Sentinel Security System (sentinel)

"A clean-room, zero-telemetry, freestanding C++23 endpoint security & antimalware suite."
An open-source, sovereign implementation of the Windows Security Center (WSC), Antimalware Scan Interface (AMSI), Exploit Guard, and Credential Guard architecture.

---

1. What is Sentinel?

Modern endpoint security systems are notoriously heavy, proprietary, and bound to cloud telemetry daemons. Sentinel is an open-source, clean-room endpoint security and threat mitigation suite engineered in modern ISO C++23 with zero external dependencies and zero telemetry tracking.

It provides a unified security architecture encompassing:

1. SentinelCenter (wscapi.dll / wscsvc): Windows Security Center aggregation broker managing Antivirus, Firewall, and UAC provider states.
2. SentinelScan (amsi.dll): Antimalware Scan Interface providing in-memory buffer inspection, script scanning, and EICAR signature recognition.
3. AegisDefender (mpclient.dll): Real-time malware protection engine, threat catalog, and quarantine facility.
4. SentinelGuard (mitlib.dll): Exploit Guard process mitigation policies (DEP, ASLR, Control Flow Guard, Arbitrary Code Guard, SEHOP, ChildProcessPolicy).
5. SentinelCredGuard (lsasrv.dll): Credential Guard and Isolated User Mode (IUM) memory enclave shielding against Pass-the-Hash attacks.

---

2. Key Architecture & Pillars

+--------------------------------------------------------------------------+
|                     SENTINEL UNIFIED SECURITY BROKER                     |
+--------------------------------------------------------------------------+
  |                   |                   |                   |
  v                   v                   v                   v
+-------------------+ +-----------------+ +-----------------+ +------------+
| SentinelCenter    | | SentinelScan    | | SentinelGuard   | | CredGuard  |
| (wscapi.dll)      | | (amsi.dll)      | | (mitlib.dll)    | | (lsasrv)   |
| Endpoint Registry | | In-Memory AMSI  | | Exploit Guard   | | IUM / VSM  |
| Health Aggregator | | Threat Hunting  | | DEP/ASLR/CFG/ACG| | LSASS Shield|
+-------------------+ +-----------------+ +-----------------+ +------------+

1. Zero-Telemetry Endpoint Defense

All cloud telemetry beacons, diagnostic pingbacks, and user tracking routines are completely omitted by design. Sentinel operates entirely locally.

2. High-Performance In-Memory AMSI Inspection

Provides standard Win32 C ABI entry points (AmsiInitialize, AmsiOpenSession, AmsiScanBuffer, AmsiScanString, AmsiCloseSession, AmsiUninitialize). Intercepts malicious scripts, obfuscated payloads, and memory injection techniques before execution.

3. Exploit Guard Process Mitigations

Enforces modern process security policies:

• DEP: Data Execution Prevention.
• ASLR: Mandatory High-Entropy Address Space Layout Randomization.
• CFG: Control Flow Guard validation.
• ACG: Arbitrary Code Guard (disallows dynamic W^X code generation).
• ChildProcessPolicy: Blocks untrusted child process spawning.
• SEHOP: Structured Exception Handling Overwrite Protection.

4. Credential Guard IUM Enclave

Simulates Virtual Secure Mode (VSM) and Isolated User Mode (IUM) trustlets, preventing raw memory scraping or minidump extraction of authentication secrets from LSASS.

---

3. Quickstart

Include Header in Any C++23 Project

#include <sentinel.hpp>
#include <iostream>

using namespace sentinel;

int main() {
    // 1. Scan in-memory script buffer
    std::string script = "function Test { return 'Safe'; }";
    ThreatDetection detection;
    AmsiResult result = SentinelScanEngine::get().scanString(script, "sample.ps1", &detection);

    if (AmsiResultIsMalware(result)) {
        std::cerr << "Malware blocked: " << detection.threatName << "\n";
    } else {
        std::cout << "Payload verified clean!\n";
    }

    // 2. Query Security Center health
    std::cout << SentinelCenterManager::get().getHealthSummary() << "\n";
    return 0;
}

---

4. Command-Line Interface (sentinel)

usage: sentinel [<command>] [<options>]

The following commands are available:
  status      Display aggregated system security posture and provider states
  health      Query health state for security providers
  products    List all registered endpoint security products in SentinelCenter
  scan        Perform real-time AMSI / AegisDefender scan on file or string
  guard       Inspect or configure Exploit Guard process mitigation policies
  credguard   Query Credential Guard IUM enclave and attack resistance
  test        Execute comprehensive Sentinel Security System diagnostic tests

Examples

# Check complete security posture
sentinel status

# Scan a script or binary file for malware / exploit signatures
sentinel scan ./payload.ps1

# List registered endpoint protection providers
sentinel products

# View active Exploit Guard mitigations
sentinel guard status

# Test Credential Guard memory shielding
sentinel credguard dump-test

# Run full diagnostic verification suite
sentinel test

---

5. Building & Testing

Requires standard CMake (3.25+) and any modern C++23 compiler (MSVC 19.38+, Clang 17+, or GCC 13+):

# Clone
git clone https://github.com/MicaNT-Kernel/sentinel.git
cd sentinel

# Configure
cmake -B build -DCMAKE_BUILD_TYPE=Release

# Build CLI and tests
cmake --build build --config Release

# Run tests
ctest --test-dir build -C Release --output-on-failure

---

6. License & Legal Notice

Licensed under the MIT License.

Windows, Windows Security Center, AMSI, Windows Defender, Exploit Guard, and Credential Guard are trademarks of Microsoft Corporation. This project is an independent clean-room implementation authored from first principles solely for interoperability and endpoint protection (Google LLC v. Oracle America, Inc.).