumadocs | This site |
| Package manager | Bun | Frontend tooling |
| Linter (frontend) | Biome | Linting and formatting |
Project Status
The project is in active development. The analysis crate is functional with 18 passing tests. The driver, agent, and server are under active construction. mTLS authentication between agent and server is scaffolded but not yet operational.