01The premise

The starting point

Detector is designed for initial defensive triage on Windows. It profiles PE and managed .NET artifacts, examines C# and PowerShell, and records the results in a stable case model. Related rules become readable capabilities with confidence, sources and supporting evidence.

One boundary applies from the start: Detector does not launch the selected file. Runtime behavior must be imported from an isolated environment or come from optional read-only sensors observing activity already occurring on the local Windows host.

02Inside the system

Static and observed evidence in one case

01

PE and .NET

Hashes, type, signature state, sections, imports, assembly, target framework and P/Invoke are read without loading the assembly.

STATIC / METADATA
02

C# and PowerShell

Explicit rules cover process access, memory manipulation, dynamic loading, persistence, credentials and download-and-run chains.

LEXICAL RULES
03

Indicators and capabilities

URLs, domains, IP addresses, commands, registry and file paths remain as evidence and are correlated transparently.

EVIDENCE / CONFIDENCE
04

Imported runtime evidence

Normalized JSONL and common Sysmon events produce a UTC timeline without executing the sample on the analyst host.

JSONL / SYSMON
05

Optional local sensors

AMSI, read-only process memory, and ETW or polling observe activity already occurring on the host.

AMSI / ETW / MEMORY
06

Coverage

Missing providers, permissions, event losses and unreadable processes remain visible gaps.

COMPLETE / PARTIAL

03Concrete workflow

A practical workflow

An unknown artifact and its Sysmon events are placed in an isolated analysis folder. Detector builds a case. Findings and correlated capabilities are reviewed first; the timeline then shows which static leads were observed. Coverage gets the final review: what ran, what was unavailable and where data is missing.

CLI / LOCAL
detector analyze .\triage --report-json .\case.json --report-html .\case.html
detector import-trace .\events.jsonl --report-json .\runtime-case.json

From input to evidence

01

Collect

Static artifacts and imported events enter the same case.

02

Separate

Findings, indicators, timeline and coverage remain distinguishable.

03

Correlate

Related rules become capabilities with sources and confidence.

04

Review

JSON and HTML support analysis and technical handoff.

Design boundaries

What the tool does not replace

  • Does not execute unknown samples and replaces neither EDR nor incident response
  • Not antivirus, a disassembler or a detonation service
  • Cannot certify completeness or absence of malware
  • Short-lived processes, protected targets and incomplete logs remain blind spots
  • An API name proves neither reachability nor malicious intent

05RC facts

Detector · RC facts

Release candidate
2.0.0-rc.1
Analyzes
PE, .NET, C# and PowerShell
Runtime evidence
normalized JSONL and Sysmon events
Optional local signals
AMSI, read-only process memory, ETW/polling
Case views
Assessment, Findings, Capabilities, Indicators, Artifacts, Timeline, Coverage
Quality assurance
141 automated tests in the RC state
Safety boundary
no execution of selected samples
The tool is strongest where it keeps uncertainty and missing coverage visible.

Public source on GitHubOpen release candidate