Sentinel — Defensive Spyware, Stalkerware & Surveillance Detector

English | 📖 Читать на русском (Russian Version)

Sentinel is an open-source, offline-first defensive security scanner designed to detect covert surveillance software: keyloggers, commercial stalkerware, remote access trojans (RATs), employee monitoring agents, corporate EDR/MDM sensors, and process watchdogs.

Operating strictly read-only by default, Sentinel requires zero telemetry, performs no remote network calls, and leaves minimal forensic trace on audited systems.

As a security application designed for users facing active threats, downloading verified binaries with cryptographic checksum validation is strongly recommended over direct shell pipes.

1. Download the archive for your operating system from GitHub Releases.
2. Verify the SHA-256 checksum against the official SHA256SUMS file:

# Windows (PowerShell)
$hash = (Get-FileHash -Path sentinel-windows-x86_64.zip -Algorithm SHA256).Hash.ToLower()
$expected = (Get-Content SHA256SUMS | Select-String "sentinel-windows-x86_64.zip").Line.Split(" ")[0].ToLower()
if ($hash -eq $expected) { Write-Host "✔ Checksum Verified!" -ForegroundColor Green }

# Linux / macOS
sha256sum -c SHA256SUMS

3. Extract the archive and execute sentinel scan.

Windows (PowerShell):

irm https://raw.githubusercontent.com/jamixm4-crypto/sentinel/main/install.ps1 | iex

Linux & macOS (Bash):

curl -fsSL https://raw.githubusercontent.com/jamixm4-crypto/sentinel/main/install.sh | bash

# 1. Standard scan (interactive spinner + terminal summary + offline HTML report):
sentinel scan

# 2. Quiet mode (minimal terminal output, suppresses spinners and banners):
sentinel scan -q

# 3. Verbose mode (displays collector execution time, evidence count, and privilege warnings):
sentinel scan -v

# 4. Personal Safety Mode (in-memory execution; zero report files saved to disk):
sentinel scan --personal-safety-mode

# 5. Forensic Offline Mode (audit an unmounted disk image or directory):
sentinel scan --scan-path /mnt/target_image

# 6. SIEM & Pipeline Export (streams findings as NDJSON or Elastic Common Schema ECS):
sentinel scan --format ecs
sentinel scan --format ndjson

# 7. Threat intelligence walkthrough & incident response triage guidance:
sentinel explain STK-WIN-0042
sentinel explain stalkerware_c2_network_beacon

# 8. Password-protected report encryption:
sentinel scan --encrypt-report --password "MySecretPass"
sentinel decrypt sentinel-report-20261030_120000.html.enc

# 9. Differential audit & system baseline comparison:
sentinel snapshot save baseline.json
sentinel snapshot diff baseline.json

# 10. Automated recurring surveillance audit schedule:
sentinel schedule install --daily --time 10:00
sentinel schedule status
sentinel schedule remove

# 11. Android smartphone stalkerware audit (via USB ADB):
sentinel mobile scan

# 12. Offline rules & C2 domain feed updates:
sentinel rules update --from /path/to/custom_rules/
sentinel rules update --from /path/to/c2_domains.txt

  🛡️ Sentinel Defensive Audit Summary
  Verdict: SURVEILLANCE LIKELY [1 High-Risk Stalkerware Finding]
  Platform: Windows 11 Pro (x86_64) | Duration: 1.48s | Inspected Processes: 242

  [CRITICAL] Stalkerware C2 Communication (api.flexispy.com)
  • Category: Network Activity & MITM | Confidence: 100% (High)
  • Description: Active socket matched known commercial stalkerware C2 endpoint.
  • Action Policy: SafeAuto (Firewall/hosts block available)
  • Remediation: sentinel quarantine C2-api-flexispy-com --execute

  [HIGH] Spyrix Personal Monitor & Keylogger
  • Category: Keyboard Capture | Confidence: 95% (High)
  • Description: Identified active process 'spx.exe' and persistent service 'spxsvc'.
  • Action Policy: SafeAuto (Automated vault quarantine available)
  • Dry-Run: sentinel quarantine STK-WIN-0042

  HTML report generated: C:\Users\user\sentinel-report-20261005_120000.html

For complete architecture diagrams and sequence charts, see ARCHITECTURE.md.

