chore: update

Author: Gorstak

CHANGELOG.md

@@ -2,6 +2,41 @@
 
 All notable changes to Windows Sentinel are documented in this file.
 
+## [3.3.0] - 2026-05-23
+
+### Added — Electron Allowlist & Work Folders Protection
+
+#### Electron/JIT App Allowlist (False Positive Elimination)
+
+- **BehavioralCorrelationEngine**: Added comprehensive allowlist of 40+ Electron/JIT apps that are now excluded from composite correlation. Eliminates false "In-Memory Implant + Network Beacon" and "DGA + C2 Beaconing" composites for:
+  - IDEs: Kiro, VS Code, Rider, IntelliJ, PyCharm, WebStorm, GoLand
+  - Communication: Discord, Slack, Teams, Signal, WhatsApp, Telegram
+  - Productivity: Notion, Obsidian, Figma, Postman, Todoist, ClickUp, Linear
+  - Security: Bitwarden, 1Password
+  - Media: Spotify, Loom
+  - Gaming: Steam, steamwebhelper
+  - Dev tools: GitKraken, Insomnia
+  - Windows system: dwm, TextInputHost, SearchHost, ShellExperienceHost
+  
+- **MemoryBehaviorAnalyzer**: Expanded JIT process exclusion list with all the above Electron apps. These processes legitimately use RWX memory for V8/SpiderMonkey JIT compilation.
+
+#### Work Folders Exfiltration Monitor (Kill-Authorized)
+
+- **WorkFoldersExfilMonitor** — Detects and blocks unauthorized Work Folders activation:
+  - Monitors Work Folders service state (kills if running on personal machine)
+  - Detects new sync server URLs appearing in registry (removes them)
+  - Detects Group Policy injection for auto-provisioning (deletes policy keys)
+  - Detects Work Folders process execution (kills immediately)
+  - Takes baseline at startup — alerts if already configured
+  - Active response: stops service, kills process, removes registry config
+  - MITRE T1567, T1048, T1484.001
+
+### Changed
+
+- Version bumped to 3.3.0 across all projects
+
+---
+
 ## [3.2.0] - 2026-05-22
 
 ### Added — Browser & Account Credential Protection + PowerShell Threat Monitoring

README.md

@@ -2,7 +2,7 @@
 
 **Userland EDR for Windows — Behavioral Detection, Automated Response & Aggressive Deception**
 
-> Version: 3.2.0 (Browser & Account Credential Protection)  
+> Version: 3.3.0 (Electron Allowlist & Work Folders Protection)  
 > Author: [Gorstak](https://gorstak.eu) | [GitHub](https://github.com/CroatiaSecurity/Sentinel)  
 > License: MIT
 
@@ -481,6 +481,7 @@ installer/
 | 3.0.0 | Security Hardening, Observability & Resilience | Centralized SecurityValidation utility, RateLimiter with burst capability, SafeExecution patterns (retry/timeout/circuit breaker), ConfigurationValidation framework, ConfigIntegrityMonitor (detects config/exe tampering), SentinelHealthCheck (memory/handles/threads/log/quarantine monitoring), SentinelMetrics (counters/histograms/gauges for detection rate, FP rate, response latency), SecureHttpClientFactory (TLS 1.2+, domain allowlisting, certificate validation), atomic quarantine operations, DllUnloadEngine improvements (IDisposable, validation, safe unload), StructuredLoggingExtensions, comprehensive fuzz tests and integration tests. |
 | 3.1.0 | Observability, Blind Spots & Resilience | SentinelMetrics wired into DetectionEngine and AdvancedResponseEngine (live detection rate, response latency, FP tracking). HashReputationService cache implemented (in-memory + DPAPI-encrypted disk persistence via SecureCacheStore, cuts API calls 90%+). Named Pipe Monitor (Cobalt Strike, PsExec, Impacket, Metasploit C2 detection). WMI Event Subscription Persistence Monitor (T1546.003 — detects planted __EventFilter/__EventConsumer bindings). Startup Self-Test (ETW, DPAPI, quarantine, log file, rule count verification on boot). Watchdog heartbeat HMAC signing (DPAPI-derived key, unforgeable without SYSTEM access). ProcessAncestryCache WMI/CIM fallback for Server Core/IoT. SentinelService.StartAsync properly overrides BackgroundService. |
 | 3.2.0 | Browser & Account Credential Protection | ChromeCredentialGuardMonitor (Login Data, Cookies, Local State file access monitoring for all Chromium browsers). FirefoxCredentialGuardMonitor (key4.db, logins.json, cookies.sqlite monitoring for Firefox/Waterfox/Thunderbird). MicrosoftAccountGuardMonitor (WAM TokenBroker cache, PRT extraction, BrowserCore abuse, Azure AD token theft tools). BrowserExtensionMonitor (malicious extension installation, registry force-install, dangerous permission detection). ChromeSessionGuardMonitor (remote debugging, CDP hijack, App-Bound Encryption bypass). PowerShellThreatMonitor (ETW script-block logging, AMSI/ETW bypass detection, download cradles, offensive frameworks, credential theft commands, encoded command detection). BrowserCredentialTheftRule (process-start detection for stealer tools targeting all browsers + Microsoft tokens). President's Law updated: "browser credential theft" kill-authorized. |
+| 3.3.0 | Electron Allowlist & Work Folders Protection | Comprehensive Electron/JIT app allowlist in BehavioralCorrelationEngine and MemoryBehaviorAnalyzer — eliminates false composite detections for Kiro, VS Code, Discord, Slack, Teams, Steam, Spotify, Notion, Obsidian, Figma, Postman, Bitwarden, and 20+ other apps. WorkFoldersExfilMonitor: detects unauthorized Work Folders configuration (registry, Group Policy injection), kills the service if running, removes injected policies, blocks silent data exfiltration via enterprise sync on personal machines. Kill-authorized. |
 
