CookieGuard v1.3.2

CookieGuard v1.3.2

Fix

Your log showed only the browser reading its own files. That was a false-positive
bug: a weak hint (browser_launched_by_untrusted_parent) downgraded a signed
browser in its expected layout from expected to review, so normal
self-access was shown.

Now:

• expected (signed browser, expected layout) is decided by the browser's own
  identity; weak review hints no longer downgrade it. Only a high signal
  overrides it.
• Normal browser self-access is hidden by default again. Use --include-browsers
  to see it on purpose.
• Event output now includes LEVEL= and PARENT= for triage.

Why a real stealer may still be missed

Handle sampling only sees a file handle that is open at the scan instant. A
stealer that opens, reads, and closes in a few milliseconds can fall between two
scans. Lower --interval (e.g. 250ms) and make the process hold the file
open longer. True read-time coverage needs an access-audit (SACL + Security event
4663) or a minifilter design - not implemented yet; that is the next step.

Assets

cookieguard.exe, cookieguard-tray.exe, simulate.exe, fakecookies.exe, SHA256SUMS.txt

Verify the fix yourself

# only browser self-reads -> you should now see almost nothing by default
.\cookieguard.exe run --lang en --interval 500ms
# our benign simulator -> should appear as LEVEL=review
.\fakecookies.exe -profile $env:USERPROFILE
.\simulate.exe --profile $env:USERPROFILE --yes
# high severity demo
.\simulate.exe --remote-debugging-port 9222 --hold 20s --yes

Türkçe

Tarayıcının kendi dosyalarını okuması normaldir ve artık varsayılan olarak
gizlenir. Zayıf ebeveyn ipucu beklenen tarayıcıyı review'a düşürmez. Gerçek
bir stealer çok hızlı aç-oku-kapat yaparsa taramalar arasında kaçabilir; aralığı
düşürün. Gerçek okuma-anı kapsaması için erişim denetimi veya minifilter gerekir.