xThreat Aegis Sensor · Windows x86_64
Endpoint Telemetry Collector & Automated Sandbox Forwarder
Deploy the standalone Aegis collector on analysis VMs, honeypots, or corporate endpoints to hash newly written PE binaries and forward suspicious artifacts directly to your xThreat Workbench.
BINARY BUILD MANIFESTv2.4.1-stable
Artifact:AegisSentinel.exe
Target OS:Windows 10 / 11 / Server x64
Subsystem:ETW + AMSI + Minifilter
Upstream API:POST /api/v1/analyze
ETW & Process Creation Telemetry
Monitors Microsoft-Windows-Kernel-Process and PowerShell ScriptBlock logging (Event ID 4104) with automatic SHA-256 hashing.
AMSI & Memory Allocation Inspection
Hooks suspicious cross-process VirtualAllocEx / WriteProcessMemory / CreateRemoteThread sequences prior to execution.
Automated xThreat Workbench Forwarding
Automatically quarantines unknown unsigned binaries and submits them to POST /api/v1/analyze using your configured Bearer API key.
Minimal Resource Footprint
Compiled native Windows x64 binary (< 15 MB RAM overhead) designed for analyst VMs and honeypot nodes.