v2.0.0 — 2.0.0: C2/beacon scanner, live network monitoring, and 20+ new security features

Released: August 19, 2026

SentinelBro 2.0.0 is the project's biggest release yet: a memory-based C2/beacon scanner, live per-process network monitoring, USB and file history cleanup, shared-folder and LOLBAS/LOLDriver threat checks, and 20+ other new security features, along with step-by-step GUI remediation guides for every check and a fully redesigned Windows 11-style interface.

Changelog

• Added a C2/beacon scanner that enumerates suspicious RWX / unbacked-image memory regions in running processes
• Added a "sleeping beacon" heuristic that tracks memory entropy changes over time to catch encrypted beacons
• Added a signature-based Cobalt Strike config decoder (with a clear false-positive warning)
• Added live per-process network traffic monitoring (ETW-based)
• Added core lateral-movement indicators — active RDP/SMB/WinRM connections, sessions, and Security log analysis
• Added detection of listening ports and VPN/tunnel tooling
• Added saved Wi-Fi network history and a MAC-address list of all devices on the network (ARP)
• Added a shared folders/drives list that auto-flags risky "Everyone: Full Control" permissions
• Added USN Journal-based tracking that distinguishes file copy vs. move vs. delete
• Added a large-file disk scanner (WinDirStat-style)
• Added USB device history cleanup, with a confirmation dialog and a local audit log
• Extended the recent file changes filter to 30 days and added filtering by file creation time
• Expanded Autoruns coverage — Winlogon, IFEO/Debugger hijacking, AppInit/AppCert DLLs, WMI event subscriptions, and unsigned services
• Added a boot configuration (BCD/bootmgr) check
• Added a full list of elevated (SYSTEM/Administrator) processes
• Added a list of OS restore points with dates
• Added crash (BSOD) and unexpected shutdown/restart history
• Added environment variables, PATH folder listing, and a PATH-hijacking (writable system folder) check
• Added LOLBAS and LOLDriver (BYOVD) threat-intel scanners, with an in-app database update button
• Added an end-of-life (EOL) checker for the installed Windows version
• Added step-by-step, regedit-free GUI remediation guides for all ~56 security checks
• Fully redesigned the interface — flat Windows 11-style design, grouped sidebar, native look and feel
• Stability fixes: elevated commands no longer flash a console window; fixed an encoding bug in result parsing