 ---
 

THREAT_MODEL.md

@@ -1,6 +1,6 @@
 # Windows Sentinel — Threat Model
 
-**Version: 3.2.0**
+**Version: 3.3.0**
 
 This document assumes the attacker has read the source code.
 

architecture-council.md

@@ -3,7 +3,7 @@
 **Status:** Architecture spec. Extends, does not replace, `requirements.md`,
 `design.md`, `constraints.md` (all v0.9.0).
 
-**Last updated:** v3.2.0 (May 2026) — Browser & Account Credential Protection.
+**Last updated:** v3.3.0 (May 2026) — Electron Allowlist & Work Folders Protection.
 
 ---
 

constraints.md

@@ -1,6 +1,6 @@
 # Windows Sentinel — Constraints
 
-**Version: 3.2.0**
+**Version: 3.3.0**
 
 ---
 

design.md

@@ -1,6 +1,6 @@
 # Windows Sentinel — Design Document
 
-**Version: 3.2.0**
+**Version: 3.3.0**
 
 ---
 
@@ -73,6 +73,7 @@ The fusion layer is PASSIVE — it never blocks, kills, or modifies telemetry.
 | `BrowserExtensionMonitor` | **3.2.0** Baselines installed extensions, detects new extensions with dangerous permissions, registry force-install. Scans every 30s | No |
 | `ChromeSessionGuardMonitor` | **3.2.0** Detects remote debugging port abuse, CDP connections from scripting processes, App-Bound Encryption bypass (elevation_service.exe). Scans every 15s | No |
 | `PowerShellThreatMonitor` | **3.2.0** ETW script-block logging (Event ID 4104). Detects AMSI/ETW bypass, download cradles, reflective loading, offensive frameworks, credential theft commands. Falls back to cmdline scanning. | Yes (ETW preferred) |
+| `WorkFoldersExfilMonitor` | **3.3.0** Detects unauthorized Work Folders activation (service running, registry config, Group Policy injection). Active response: kills service, removes config, deletes policy keys. Kill-authorized. Scans every 15s | No |
 
 ### Engine
 
@@ -317,6 +318,14 @@ Composite detections are emitted as Tier1 `DetectionEvent`s directly into the de
 | `BrowserCredentialTheftRule` | Process-start detection rule for browser credential theft tools. Covers Chromium paths, Firefox paths, Microsoft token paths, DPAPI patterns, known stealer tools. |
 | President's Law update | `"browser credential theft"` fragment added to kill list in both AdvancedResponseEngine and AgentResponseEngine. |
 
+## Added in 3.3.0
+
+| Component | Purpose |
+|-----------|---------|
+| Electron/JIT allowlist (BehavioralCorrelationEngine) | 40+ Electron apps excluded from composite correlation. Eliminates false "In-Memory Implant + Network Beacon" and "DGA + C2 Beaconing" composites for Kiro, VS Code, Discord, Slack, Steam, etc. |
+| Electron/JIT allowlist (MemoryBehaviorAnalyzer) | Expanded JIT process exclusion list with all common Electron apps. Prevents false RWX memory alerts. |
+| `WorkFoldersExfilMonitor` | Detects unauthorized Work Folders activation: service state monitoring, registry config detection, Group Policy injection detection. Active response: kills service, removes config, deletes injected policies. Kill-authorized. |
+
 ---
 
 ## Monitoring Coverage by Elevation Level

installer/build.ps1

@@ -44,48 +44,42 @@ dotnet clean "$RepoRoot\src\WindowsSentinel.Service\WindowsSentinel.Service.cspr
 dotnet clean "$RepoRoot\src\WindowsSentinel.Agent\WindowsSentinel.Agent.csproj" -c $Configuration --nologo -v q 2>$null
 Write-Host "[OK] Build cache cleared" -ForegroundColor Green
 
