NiteWatch
Somebody's knocking on your door at 3am. Here's who.
Pre-release, unsigned, and the false-positive rate is unmeasured. Windows
will call it an unrecognised app; on Windows 11 with Smart App Control enabled
it will not run at all. A build is downloadable from
threattape.com with the
caveats stated in full. Everything it cannot do is compiled into the binary and
one click from the dashboard.
NiteWatch is a lightweight personal security agent for Windows. It watches what
your computer is actually doing — which programs are running, who they're
talking to, what files they're touching — and when something is wrong, it tells
you the story in plain English with a one-click fix.
- Who's talking? A permanent, process-attributed log of every outbound
connection: which program, which server, which domain, when — plus who owns
the address block and what country it's registered in.
- The whole story. Click any connection to see the causal chain that
produced it: program started → looked up a name → connected. Reconstructed
from a causal event graph, ordered by logical clock rather than wall time.
- Do this. Alerts come with plain-English explanations and one-click
remediation — block, stop, quarantine, remove from startup — each with undo
where the change can be reversed.
- Private by design. Everything is analysed on your machine. Threat
intelligence and address-ownership data are pulled down; nothing about your
traffic goes up.
What it detects
| Area | Examples |
|---|
| Command & control | connections to known malware infrastructure, programs dialling bare addresses they never looked up, unsigned software reaching new destinations, first contact with watched jurisdictions |
| Persistence | autostart entries added from temporary folders, an existing startup entry silently repointed, launch hijacking (IFEO/AppInit) |
| Ransomware | one program rewriting many documents across folders, encryption-style renames, ransom notes, backup destruction |
| Credential theft | a program that isn't the owner reading saved passwords, SSH keys, cloud credentials or wallet files |
Noise control is treated as a feature, not a detail: verified-publisher
suppression, a post-install learning window, per-program/destination "always
allow", and severity gating so only serious findings interrupt you.
Status
Feature complete against the original design; not yet validated on real
hardware over time. The false-positive rate during ordinary use is the open
question.
Running it
Build (pure-Go, single static exe, no CGO):
cd agent && CGO_ENABLED=0 go build -o nitewatch ./cmd/nitewatch
Cross-compile for Windows:
cd agent && GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go build -trimpath -ldflags "-s -w" -o ../dist/nitewatch.exe ./cmd/nitewatch
-trimpath matters: builds are reproducible, and released binaries have their
SHA-256 published, so a build made without it will not match the hash on the
download page even when the source is identical.
dist/ is git-ignored build output. To hand someone a working copy, ship the
exe together with agent/scripts/run-nitewatch.bat — that launcher is the
source of truth, and it must sit in the same directory as the exe because it
self-elevates and then runs nitewatch.exe from its own location.
dist/ is where a build is picked up from, so rebuild it whenever the thing
being handed over changes. A stale exe there is indistinguishable from a
current one at a glance, and the file's timestamp does not help: Go stamps the
commit time into the binary, not the build time, so a fresh build of old code
and an old build of old code look the same. To check what a binary actually is:
go version -m dist/nitewatch.exe | grep vcs
Build releases from the main checkout, not a git worktree. Go recognises a
git repository only by a .git directory; a worktree has a .git file, so
Go walks past it and stamps whatever repository encloses it — on the dev box,
the unrelated parent repo. The build still works; its vcs.revision is simply
wrong, and so is the "quote this in any bug report" line.
The running agent reports the same identity in its About panel, which is the
only way to check on a machine without Go.
Windows (live) — must run elevated; ETW requires Administrator:
nitewatch.exe --serve
Or double-click run-nitewatch.bat, which requests elevation for you. The
agent opens the dashboard itself; if it does not, use the Open the dashboard
link it prints. The plain address http://127.0.0.1:8973 is not enough on its
own: the link carries this run's API token after #.
Dev/demo (any OS) — replay a recorded trace, no elevation needed:
./nitewatch --replay testdata/traces/basic.jsonl
Useful flags: --no-feeds (skip threat-intel downloads), --no-recon (skip the
address-ownership dataset), --rules <dir> (load rule packs from disk during
development). Everything else is configured from the dashboard's Settings panel.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
