ExfilGuardian
Getting Started

Installation

Install prerequisites and build ExfilGuardian

Prerequisites

ExfilGuardian is a cross-platform anti-exfiltration detection system (Windows first, Linux planned). Different components have different platform requirements:

ToolMinimum VersionPurposePlatform
Bun>= 1.3JavaScript runtime and package managerAll (desktop/docs)
Rust (stable)Latest stableWorkspace compilation (agent, server, analysis, installer, certs)All
Rust (nightly)Latest nightlyDriver compilation (requires unstable features)Windows only
Windows Driver Kit (WDK)LatestKernel driver build headers and librariesWindows only
Visual Studio Build Tools2022+MSVC linker and Windows SDKWindows only

Note: The analysis crate (exfil-analysis) compiles on all platforms (macOS, Linux, Windows). The agent, installer, and driver require Windows.

Install Commands

Windows (Full Build)

# Install Bun
powershell -c "irm bun.sh/install.ps1 | iex"

# Install Rust (stable + nightly)
winget install Rustlang.Rustup
rustup toolchain install nightly

# Install Visual Studio Build Tools (includes Windows SDK)
winget install Microsoft.VisualStudio.2022.BuildTools

# Install Windows Driver Kit (WDK)
# Download from https://learn.microsoft.com/en-us/windows-hardware/drivers/download-the-wdk

macOS / Linux (Analysis + Docs Development)

# Install Bun
curl -fsSL https://bun.sh/install | bash

# Install Rust
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh

These platforms can build the analysis crate, run the docs site, and develop the desktop frontend, but cannot build the Windows driver, agent, or installer.

Clone and Build

# Clone the repository
git clone git@github.com:Wany917/exfil-guardian.git
cd exfil-guardian

# Install frontend dependencies
bun install

# Build the full Rust workspace (Windows only for agent/installer)
cargo build --workspace

# Or build just the analysis crate (cross-platform)
cargo build -p exfil-analysis

Verify Installation

# Check versions
bun --version
cargo --version
rustup show

# Run analysis tests (cross-platform, 18 tests)
cargo test --workspace

On this page