-# ── Check Windows Defender Exclusions ─────────────────────────────────────────
-Write-Host "`n[Pre-build] Checking Windows Defender configuration..." -ForegroundColor Yellow
+# ── Windows Defender Exclusions (ALWAYS add — status check is unreliable) ─────
+Write-Host "`n[Pre-build] Adding Windows Defender exclusions..." -ForegroundColor Yellow
 
 try {
-    $defenderStatus = Get-MpComputerStatus -ErrorAction SilentlyContinue
-    if ($defenderStatus.RealTimeProtectionEnabled) {
-        $exclusions = Get-MpPreference -ErrorAction SilentlyContinue | Select-Object -ExpandProperty ExclusionPath
-        $repoExcluded = $exclusions | Where-Object { $_ -and $RepoRoot.StartsWith($_) }
-        
-        if (-not $repoExcluded) {
-            # AUTOMATIC: Try to add exclusion without prompting
-            try {
-                Add-MpPreference -ExclusionPath $RepoRoot -ErrorAction Stop
-                Write-Host "[AUTO] Added Defender exclusion for $RepoRoot" -ForegroundColor Green
-                
-                # Also exclude build outputs
-                $publishPath = Join-Path $Installer "publish"
-                if (Test-Path $publishPath) {
-                    Add-MpPreference -ExclusionPath $publishPath -ErrorAction SilentlyContinue | Out-Null
-                }
-                
-                # Exclude the releases folder
-                $releasesPath = Join-Path $RepoRoot "releases"
-                Add-MpPreference -ExclusionPath $releasesPath -ErrorAction SilentlyContinue | Out-Null
-            }
-            catch {
-                Write-Host "[WARN] Could not auto-add Defender exclusion (needs Admin): $_" -ForegroundColor Yellow
-                Write-Host "       Build may fail with 'virus detected' errors." -ForegroundColor Yellow
-                Write-Host "       To fix: Run as Administrator or run: Add-MpPreference -ExclusionPath '$RepoRoot'" -ForegroundColor Cyan
-                Start-Sleep -Seconds 2
-            }
+    # Always add exclusions regardless of reported Defender status.
+    # Get-MpComputerStatus can report RealTimeProtection=disabled while
+    # Defender still scans files during build (cloud protection, on-access hooks).
+    $exclusionsNeeded = @(
+        $RepoRoot,
+        (Join-Path $Installer "publish"),
+        (Join-Path $Installer "output"),
+        (Join-Path $RepoRoot "releases")
+    )
+
+    foreach ($path in $exclusionsNeeded) {
+        try {
+            Add-MpPreference -ExclusionPath $path -ErrorAction Stop
         }
-        else {
-            Write-Host "[OK] Windows Defender exclusion already configured" -ForegroundColor Green
+        catch {
+            # Silently continue — may already exist or need admin
         }
     }
-    else {
-        Write-Host "[OK] Windows Defender Real-time Protection is disabled" -ForegroundColor Yellow
+
+    # Also exclude the dotnet build output patterns
+    try {
+        Add-MpPreference -ExclusionProcess "dotnet.exe" -ErrorAction SilentlyContinue
+        Add-MpPreference -ExclusionExtension ".dll" -ErrorAction SilentlyContinue
     }
+    catch { }
+
+    Write-Host "[OK] Defender exclusions applied (repo + publish + output)" -ForegroundColor Green
 }
 catch {
-    Write-Host "[WARN] Could not check Defender status: $_" -ForegroundColor Yellow
+    Write-Host "[WARN] Could not add Defender exclusions (run as Admin if build fails): $_" -ForegroundColor Yellow
+    Write-Host "       Manual fix: Add-MpPreference -ExclusionPath '$RepoRoot'" -ForegroundColor Cyan
+    Start-Sleep -Seconds 2
 }
 
 # ── 1. Publish Service ────────────────────────────────────────────────────────

installer/setup.iss

@@ -15,7 +15,7 @@
 
 #define AppName      "Windows Sentinel"
 #ifndef AppVersion
-  #define AppVersion   "3.2.0"
+  #define AppVersion   "3.3.0"
 #endif
 #define AppPublisher "Gorstak"
 #define AppURL       "https://github.com/CroatiaSecurity/Sentinel"

requirements.md

@@ -1,6 +1,6 @@
 # Windows Sentinel — Requirements
 
-**Version: 3.2.0**
+**Version: 3.3.0**
 
 ---
 

src/WindowsSentinel.Agent/Program.cs

@@ -80,7 +80,7 @@ static async Task<int> Main(string[] args)
         var host = builder.Build();
 
         var logger = host.Services.GetRequiredService<ILogger<Program>>();
-        logger.LogInformation("Windows Sentinel Agent v3.2.0 starting in user session (with user-context monitors)");
+        logger.LogInformation("Windows Sentinel Agent v3.3.0 starting in user session (with user-context monitors)");
 
         await host.RunAsync();