OPSEC Overview

Defense in depth.

OPSEC modules are designed to increase operational security during authorized engagements. Use --opsec full for maximum protection. Always validate in your target environment.

Sentrava C2 includes a set of optional security hardening modules for the agent binary. These are selected at generate time and compiled into the agent via ldflags. Disabled modules consume no registry slot and produce no runtime overhead.

Module categories

Pre-flight checks run before the agent begins beaconing. If a check fails and KillOnDetection is enabled, the agent exits immediately. By default (with --opsec basic or --opsec full), detections are logged and the agent continues.

Runtime protections operate during the agent's lifecycle — masking memory during sleep, validating the server's TLS certificate fingerprint, and monitoring for debugging.

Linux modules

Module	Category	What it does
`guardrails`	Pre-flight	Detects sandboxes, AV products, and hostile environments
`validator`	Pre-flight	Pins the server TLS certificate fingerprint; detects sinkholes
`sleepmask`	Runtime	XOR-masks agent memory and applies page protection during sleep
`canary`	Runtime	Anti-debug: monitors `TracerPid`, timing anomalies, `LD_PRELOAD`
`polymorph`	Runtime	AES-GCM re-encrypts the agent config block at startup

Windows modules

Windows agents support a separate OPSEC stack enabled with --win-opsec. These modules target the Windows detection surface and are no-ops on Linux.

Module	Category	What it does
`etw-patch`	Pre-flight	Patches ETW to suppress kernel telemetry events
`amsi-bypass`	Pre-flight	Patches AMSI to return AMSI_RESULT_CLEAN for all scans
`ppid-spoof`	Pre-flight	Spoofs parent process ID at spawn time
`ntdll-unhook`	Pre-flight	Restores ntdll.dll .text from disk to remove EDR inline hooks
`indirect-syscall`	Runtime	Replaces Nt* calls with indirect syscall stubs
`sleepmask-win`	Runtime	XOR-masks agent memory and flips page protection during sleep

See Windows OPSEC for full per-module detail including Kill Date and Working Hours lifecycle controls.

Presets

--opsec none    No modules (default)
--opsec basic   guardrails + validator
--opsec full    All five modules

See Presets for the full preset reference, and Modules for per-module detail.

KillOnDetection

By default all presets leave KillOnDetection off. When a detection occurs, the agent logs it and continues. Set KillOnDetection = true only when you explicitly want the agent to self-terminate on detection:

# KillOnDetection is not exposed as a CLI flag by default.
# It can be set in a custom generate invocation via the underlying ldflag.

Platform support

The five Linux modules (guardrails, validator, sleepmask, canary, polymorph) are Linux-specific; they compile to no-ops on Windows. The six Windows OPSEC modules (etw-patch, amsi-bypass, ntdll-unhook, ppid-spoof, indirect-syscall, sleepmask-win) are Windows-specific and compile to no-ops on Linux. Use --opsec for the Linux stack and --win-opsec for the Windows stack; both flags are combinable on a single generate invocation.

How modules are registered

Modules are registered in the agent's capability registry only when their corresponding flag is true. The registration happens in main() before core.New(), so the ordering is deterministic regardless of Go package init ordering.