A behavioral antivirus & EDR for Windows 11 that catches what malware does — so zero-day threats with no signature still get caught and killed.
Seven behavioral sentinels watch processes, the network, files, the registry and DNS — and act the moment something turns hostile.
Catches techniques, not hashes. Novel and zero-day malware with no known signature still trips the sentinels.
Suspends or kills the culprit, deletes persistence, and freezes ransomware mid-encryption — automatically.
Every finding maps to a MITRE technique and carries a CVSS score — ready for triage and reporting.
Event-driven sentinels sleep until something fires. You will not hear the fans or feel the lag.
Killed files go to a locked vault. The engine restarts itself if an attacker tries to shut it down.
Throttles while a full-screen game runs, then snaps back to full protection the second you exit.
A selection of the techniques FlewHaul detects, each tested with real tooling — not a generic feature list.
| Technique | ATT&CK ID | Severity |
|---|---|---|
| Reverse shell / C2 | T1059 | CVSS 9.0 |
| Ransomware encryption | T1486 | CVSS 9.4 |
| LSASS credential dump | T1003.001 | CVSS 9.1 |
| Shadow-copy deletion (recovery inhibition) | T1490 | CVSS 8.6 |
| Disable Defender / UAC via registry | T1562.001 | CVSS 8.4 |
| Process injection (RWX / hollowing) | T1055 | CVSS 8.4 |
| UAC bypass | T1548.002 | CVSS 8.2 |
| PsExec / WMI lateral movement | T1021 · T1047 | CVSS 8.0 |
| Rundll32 / Regsvr32 proxy execution | T1218 | CVSS 7.7 |
| Tunnels & RATs (ngrok, cloudflared…) | T1572 | CVSS 7.5 |
| Run-key / scheduled-task persistence | T1547 · T1053 | CVSS 7.2 |
| Event-log clearing (anti-forensics) | T1070.001 | CVSS 6.5 |
A security tool should never become the hole in your defenses. The FlewHaul agent never opens a listening port and never sends your data anywhere — so it cannot be reached, hijacked, or turned against you.
Free. Windows 11. Installs in seconds and runs alongside Defender.
One-click setup with Start-menu and desktop shortcuts. Starts protecting at boot.
Download InstallerA self-contained folder — unzip and run. Ideal for a USB stick or a locked-down PC.
Download PortableNeeds Administrator on first run for full real-time detection. Unsigned build — accept SmartScreen to continue.