v0.4.0

The machine can now be compared with itself, protection runs whether or not the window is open, and a round of adversarial review closed several ways an ordinary user could have borrowed the agent's LocalSystem rights.

What is new since v0.3.0

Changes: what is different since last time. Every other view reports what is true now. This one reports what is different — services, Run keys, Startup items, scheduled tasks and local administrators, compared against a baseline and charted over twelve weeks. There is no score, because a score needs an idea of what a correct machine looks like and this software does not have one. Things disappearing count at least as much as things appearing: an antivirus service or a backup task quietly removed gets reported, and Windows reports that nowhere else. It also notices when an entry's path stays the same but the file behind it is now signed by someone else, or by nobody. Changes this program made itself are labelled rather than hidden, so malware can't hide by using its name. A source that could not be read is named as unread, never reported as empty.

Protection is always on, with one switch. The agent restarts itself 5, 15 and 60 seconds after a crash, which it never managed before: the restart settings were silently failing to apply. Overview → Protection turns the watching off within seconds without stopping the service, because a security tool that can be silenced through its own window is one an attacker silences.

Scanner. Quick and full Defender scans start from here. Defender is told to report rather than remove, so what it finds stays put and is dealt with through the fenced, audited quarantine. Findings are read from Defender's own records, not from its console output, and a scan that was stopped never shows as a clean result. The on/off protections beside Attack Surface Reduction are now read and explained. Anything off can be switched on, audit mode first, and the result is read back from Defender instead of assumed. The rules are shown as a grid.

Firewall. Connections are grouped by program, with what each program says it is shown separately from who actually signed it. A map shows publishers by area and drills into their programs. Each program lists what is worth noticing instead of a risk score. A signed program listening on all interfaces is no longer drawn as "staying on this machine".

Cleanup. Removal goes to the Recycle Bin or to quarantine; the one-step permanent delete is gone. Where the Recycle Bin cannot work, the row says so instead of offering a button that fails. You can pick which duplicate copy to keep. Everything measured is drawn to scale in one map. Clearing a cache that costs something, such as Windows.old, now says what it costs and asks first.

Starts on a clean Windows install. kam-agent.exe needed the Visual C++ Redistributable, and on a machine without it the service simply would not start. The C runtime is now built into the binary, and a test fails if that dependency comes back. setup.ps1 registers the service, locks down the install folder and puts a shortcut on the desktop. -Remove undoes it.

Security fixes

Found by adversarial review and each fixed with a regression test. Every test was checked by disabling its guard and watching it fail.

• Deleting through a junction. A user could replace a cache folder with a junction, and the next Clear would permanently delete whatever it pointed at, as LocalSystem. The folder is now opened once and held open for the whole walk, so the swap fails instead of racing.
• Quarantine ids reached outside the store. An absolute path or .. in an id could delete directories anywhere, and restoring could write a file to any path as LocalSystem. Ids are now checked against the exact format the store issues.
• powershell.exe resolved from the agent's folder. A planted copy beside the agent would have run as LocalSystem at the next click on the hardening panel. It is now named by absolute path.
• A writable install folder. Unzipping into Downloads or the Desktop leaves the folder writable by any user, who could then drive the service or replace the agent. Installation now refuses such a folder, and setup.ps1 locks it down.
• The audit log's directory was writable. A planted SQLite write-ahead log could rewrite the append-only audit log underneath the triggers that protect it. The agent now locks the directory before opening the database, at every start.
• Named-pipe squatting. The protection against another process squatting the pipe name switched itself off after its first failure. A newline in a refused path could forge a line in the audit log. And one panic could disable auditing until reboot. All three are fixed.
• Paths judged by their spelling. The removal checks looked at the path text instead of what it pointed to, so ::$INDEX_ALLOCATION, 8.3 short names and plain prefix matches all got past them. Paths are now resolved before they are judged.

Also fixed

• The agent reported itself as the most suspicious program on the machine, and drew itself red on the firewall map. It is now identified as this program, still described as unsigned, and never exempted from anything.
• The agent tripped its own canaries every two minutes when checking that its decoys were intact.
• Two quarantined items could end up sharing one id, and a restore could then put a file back in the wrong place.

Registry canaries are switched off again

v0.3.0 introduced decoy PuTTY, WinSCP and Remote Desktop sessions. They reported themselves as planted and watched while reg.exe, Test-Path and .NET could not see them, and a decoy nothing can find is never read. They sit behind a flag until the cause is confirmed under the service account. File canaries are unaffected and verified working.

Install

Unzip anywhere, keeping every file in one folder — the agent only serves clients installed alongside it, so separating them stops the shell working. Then right-click setup.ps1 and choose Run with PowerShell, or from a terminal:

powershell -ExecutionPolicy Bypass -File setup.ps1

It asks for administrator rights once, registers the service that makes the fast disk scan possible, and puts a shortcut on your desktop. It adds nothing to the run keys and does not open the window at logon.

To remove all of it:

powershell -ExecutionPolicy Bypass -File setup.ps1 -Remove

Upgrading from an earlier version: replace both executables together. The protocol version has changed, and the window refuses to talk to an agent of a different version.

These binaries are not signed

SmartScreen will warn on first run, and some antivirus products may flag them. That is expected for an unsigned tool that enumerates every file on disk and runs an elevated service. Verify the checksum against SHA256SUMS.txt, and build from source if you would rather not trust a download.