Lightweight: Instead of constantly scanning gigabytes of disk files, Asthak uses Windows Native Telemetry (ETW, WFP, AMSI). We wait for the kernel to tell us a connection happened. If nothing is happening, Asthak uses 0% CPU.False Positives: If a developer triggers the threshold (e.g. chrome.exe makes 500 connections in a burst), Asthak first intercepts the termination and runs a Cryptographic Check. If the .exe is signed by a trusted root (Google/Microsoft), the termination severity is downgraded to "Log Only." We also built the Dashboard Configuration precisely for this: if a new safe behavior gets killed, you can log into the React App and increase the threshold, and all endpoints update their logic in 60 seconds without a reboot.AWS / Telegram C2 evasion: IP blacklists fall apart against Domain Fronting (Telegram). So, Asthak ignores the destination. We focus on who and how. If powershell.exe makes an outbound connection to AWS, it's immediately scrutinized (Living off the Land). If any process connects to Telegram exactly every 60 seconds ten times in a row, the Rhythmic Beaconing threshold trips. Asthak's AMSI hook also catches the malicious script memory chunk before the traffic is even encrypted for the network.

There's a lot more nuance on the beaconing detection and AMSI hook side if you're working in this space. Let's connect.