s3cur3th1ssh1t/kassandra

Kassandra is a Windows security tool that watches running programs in real time and flags suspicious behavior. It was created as a learning resource: the original version was published without source code, so the author used an AI assistant to generate readable C code that others could study and analyze. The tool works by tapping into Event Tracing for Windows, a built-in Windows mechanism for recording system activity. Kassandra listens to events about process creation, network connections, memory allocation, and loaded libraries. As it watches, it assigns tags to each process. For example, a program that connects to both public and private network addresses gets a "net_tunnel" tag, suggesting possible network tunneling. A program that loads many security-related DLLs gets a "module_balloon" tag, which could indicate credential harvesting. Other tags cover dynamic code injection, thread pool manipulation, and connections to many Windows service ports at once. Tags combine into severity levels using a two-phase algorithm. A single suspicious tag produces no alert. Two related tags produce an INFO or LOW alert. Four or more tags, or certain escalation patterns, push a process to MEDIUM or HIGH severity. Alerts at LOW or above are printed to the console and written to a log file. When you stop the tool with Ctrl+C, it prints a sorted summary table of every flagged process, ordered from highest risk to lowest. The entire tool is a single C file, about 1,600 lines of code, with no dependencies beyond the Windows SDK. It requires administrator privileges to run because it needs access to kernel-level tracing. You can build it with Visual Studio, MinGW on Windows, or cross-compile from Linux using MinGW, though the resulting executable only runs on Windows. The README also includes an architecture diagram showing how three event streams feed into a process table, where tags are evaluated and alerts are emitted. The README appears to be cut off mid-sentence in the Files section. The full README is longer than what was shown.