ProcSentry is an EDR-style host-integrity detection scanner for critical Windows processes & services — a C++ library and CLI.

---

Note

Scope, honestly: ProcSentry is a point-in-time, read-only detection scanner — the "D" in EDR. It runs five tamper detections against a fixed set of critical processes/services and reports findings mapped to MITRE ATT&CK. It is not a real-time kernel agent and takes no response actions.

It is:

• Read-only — query-only access masks; never modifies another process
• A library + CLI — embed procsentry::scan() or run procsentry.exe
• Five detections mapped to MITRE ATT&CK, each catching a specific tamper behavior
• Structured output — anomalies and operational diagnostics kept separate; JSON available
• Zero external dependencies, CMake-built, C++17, x64

Warning

Full inspection of system processes requires running elevated (SeDebugPrivilege). Without elevation, some detections emit diagnostics and degrade gracefully.

Detections 🛡️

Detection	Catches	MITRE ATT&CK	Severity
Termination	a monitored process/service is not running	T1489 Service Stop · T1562.002	Info
UnexpectedRestart	(re)started since the last interactive logon	behavioral indicator (≈ T1562)	Warning
ImageIntegrity	wrong image path, unsigned/invalid binary, or SCM path mismatch	T1036.005 Masquerading · T1574	Anomaly
ThreadTampering	suspended threads — a process-hollowing/injection indicator	T1055.012 Process Hollowing	Anomaly
TokenManipulation	token privilege/group enabled-state drift	T1134 Access Token Manipulation	Warning

Detections are indicators mapped to the nearest technique — e.g. a suspended thread is a hollowing signal, not proof.

Threat model 🎯

ProcSentry watches a curated set of high-value Windows processes and services (e.g. lsass, MsMpEng/Defender, explorer, the Event Log, BFE, DPS). An attacker who has reached a host often stops a logging/security service, replaces or masquerades a signed binary, hollows a trusted process, or adjusts a service token. Each detection above targets one of those moves and surfaces it as a severity-ranked, ATT&CK-tagged finding suitable for triage or scripting (meaningful exit codes, --json).

Features ✨

• Meaningful exit codes (0 clean, 1 anomaly, 2 operational failure) for scripting
• --json machine-readable output
• Fine-grained --detections selection and configurable --restart-grace

Example 🧪

#include "procsentry/procsentry.hpp"
#include <cstdio>

int main() {
    procsentry::Report report = procsentry::scan();
    std::printf("anomalies: %d\n", report.has_anomaly() ? 1 : 0);
}

Structure ⚙️

CLI 🔧

procsentry [--json] [-v|--verbose] [-q|--quiet]
           [--detections termination,unexpected_restart,image_integrity,thread_tampering,token_manipulation]
           [--restart-grace <sec>] [-h|--help] [-V|--version]

Note

Informational findings — including Termination (Monitored target not running) — are hidden in default console output. Pass -v/--verbose to show them, or use --json, which always includes every severity.

Installation 📥

git clone https://github.com/ClassyEdge/ProcSentry
cd ProcSentry
cmake -S . -B build -G Ninja -DCMAKE_C_COMPILER=clang-cl -DCMAKE_CXX_COMPILER=clang-cl
cmake --build build

The CLI is build/procsentry.exe. To embed the library, add include/ to your include path and link the procsentry target.

Documentation 📖

Full docs — API reference, detections, MITRE mapping, CLI usage, and build steps — live in docs/documentation.md.

Doc	What's in it
Documentation	API reference, the five detections, ATT&CK mapping, CLI usage, building
Contributing	how to build, test, and submit changes
Security	how to report a vulnerability
Changelog	release history

License 📜

MIT — see LICENSE.