v0.2.1 - False Positive Elimination, Quarantine Reality Check & Extension Localization

🚀 Sentinel v0.2.1 Release Notes

🛡️ False Positive Elimination

• Strict Process & Service Binary Matching: Fixed substring match vulnerabilities in RuleMatcher where short process names ($\le 3$ characters such as \pm.exe, \�k.exe, \svc.exe) matched arbitrary substrings in service binary paths and descriptions.
• Corroboration Enforcement: Stalkerware rules (\lexispy.yml, \�ctual_keylogger.yml, \pctattletale.yml, \ hetruthspy.yml, \wolfeye.yml, \expert_home.yml) now require multiple independent corroborating indicators (\condition: min_matches: 2).
• Pruned Ambiguous Signatures: Removed ambiguous \svc.exe\ from Teramind rule.

🔍 Live System Reality Checks in Quarantine & Removal

• Pre-execution Verification: \sentinel quarantine\ and \sentinel remove\ dry-run mode now actively query the live OS (\sysinfo\ for processes, \winreg\ / systemd for services, and \Path::exists\ for files).
• Accurate Simulation: Never simulates killing non-existent processes or moving non-existent files. If no components exist on disk, Sentinel clearly reports: \No active processes, registered services, or target files exist on your system for this finding (system is clean).\

🌐 Browser Extension i18n Localization

• Automatically resolves _MSG_extName_\ resource keys from _locales\ in Chrome, Edge, and Brave extensions (e.g., properly displaying 'Tampermonkey' instead of raw localization tokens).

📦 Verification

• Checksums available in SHA256SUMS.

Sentinel v0.2.0 — Major Architecture & Detection Capabilities Upgrade

Sentinel v0.2.0 — Major Architecture & Detection Capabilities Upgrade

Sentinel v0.2.0 represents a comprehensive evolution in offensive surveillance detection, deep endpoint forensics, and victim-centric defensive engineering.

---

🌟 What's New in v0.2.0

1. 🌐 Browser Extensions & Web Interception Auditor (BrowserExtensionsCollector)

• Cross-platform inspection of Chrome, Microsoft Edge, Brave, Mozilla Firefox, Opera, and Yandex Browser profiles.
• Parses manifest.json and extensions.json to extract permissions, IDs, and installation sources.
• Flags extensions with elevated interception capabilities (debugger, webRequestBlocking + <all_urls>, nativeMessaging, cookies, clipboardRead).
• Detects covert sideloaded extensions and stalkerware web sniffers.

2. 🔴 Real-Time Active Camera & Microphone Interception Alerts

• Correlates Windows CapabilityAccessManager\ConsentStore metadata (LastUsedTimeStop == 0).
• Alerts with Critical severity when an unauthorized background process is actively capturing live audio or video streams in the exact second of the scan.
• Suppresses false positives for recognized video conferencing applications (Zoom, Teams, Discord, OBS, WebEx, etc.).

3. 📸 Differential System Audits & Baseline Snapshots (sentinel snapshot)

• sentinel snapshot save baseline.json: Captures a signed, comprehensive baseline fingerprint of the system (active processes, services, autostart ASEP entries, listening ports, browser extensions, root certificates).
• sentinel snapshot diff baseline.json: Audits the live system against the baseline snapshot and outputs an exact delta (added processes, new services, modified autostart, newly opened ports, added extensions, or removed security tools).

4. ⏱️ Automated Recurring Surveillance Audits (sentinel schedule)

• sentinel schedule install [--daily | --hourly | --on-logon]: Native registration into Windows Task Scheduler, Linux systemd user timers, or macOS LaunchAgents without manual scripting.
• sentinel schedule status: Queries live status, execution schedule, and last run result.
• sentinel schedule remove: Cleanly unregisters and deletes the background audit task.

5. 📱 Connected Mobile Device Bridge (sentinel mobile scan)

• Non-root forensic audit of connected Android smartphones via USB ADB (adb shell pm list packages -u).
• Correlates installed package names against known commercial mobile stalkerware indicators (mSpy, Cerberus, Snoopza, KidsGuard, ClevGuard, Hoverwatch, Trackview, SpyHuman, FlexiSPY, Cocospy, etc.).
• Inspects active Accessibility Services and Device Administrators to detect stealth screen/keystroke capture on mobile devices.

6. 🔒 Password-Protected Report Encryption (sentinel decrypt & --encrypt-report)

• sentinel scan --encrypt-report [--password <PWD>]: Generates a self-contained encrypted audit report container (.html.enc) and removes plaintext artifacts from disk.
• sentinel decrypt <path.enc>: Restores and decrypts report files on demand with AES-256-like stream encryption and PBKDF key derivation.

