Processing pipeline
- ObserveFile changes, on-demand scans or ETW sessions.
- AssessSHA-256, threat indicators, Defender and AMSI where applicable.
- RespondLog, alert or quarantine according to the selected configuration.
- VerifyReview the evidence and restore items when appropriate.
What it adds to Windows protection
Microsoft Defender already provides scanning and real-time protection. KK-SECURE works alongside it and adds scoped folder monitoring and evidence you can revisit when investigating an incident.
Version 1.6.0 groups status, scanning, updates, protection, tools and support. The dashboard reads the background worker heartbeat and shows when attention is needed.
Pro inspects PE and ZIP files without executing them. Enterprise adds minidumps, CEF export and application policy review in Audit mode. These are investigation capabilities, not a claim of higher detection rates.
Detection and response
Background protection runs under the Windows user account. When enabled, Task Scheduler starts it at sign-in. ReadDirectoryChangesW observes selected directories and a queue coalesces changes before files are read and evaluated. Defender uses the available Windows engine; supported AMSI submissions go to the provider registered on that machine.
The quarantine vault uses Windows DPAPI, checks the file digest and supports controlled recovery. Ransomware alerts use clusters of unusual file changes. Review these signals in context: legitimate synchronization and backup activity can also cause bursts.
Investigation and privilege
Pro and Enterprise add static PE/ZIP analysis and on-demand kernel ETW for process, thread and image-load activity. Enterprise adds event correlation and CEF export, a selected-process minidump and explicit confirmation for process termination.
Enterprise can deploy a WDAC Audit policy on supported, authorized Windows systems. Audit records events for policy review. The file monitor runs in user mode and reacts after notifications; the current release has no dedicated minifilter driver.
Licensing and updates
The client checks the signed license against its installation profile. The update client verifies signatures, versions and SHA-256 before staging an application package. Defender intelligence comes from Microsoft; CISA KEV lists known exploited vulnerabilities. The separate commercial IOC feed has not been verified with live upstream data.
Editions
| Edition | Capabilities | Operating conditions |
|---|---|---|
| Standard 1.6.0 | File scans, Defender, background monitoring and quarantine. | Select the folders to monitor; Defender depends on the Windows configuration. |
| Pro 1.6.0 | Adds static PE/ZIP analysis, scheduled scanning and process diagnostics. | Kernel ETW requires appropriate Windows support and privileges. |
| Enterprise 1.6.0 | Adds event correlation, CEF, minidumps and WDAC Audit. | Pilot Audit mode before broad deployment. |
Verification protocol
- Safe detection fixture
Use EICAR and clean controls in a virtual machine. Exercise alerting, quarantine and recovery.
- Background workload
Record event latency, queue depth, CPU and memory over progressively larger file workloads.
- ETW and WDAC
Record the Windows build, dropped event or buffer counts, compile output and Audit events. Audit events alone do not prove blocking.
Evidence and limits
The release has tests for scanning, quarantine, background monitoring, updates and licensing. The 1.5.3 verification record reports administrator ETW capture and WDAC Audit preview compilation. Applying and removing WDAC Audit on a designated pilot machine still needs confirmation. No comparative detection rate has been published.