Put a witness on every Windows machine.
Aegis watches process, network, credential and script activity and reports it to the Aegis console running on your own network. Setup finds the console by itself. You approve the machine, and it's covered in about half a minute.
You're on a different system. Open this page on the Windows machine you want to protect.
Or in PowerShell on that machine:
irm https://this-site/setup.ps1 | iex
Three steps, one of them yours.
-
1
It finds your console
Setup broadcasts on the local network. If nothing answers, it checks the nearby addresses for an Aegis console.
No address or enrollment code to type.
-
2
You approve it
The machine shows up on the console under Endpoints with its name, user and IP. Click Approve.
Or switch on auto-approve for a lab you trust.
-
3
It installs and reports
The console sends the installer. Each step appears live on the console until the first events arrive.
Usually under 30 seconds on a local network.
Everything it touches, and how it leaves.
| # | Item | Where | Notes |
|---|---|---|---|
| 01 | Agent and private Python runtime | C:\Program Files\Aegis | Self-contained. Doesn't add Python to the system or change PATH. |
| 02 | Sysmon optional | Microsoft-Windows-Sysmon | Process, network and LSASS-access telemetry. Kept as-is if already installed; skipped if another security product blocks it. |
| 03 | Audit and PowerShell logging | auditpol · script block logging | The previous audit policy is backed up first and restored on removal. |
| 04 | Aegis Agent task | Task Scheduler | Runs as SYSTEM at startup, restarts if it stops, updates itself from the console. |
To remove it, use Remove on the host in the console, or run & "C:\Program Files\Aegis\uninstall.ps1".
Sysmon is only uninstalled if Aegis installed it.
23 detections, mapped to ATT&CK.
Credential access 6
T1003.001LSASS memory accessT1003.001LSASS dump via command lineT1003Mimikatz keywords in PowerShellT1110.001Brute-force logon attemptsT1110.003Password sprayT1110Account locked out
Defense evasion 6
T1070.001Security event log clearedT1070.001Event log clearedT1562.001Defender real-time protection disabledT1562.001Defender tampering via command lineT1562.002Audit policy changedT1204Defender detected malware
Execution 4
T1059.001Encoded PowerShell commandT1059.001PowerShell download cradleT1204.002Office or browser spawned a shellT1218LOLBin downloading or running remote code
Persistence & privilege 5
T1136.001Local user account createdT1098User added to privileged groupT1543.003New service installedT1053.005Scheduled task createdT1547.001Registry Run key persistence
Discovery & impact 2
T1082Burst of reconnaissance commandsT1490Shadow copies deleted, recovery disabled
Before you run it.
Windows says it “protected your PC”.
The launcher isn't code-signed yet. Click More info, then Run anyway. You can read the whole script first: it's setup.ps1, about 175 lines.
Where does my data go?
Only to the console you approve on your own network. This site never receives events, and setup talks to nothing else.
Setup can't find the console.
Check the console is running and that both machines are on the same network or VPN. Setup then asks for the address, for example 192.168.1.20:8000.
Why does it ask for administrator rights?
Reading the Security log, installing Sysmon and setting audit policy all need them. Windows asks once, when setup starts.
It's a work laptop with another EDR.
That's fine. If the other product blocks Sysmon, that step is skipped and Aegis carries on with the Security, PowerShell and System logs.
Can someone enroll a machine I don't know about?
Not by default. Every machine waits for an analyst to approve it on the console, unless you turn auto-approve on.