Replace .bigbrother with .implant in all identity strings — avoid tool name exposure on fresh flash

core/state.py

@@ -19,7 +19,7 @@ from pathlib import Path
 logger = logging.getLogger("sensor.state")
 
 _DEFAULT_DB = os.path.join(
-    os.path.expanduser("~"), ".bigbrother", "state.db"
+    os.path.expanduser("~"), ".implant", "state.db"
 )
 
 

modules/active/mitmproxy_mgr.py

@@ -66,7 +66,7 @@ class MitmproxyManager(BaseModule):
         self._mitmdump_binary = config.get("mitmdump_binary", "mitmdump")
         self._flow_log = config.get(
             "flow_log",
-            os.path.join(os.path.expanduser("~"), ".bigbrother", "mitmproxy_flows"),
+            os.path.join(os.path.expanduser("~"), ".implant", "mitmproxy_flows"),
         )
 
     # ------------------------------------------------------------------

modules/active/ntlm_relay.py

@@ -68,10 +68,10 @@ class NTLMRelay(BaseModule):
         self._relays_lock = threading.Lock()
         self._responder_mgr = None
         self._target_file = os.path.join(
-            os.path.expanduser("~"), ".bigbrother", "relay_targets.txt"
+            os.path.expanduser("~"), ".implant", "relay_targets.txt"
         )
         self._loot_dir = os.path.join(
-            os.path.expanduser("~"), ".bigbrother", "ntlmrelay_loot"
+            os.path.expanduser("~"), ".implant", "ntlmrelay_loot"
         )
 
     # ------------------------------------------------------------------

modules/passive/auth_flow_tracker.py

@@ -499,7 +499,7 @@ class AuthFlowTracker(BaseModule):
 
     def _resolve_db_path(self) -> str:
         base = self.config.get("db_dir", os.path.join(
-            os.path.expanduser("~"), ".bigbrother"
+            os.path.expanduser("~"), ".implant"
         ))
         return os.path.join(base, "auth_flow_tracker.db")
 

modules/passive/cloud_token_harvester.py

@@ -277,7 +277,7 @@ class CloudTokenHarvester(BaseModule):
 
     def _resolve_db_path(self) -> str:
         base = self.config.get("db_dir", os.path.join(
-            os.path.expanduser("~"), ".bigbrother"
+            os.path.expanduser("~"), ".implant"
         ))
         return os.path.join(base, "cloud_token_harvester.db")
 

modules/passive/db_interceptor.py

@@ -648,7 +648,7 @@ class DBInterceptor(BaseModule):
 
     def _resolve_db_path(self) -> str:
         base = self.config.get("db_dir", os.path.join(
-            os.path.expanduser("~"), ".bigbrother"
+            os.path.expanduser("~"), ".implant"
         ))
         return os.path.join(base, "db_interceptor.db")
 

modules/passive/ldap_harvester.py

@@ -449,7 +449,7 @@ class LDAPHarvester(BaseModule):
 
     def _resolve_db_path(self) -> str:
         base = self.config.get("db_dir", os.path.join(
-            os.path.expanduser("~"), ".bigbrother"
+            os.path.expanduser("~"), ".implant"
         ))
         return os.path.join(base, "ldap_harvester.db")
 

modules/passive/network_mapper.py

@@ -305,7 +305,7 @@ class NetworkMapper(BaseModule):
 
     def _resolve_db_path(self) -> str:
         base = self.config.get("db_dir", os.path.join(
-            os.path.expanduser("~"), ".bigbrother"
+            os.path.expanduser("~"), ".implant"
         ))
         return os.path.join(base, "network_mapper.db")
 

modules/passive/quic_analyzer.py

@@ -417,7 +417,7 @@ class QUICAnalyzer(BaseModule):
 
     def _resolve_db_path(self) -> str:
         base = self.config.get("db_dir", os.path.join(
-            os.path.expanduser("~"), ".bigbrother"
+            os.path.expanduser("~"), ".implant"
         ))
         return os.path.join(base, "quic_analyzer.db")
 

modules/passive/rdp_monitor.py

@@ -329,7 +329,7 @@ class RDPMonitor(BaseModule):
 
     def _resolve_db_path(self) -> str:
         base = self.config.get("db_dir", os.path.join(
-            os.path.expanduser("~"), ".bigbrother"
+            os.path.expanduser("~"), ".implant"
         ))
         return os.path.join(base, "rdp_monitor.db")
 

modules/passive/smb_monitor.py

@@ -347,7 +347,7 @@ class SMBMonitor(BaseModule):
 
     def _resolve_db_path(self) -> str:
         base = self.config.get("db_dir", os.path.join(
-            os.path.expanduser("~"), ".bigbrother"
+            os.path.expanduser("~"), ".implant"
         ))
         return os.path.join(base, "smb_monitor.db")
 

modules/passive/vlan_discovery.py

@@ -382,7 +382,7 @@ class VLANDiscovery(BaseModule):
 
     def _resolve_db_path(self) -> str:
         base = self.config.get("db_dir", os.path.join(
-            os.path.expanduser("~"), ".bigbrother"
+            os.path.expanduser("~"), ".implant"
         ))
         return os.path.join(base, "vlan_discovery.db")