Search Engine
Full-text search across titles, headings, tags, descriptions, and body content.
Shortcut: Ctrl + K
Results
Big-picture explanations, quick reference material, and definitive orientation docs.
mutant capability reference generated from the builtin metadata builtin metadata go the source of truth to refresh after adding or changing builtins iterate builtin builtins and read each entry s teachingdoc platformsupport and capabilityc...
Big-picture explanations, quick reference material, and definitive orientation docs.
graph database the db_ builtins embed a property graph database in the mutant runtime for modeling entities and the relationships between them people and documents in a knowledge graph o...
Tamper resistance, sandboxing, remote scan policy, and security deep dives.
...ical modules 1 security crypto go - aes-gcm payload encryption decryption - metadata serialization parsing 2 security kdf go - argon2id derivation and parameter validation - deterministic hkdf utilities 3 security signing go security signatures go - ed25519 si...
Canonical policies, reference sheets, migration matrices, and source-of-truth documentation.
...------------- use filesystem and disk image builtins fs__ ntfs__ vhdi_ etc move data loading to browser-side javascript and pass data into browser-safe builtins browser sandbox does not expose host filesystem block devices use process exec builtins process__ c...
Big-picture explanations, quick reference material, and definitive orientation docs.
structured data json encoding compression amp conversion mutant scripts spend most of their time moving data between shapes text off the wire bytes on disk and the hashes arrays sc...
Bytecode, VM, polymorphism, and execution internals.
...tation set a generated capability reference plus deep-dive guides for the graph database runtime integration structured data and networking - all aoiflux forensic libraries upgraded to their latest releases new language capabilities - higher-order collection f...
PROCESS INJECTION DETECTION LLD
Tamper resistance, sandboxing, remote scan policy, and security deep dives.
...and confidence thresholding - future architecture for cross-process detection - data model scoring and rollout plan out of scope - offensive code or exploit implementation - kernel driver implementation - full edr product design --- 3 current implementation su...
Tamper resistance, sandboxing, remote scan policy, and security deep dives.
...can is disabled when enable env is unset 2 invalid mode falls back to observe 3 data model core types 1 remoteprocesstarget - pid name executable 2 remoteprocesssignal - name detected weight confidence detail evidence 3 processriskverdict - pid name finalscore...
Canonical policies, reference sheets, migration matrices, and source-of-truth documentation.
...in builtin go - builtin names constants builtin names go - builtin teaching metadata signatures builtin metadata go related references - capability reference capability_reference md the full category-grouped catalog of every builtin generated from the metadata...
Big-picture explanations, quick reference material, and definitive orientation docs.
...ge standard library 399 builtins across 32 categories strings math hashing time structured data json encoding compression higher-order collection functions filesystem networking sockets tls http graph modeling cryptography ioc network intelligence fingerprinti...
Editor integration, implementation workflow, and operational runbooks.
...ory thread hook signals 2 calibrate weights and thresholds using false-positive datasets 3 add evidence-rich integration tests for platform-specific scanners suggested file plan 1 security processscan_windows go 2 security processscan_windows_stub go 3 securit...
Tamper resistance, sandboxing, remote scan policy, and security deep dives.
...inspectors 2 keep weighted correlation tuning calibrated against false-positive datasets 3 continue allowlist tuning for approved enterprise tooling primary anchors 1 security antitamper_probe go 2 security antitamper_windows go 3 runner runner go 2 2 polymorp...
Bytecode, VM, polymorphism, and execution internals.
... the legacy core-9 only - every builtin is documented a builtindoc entry in metadata go signature summary params is part of done not optional - every builtin is tested a _test go case covering happy path arg-count error type error is part of done - reuse share...
Editor integration, implementation workflow, and operational runbooks.
... quick fixes textdocument semantictokens full semantictokensfull semantic token data panic fallback textdocument formatting formatting ast formatter safety-preserving fallback textdocument ontypeformatting ontypeformatting trigger-based canonicalization while ...
Big-picture explanations, quick reference material, and definitive orientation docs.
... file or a remote http endpoint this is useful for anything you want to keep as data instead of compiled logic scoring functions detection classification rules response policies content that a rules team can edit and ship without touching the mutant program th...
Big-picture explanations, quick reference material, and definitive orientation docs.
...t_tls_connect address timeoutms options connection handle net_conn_write handle data timeout_ms bytes written write deadline default 30s or timeout_ms example verified tls client let conn err net_connect example com 443 5000 let opts server_name example com mi...
