01
Every process, with its story
Who started it, where it really runs from, and who signed it — Windows catalogue signatures and Store packages included — plus what it holds open.
Mini MDR for Windows
Task manager on steroids.
Every process, who signed it and what it talks to — and a flag the moment one misbehaves. MLPA watches how processes are born, explains the odd ones in plain words, and lets you act in a click.
Windows 10 / 11 · x64 · free for individuals and small businesses
Fig. 01The first screen answers one question: is this PC all right? Anything that needs you comes with a reason in plain words and a button.
01 · Features
A task manager that knows what “weird” looks like.
The list you already know, plus the context you never had.
02
Flags what's out of place
Word launching PowerShell. Encoded commands. A process writing into memory it didn't start. Invisible overlays. Code running with no file behind it.
03
Learns your machine
An anomaly model trained on this PC, and a memory of how long each exact file has been here — so the software you use every day stays quiet.
04
Act in one click
Stop, suspend, trust or block — from the alert or the row. Trusting a signed app covers its future updates; scripts and system tools are never trusted by name.
05
Sees who it talks to
A live map of every connection, grouped by who owns each address, with the ports explained and anything on a blocklist you imported marked.
06
Local by default
Your process data stays on your PC. Reputation checks send a hash, never a file; an AI second opinion is opt-in and shows you the exact text before it goes.
02 · How it works
Watch, score, act.
-
01 · Watch
Watch
Every 1.5 seconds MLPA reads each process — image, signature, handles, windows, connections — and listens to Windows event tracing for the ones that live less than that.
-
02 · Score
Score
Rules score what each process did and what it is, in sentences you can read. Signed, installed or long-familiar software has to actually do something odd to be flagged.
-
03 · Act
Act
Flagged? Stop it, trust it or block it. Automatic action ships off and starts in dry-run, so you can read what it would have done before it does anything.
03 · CLI
Same engine, in your terminal.
Headless scans for scripts, scheduled tasks and CI. The exit code says what it found.
PS> MLPA.exe --cli --top 3 Scanned 214 processes | 211 clean, 2 info, 1 suspicious, 0 malicious Top 3 findings: PID VERDICT SCORE NAME 4312 Suspicious 70 powershell.exe spawned by winword.exe PS> MLPA.exe --cli --quiet --export-json scan.json --fail-on-threat PS> $LASTEXITCODE 10 # 0 clean · 10 suspicious · 20 malicious
04 · Download
Get MLPA
Open source under the GPL-3.0: free for everyone, at home, at school or at work, in a company of any size.