                                ┌────────────────────────────────┐
                                │       sentinel-cli (CLI)       │
                                └───────────────┬────────────────┘
                                                │
             ┌───────────────────┬─────────────┴───────┬───────────────────┐
             ▼                   ▼                     ▼                   ▼
     ┌──────────────┐    ┌──────────────┐      ┌──────────────┐    ┌──────────────┐
     │  Processes & │    │ Persistence  │      │  Network C2  │    │ Masquerading │
     │  Input Sinks │    │ Registry/ASEP│      │  Inspection  │    │ (T1036.005)  │
     └───────┬──────┘    └───────┬──────┘      └───────┬──────┘    └───────┬──────┘
             │                   │                     │                   │
             └───────────────────┼─────────────────────┴───────────────────┘
                                 ▼
                     ┌───────────────────────┐
                     │ Multi-Modal Correlator│
                     │  (75+ Rules, 280+ C2) │
                     └───────────┬───────────┘
                                 │
                 ┌───────────────┴───────────────┐
                 ▼                               ▼
       ┌───────────────────┐           ┌───────────────────┐
       │   sentinel-report │           │ sentinel-removal  │
       │ HTML/JSON/NDJSON/ │           │ Reversible Vault  │
       │ Elastic ECS v8.11 │           │ (Dry-Run / Undo)  │
       └───────────────────┘           └───────────────────┘

Sentinel is engineered as a collection of modular Rust crates publishable to crates.io:

When running sentinel scan, Sentinel generates a zero-dependency, single-file HTML report:

┌──────────────────────────────────────────────────────────────────────────────┐
│ 🛡️  SENTINEL AUDIT REPORT                     [Verdict: Review Recommended] │
│ Target: Windows 11 x86_64 | 237 Inspected Processes | Scan Duration: 1.67s   │
├──────────────────────────────────────────────────────────────────────────────┤
│ ┌──────────────────────┐  ┌──────────────────────┐  ┌──────────────────────┐ │
│ │ 0 Critical Detected  │  │ 1 Medium (Dual-Use)  │  │ 236 Verified Clean   │ │
│ └──────────────────────┘  └──────────────────────┘  └──────────────────────┘ │
│                                                                              │
│ ▼ [MEDIUM] VNC Server (UltraVNC / TightVNC / RealVNC)   Confidence: 100%     │
│   Category: Remote Access & Control | Removal Policy: ManualReviewRequired   │
│   • What is this: Virtual Network Computing server providing remote desktop  │
│   • Why flagged: Process 'vncserver.exe' listening on TCP port 5900          │
│   • Legitimate use: Very common in enterprise support and homelabs.          │
│   • Remediation: Dry-run available via 'sentinel quarantine <id>'            │
└──────────────────────────────────────────────────────────────────────────────┘

In intimate partner violence or domestic stalking scenarios, modifying or removing spyware can immediately alert the perpetrator via remote disconnection notifications, carrying severe risk of retaliatory confrontation:

• Zero Local Disk Artifacts: No HTML or JSON reports are created on disk; findings are output exclusively to the terminal in memory.
• Browser Suppression: The default web browser is not launched, leaving no browser history, cache, or tabs.
• Modifications Locked: All remove and quarantine commands are strictly blocked.
• Support Resources: Guidance on covert safety planning without alerting attackers:
  • Coalition Against Stalkerware
  • Global Support Directory: Lila.help

All modification operations execute in dry-run mode by default:

# 1. Preview quarantine actions without modifying files:
sentinel quarantine <finding-id>

# 2. Execute quarantine into encrypted vault:
sentinel quarantine <finding-id> --execute

# 3. Restore quarantined item to original state:
sentinel restore <quarantine-id>

# 4. Preview automated removal for all SafeAuto findings:
sentinel remove --all-safe

# 5. Execute permanent removal:
sentinel remove --all-safe --execute

Manage your local allowlist to suppress expected administrative tools:

sentinel allow list
sentinel allow add "my_admin_tool.exe"
sentinel allow remove "my_admin_tool.exe"

Preserve a trusted system baseline before leaving a device unattended or traveling, and verify exact modifications upon return:

# Save trusted system fingerprint (processes, services, autostart, ports, extensions, certs):
sentinel snapshot save baseline.json

# Audit live system against baseline and output modifications:
sentinel snapshot diff baseline.json

Configure low-overhead background audits without writing shell scripts:

# Register automatic daily audit at 09:30 AM (Windows Task Scheduler / systemd user timer):
sentinel schedule install --daily --time 09:30

# Check scheduled status:
sentinel schedule status

# Cleanly deregister and remove the audit task:
sentinel schedule remove

Audit connected Android smartphones for commercial stalkerware, suspicious APK packages, and stealth accessibility service captures without requiring root:

sentinel mobile scan

Protect sensitive forensic audit reports with password-authenticated encryption:

# Generate encrypted report container (plaintext HTML removed immediately):
sentinel scan --encrypt-report --password "SecretPassword123"

# Decrypt and restore the report when needed:
sentinel decrypt sentinel-report-20261030_120000.html.enc

Sentinel leaves minimal trace, and provides simple commands to cleanly wipe the binary, all generated reports, and quarantine vaults:

# Delete all generated reports (sentinel-report-*.html/json) without uninstalling:
sentinel purge --reports-only -y

# Completely wipe Sentinel: delete all reports, remove ~/.sentinel, and clean PATH/binary:
sentinel purge -y

Windows (PowerShell):

irm https://raw.githubusercontent.com/jamixm4-crypto/sentinel/main/uninstall.ps1 | iex

Linux & macOS (Bash):

curl -fsSL https://raw.githubusercontent.com/jamixm4-crypto/sentinel/main/uninstall.sh | bash

1. Mobile Devices (Android & iOS): The majority of modern consumer stalkerware targets mobile smartphones. Sentinel is a desktop workstation scanner. Direct filesystem analysis of smartphones requires specialized physical tools like Amnesty International's MVT (Mobile Verification Toolkit) or TinyCheck. Sentinel includes mobile C2 indicators to audit local workstation network traffic for smartphone sync beacons.
2. Kernel Rootkits (Ring 0): If an attacker has installed custom kernel drivers modifying dispatch tables, user-mode scans cannot guarantee complete visibility. If a rootkit is suspected, run Sentinel from an offline bootable live medium.
3. Hardware Keyloggers: Inline physical hardware keyloggers connected to keyboard cables or USB ports cannot be detected via operating system software APIs. Conduct physical hardware inspections.

All pull requests and release tags undergo rigorous automated quality and supply-chain audits across Windows, Linux, and macOS GitHub Actions runners:

• Formatting Standards: cargo fmt --check ensures consistent code layout.
• Strict Linting: cargo clippy --all-targets --all-features -- -D warnings forbids all compiler and style warnings.
• Vulnerability Auditing: cargo audit verifies zero known CVEs or supply-chain advisories across all Cargo dependencies.
• License & Dependency Health: cargo deny check prevents licensing conflicts and unapproved dependencies.
• 100% Deterministic Offline Testing: Automated suite verifies zero outbound sockets and validates rule precision against synthetic telemetry.

Contributions of new detection rules, threat feeds, or bug fixes are welcome!

• Pull Request Template
• Bug Report Template
• Contributing Guide
• Threat Intelligence Feed Guidelines

• Root Architecture Specification
• Threat Model & Security Scope
• Architecture & Correlation Engine
• Reproducible Builds & Verification
• Removal Policy & Safety Tiers
• YAML Rule Specification
• Code of Conduct
• Security Policy

• Source Code: Apache License 2.0
• Detection Rules: Creative Commons Attribution 4.0 International