7. 🛡️ MITRE ATT&CK Matrix Mapping & Untrusted Root CA Interception

• Every finding is correlated to exact MITRE ATT&CK techniques (T1056.001 Keylogging, T1113 Screen Capture, T1125 Video Capture, T1123 Audio Capture, T1021.001 Remote Desktop, T1547.001 Autostart, T1557.001 SSL MITM Interception, T1546.003 WMI Persistence, T1185 Browser Session Hijacking).
• Deep audit of the Windows ROOT certificate store for known SSL interception CAs (mitmproxy, Fiddler, Charles, SearchInform, InfoWatch, Proxyman, Burp Suite).

---

📦 Release Checksums (SHA-256)

14e23064074cc4e69ac48ad44233d4b5972c757d0d3872eca072c8b325f65efc  sentinel-x86_64-pc-windows-msvc.zip
14e23064074cc4e69ac48ad44233d4b5972c757d0d3872eca072c8b325f65efc  sentinel-windows-x86_64.zip

Sentinel v0.1.4 — 137 Rules Detection Suite & Purge Engine

Sentinel v0.1.4 — Expanded Detection Catalog & Clean Purge

🛡️ Expanded Detection Catalog (137 Built-in Signatures)

• Enterprise DLP & Insider Monitoring: SearchInform (RiskMonitor), InfoWatch Traffic Monitor, Rostelecom Solar Dozor, FalconGaze SecureTower, LanAgent, Stakhanovets (Стахановец), Bitcop, CrocoTime, CurrentWare BrowseControl.
• Remote Access & RMM: UltraViewer, Supremo Remote Desktop, Getscreen.me, LiteManager, RMS (Rutserv), Goverlan Reach, BeyondTrust (Bomgar), Zoho Assist, Dameware Mini Remote Control, Remotely.
• Covert Stalkerware & Keyloggers: Mipko Personal & Employee Monitor, IzyMonitor, Spyera Desktop Tracker, Snoopza Computer Monitor, ClevGuard / KidsGuard, NetBull Stealth Keylogger, KGB Keylogger & Spy.
• Cloud Telemetry & Infrastructure Monitoring: Grafana Agent / Alloy, OpenTelemetry Collector, VictoriaMetrics vmagent, Fluent Bit, Paessler PRTG Network Monitor Probe, Dynatrace OneAgent, New Relic Infrastructure Agent, SolarWinds Orion Agent.

🧹 Complete Trace Purge & Uninstallation

• sentinel purge --reports-only -y: Deletes all forensic report artifacts (.html, .json, .ndjson) to eliminate audit trails.
• sentinel purge -y: Completely uninstalls Sentinel, purges quarantine vaults (~/.sentinel), and removes binaries.
• One-liner uninstallers:
  • Windows: irm https://raw.githubusercontent.com/jamixm4-crypto/sentinel/main/uninstall.ps1 | iex
  • Linux / macOS: curl -fsSL https://raw.githubusercontent.com/jamixm4-crypto/sentinel/main/uninstall.sh | bash

🔒 Enhanced Privacy & Safety

• Removed emergency 1-800 hotline references and banners from HTML reports and documentation.
• 100% offline verification with zero network telemetry during audits.

📦 SHA-256 Checksums

b5555eeb7266a81141446f87fff079749a4688dda2b20cd76e48ff7ec00637ad  sentinel-x86_64-pc-windows-msvc.zip
b5555eeb7266a81141446f87fff079749a4688dda2b20cd76e48ff7ec00637ad  sentinel-windows-x86_64.zip

Sentinel v0.1.3 — Windows Services Collector & IT Telemetry Suite (Zabbix, Wazuh, Prometheus)

🛡️ Sentinel v0.1.3 Release Notes

🔍 Major Additions & Capabilities

1. Windows Services Collector (\HKLM\SYSTEM\CurrentControlSet\Services):

   • Enumerates all installed Windows Services, extracting service names, display names, normalized binary image paths (\ImagePath), and startup types.
   • Normalizes quoted paths and command-line parameters to isolate executable targets.
   • Emits strongly-typed \EvidenceData::Service\ for multi-modal correlation.

2. Expanded Network Socket Inspection:

   • Inspects telemetry, observability, and remote management ports: \10050\ (Zabbix Agent), \10051\ (Zabbix Trapper), \9100\ / \9182\ (Prometheus), \5666\ / \5693\ (Nagios/NCPA), \6556\ (Checkmk), \19999\ (Netdata), \8089\ (Splunk), \5001\ (Datadog), \1514\ / \1515\ (Wazuh), \21115..21117\ (RustDesk).
   • Bidirectional inspection matching both local listening ports and active outbound remote connections.

