Initial public release

Full BigBrother network implant - passive SOC + active exploitation.
Personal identifiers removed; all capabilities intact.
See README.md for setup and docs/deployment.md for detailed deployment.

data/bpf_filters/credentials.bpf

@@ -0,0 +1,2 @@
+# HTTP Basic/NTLM auth, FTP, Telnet, SMTP, POP3, IMAP, LDAP bind, Kerberos AS-REQ
+port 80 or port 21 or port 23 or port 25 or port 110 or port 143 or port 389 or port 88 or port 445

data/bpf_filters/discovery.bpf

@@ -0,0 +1,2 @@
+# ARP, DHCP, mDNS, SSDP, LLMNR, NetBIOS
+arp or port 67 or port 68 or port 5353 or port 1900 or port 5355 or port 137 or port 138

data/bpf_filters/dns.bpf

@@ -0,0 +1 @@
+port 53

data/bpf_filters/full_capture.bpf

@@ -0,0 +1 @@
+# Everything — no filter