n0mad1k d3d1deb99c v3.1: Incorporate security tribe review findings into design doc
Add 7 new modules: ldap_harvester, rdp_monitor, quic_analyzer,
db_interceptor (passive), change_detector, security_posture,
operator_audit (intel). Add capture_bus for single AF_PACKET
demux to per-module queues (multiprocess architecture). Fix Pi
Zero memory budget (70MB interpreter, 4 passive modules max).
Move sensitive config inside LUKS with network-derived boot key.
Require 128GB SD card with zstd PCAP compression. Add coercion
tools (Coercer, PetitPotam), proxychains-ng, socat, sshuttle,
pypykatz, ldapdomaindump, smbmap, ROADtools. Add thermal
monitoring, SQLite contention fix (single DB + async writer),
bridge STP/CDP suppression, DHCP fingerprinting, wireless
interface conflict detection, optional scope.yaml, DoH/ECH
awareness, triage CLI command. Update implementation phases
and hardware tier matrix.
2026-03-17 10:57:51 -04:00
S
Description
Network drop implant — passive SOC + active exploitation. Deploy on any Debian host.
4.3 MiB
Languages
Python 89.2%
Shell 8.5%
HTML 1.1%
C 0.9%
Jinja 0.3%