4 projects
manifest-trace
Android manifest exposure scanner: finds exported components, allowBackup, debuggable and cleartext issues across a batch of APKs
runtime-trace
Runtime cross-layer consistency checker for Linux: eBPF-powered process/module hiding and fileless-execution detection for DFIR and blue teams
phantom-trace-ntfs
Read-only NTFS cross-layer consistency checker for DFIR: finds where the MFT, bitmaps and run lists disagree
hayabusa-lens
Find what happened in Windows event logs: a dashboard for Hayabusa and Chainsaw, a 3D attack map, and an AI investigator that keeps an audit trail of every question it asks