3. Multi-Modal Rule Matcher Hardening:

   • Enhanced cross-platform process name matching with case-insensitive .exe\ trimming.
   • Correlates Windows service binary paths directly against rule process and file path definitions.
   • Correlates service display names against rule service definitions.

4. 103 Built-In Signatures (28 New Declarative Rules):

   • IT Monitoring & Observability Agents: Zabbix Agent & Agent 2, Prometheus Node & Windows Exporter, Datadog Infrastructure Agent, Wazuh Security Agent, Osquery Endpoint Telemetry Agent, Elastic Agent & Beats, Splunk Universal Forwarder, InfluxData Telegraf, Netdata Real-Time Monitor, Nagios NCPA & NSClient++, Checkmk Agent, SysAid ITSM Agent, ManageEngine Endpoint Central, Tanium Endpoint Client.
   • Remote Access & RMM: MeshCentral, NinjaOne (NinjaRMM), Atera RMM, Kaseya VSA, Action1 Cloud RMM, AnyViewer Remote Desktop.
   • Commercial Stalkerware & Keyloggers: NeoSpy, Expert Home / SpyGo, Ardamax Keylogger, All In One Keylogger, Perfect Keylogger, Revealer Keylogger, Realtime-Spy, Shadow Keylogger.

📦 Checksums (SHA-256)

\
71de6b793ee26edbc7712e0d9fd5cabbdaefc2d135b2e7da78820c19d0ec2179 sentinel-x86_64-pc-windows-msvc.zip
71de6b793ee26edbc7712e0d9fd5cabbdaefc2d135b2e7da78820c19d0ec2179 sentinel-windows-x86_64.zip
\\

Sentinel v0.1.2 — Security Hardening, In-Memory Safety Mode & Forensic Inspection

What's New in v0.1.2:

• 🛡️ Hardened Personal Safety Mode (--personal-safety-mode):
  • In-memory audit execution with zero report files written to local disk (preventing monitors from discovering report files).
  • Web browser auto-launch suppressed to prevent leaving history or cache traces.
  • Strict lockdown on all modifying commands (remove and quarantine are strictly blocked).
  • Explicit warning notice regarding local forensic traces (Prefetch, BAM, command history) and domestic violence hotline links.
• ⚡ Safe Remediation (Dry-Run by Default):
  • Both 'sentinel quarantine' and 'sentinel remove' run in dry-run simulation by default, requiring '--execute' to apply changes.
• 📊 Enterprise SIEM Integration & Formats (--format ecs | ndjson):
  • Supports Elastic Common Schema (ECS v8.11) with MITRE ATT&CK mappings (tactics and techniques) for Elasticsearch, Logstash, Kibana, Splunk, and Wazuh.
  • NDJSON streaming to stdout for clean shell pipelines.
• 🔎 Rich Incident Triage Guidance ('sentinel explain'):
  • Detailed threat profiles with MITRE ATT&CK technique mapping, attacker TTPs, and step-by-step incident response advice.
  • C2 beaconing threat analysis cross-referenced against 280+ stalkerware C2 domains.
• 🔄 Offline Rule & C2 Feed Updates ('sentinel rules update --from '):
  • Offline import of external YAML rule directories and custom C2 domain feeds (~/.sentinel/c2_domains.txt) without telemetry or internet access.
• ⚙️ Quiet & Verbose Operational Flags (-q, --quiet / -v, --verbose):
  • Interactive progress spinner via 'indicatif'.
  • Silent/quiet execution mode for automation and CI/CD.
  • Detailed diagnostics showing collector execution metrics, timing, and privilege constraints.
• 📁 Forensic Disk Inspection Mode (--scan-path ):
  • Allows forensic analysts to inspect mounted disk images or directories offline without querying live host OS processes.
• 🏗️ Architecture & Modular Crates:
  • Dedicated root ARCHITECTURE.md with sequence diagrams and crate breakdowns.
  • Multi-crate workspace architecture ready for crates.io publication.
  • CI security tooling: cargo fmt, clippy -D warnings, cargo audit, cargo deny.

Sentinel v0.1.1 — Deep Threat Intelligence & C2 Engine

Release v0.1.1: expanded database with 75 rules, real-time Stalkerware C2 matcher (280+ domains), MITRE ATT&CK dashboard, and automated scan on install.

Sentinel v0.1.0

First public release of Sentinel — defensive surveillance software & spyware detector.