What is kassandra?

s3cur3th1ssh1t/kassandra — explained in plain English

Analysis updated 2026-05-18

★ 28CAudience · developerComplexity · 3/5Setup · moderate

Mindmap

mindmap
  root((Kassandra))
    What it does
      Watches running programs
      Flags suspicious behavior
      Assigns risk tags
      Prints summary on exit
    How it works
      Taps Windows Event Tracing
      Tracks process creation
      Monitors network connections
      Watches loaded libraries
    Alert system
      Single tag is silent
      Two tags give low alert
      Four tags give high alert
      Logs alerts to file
    Use cases
      Study security tool code
      Detect network tunneling
      Spot credential harvesting
      Monitor process behavior
    Tech stack
      C language
      Windows SDK
      Event Tracing for Windows
      Admin privileges required

mindmap root((Kassandra)) What it does Watches running programs Flags suspicious behavior Assigns risk tags Prints summary on exit How it works Taps Windows Event Tracing Tracks process creation Monitors network connections Watches loaded libraries Alert system Single tag is silent Two tags give low alert Four tags give high alert Logs alerts to file Use cases Study security tool code Detect network tunneling Spot credential harvesting Monitor process behavior Tech stack C language Windows SDK Event Tracing for Windows Admin privileges required

What do people build with it?

USE CASE 1

Study readable C code to learn how Windows security monitoring tools work.

USE CASE 2

Run it with admin privileges to watch running programs for suspicious network tunneling behavior.

USE CASE 3

Use it to detect programs that load many security-related libraries, which could indicate credential harvesting.

USE CASE 4

Monitor real-time process activity and review a ranked risk summary after stopping the tool.

What is it built with?

CWindows SDKETWVisual StudioMinGW

How does it compare?

	s3cur3th1ssh1t/kassandra	busung-dev/cve-2026-43499-s25u	cocoonstack/scrcpy-rfb
Stars	28	28	28
Language	C	C	C
Setup difficulty	moderate	hard	hard
Complexity	3/5	5/5	4/5
Audience	developer	developer	developer

Figures from each repo's GitHub metadata at analysis time.

How do you get it running?

Difficulty · moderate Time to first run · 30min

Requires administrator privileges on Windows to access kernel-level tracing and must be built from source using Visual Studio or MinGW.

The explanation does not mention a license, so the terms of use are unclear.

So what is it?

Kassandra is a Windows security tool that watches running programs in real time and flags suspicious behavior. It was created as a learning resource: the original version was published without source code, so the author used an AI assistant to generate readable C code that others could study and analyze. The tool works by tapping into Event Tracing for Windows, a built-in Windows mechanism for recording system activity. Kassandra listens to events about process creation, network connections, memory allocation, and loaded libraries. As it watches, it assigns tags to each process. For example, a program that connects to both public and private network addresses gets a "net_tunnel" tag, suggesting possible network tunneling. A program that loads many security-related DLLs gets a "module_balloon" tag, which could indicate credential harvesting. Other tags cover dynamic code injection, thread pool manipulation, and connections to many Windows service ports at once. Tags combine into severity levels using a two-phase algorithm. A single suspicious tag produces no alert. Two related tags produce an INFO or LOW alert. Four or more tags, or certain escalation patterns, push a process to MEDIUM or HIGH severity. Alerts at LOW or above are printed to the console and written to a log file. When you stop the tool with Ctrl+C, it prints a sorted summary table of every flagged process, ordered from highest risk to lowest. The entire tool is a single C file, about 1,600 lines of code, with no dependencies beyond the Windows SDK. It requires administrator privileges to run because it needs access to kernel-level tracing. You can build it with Visual Studio, MinGW on Windows, or cross-compile from Linux using MinGW, though the resulting executable only runs on Windows. The README also includes an architecture diagram showing how three event streams feed into a process table, where tags are evaluated and alerts are emitted. The README appears to be cut off mid-sentence in the Files section. The full README is longer than what was shown.

Copy-paste prompts

Prompt 1

I want to understand how Kassandra assigns tags to Windows processes. Walk me through the tag logic for net_tunnel, module_balloon, and any other tags, and show me how to add a new tag that flags a process making many rapid outbound connections.

Prompt 2

Help me set up a MinGW cross-compilation workflow on Linux to build Kassandra into a Windows executable. What dependencies do I need and what build command should I run?

Prompt 3

I have Kassandra running on Windows. Explain how the two-phase severity algorithm combines tags into INFO, LOW, MEDIUM, and HIGH alerts, and help me modify the thresholds so that three related tags trigger a MEDIUM alert instead of four.

Prompt 4

I want to extend Kassandra to send a desktop notification or write to the Windows Event Log whenever a HIGH severity alert is emitted. Show me how to add that functionality to the existing C code.

Frequently asked questions