A collection of defensive and offensive security tools, research projects, and internal R&D maintained by Red Specter.
Built for security teams, incident responders, and authorized researchers.
Detect → Block → Contain → Prove.

• Overview
• Public tools
• Private R&D
• Current Focus: Red Specter AI Shield
• Why this matters now
• Usage & access
• Responsible use & legal
• Contributing

Red Specter focuses on practical visibility and response across:

• Botnet activity and early-stage DDoS signals
• C2-style outbound behaviour and beaconing
• Sudden service exposure and brute-force patterns
• AI-era risks: shadow AI usage, prompt injection, data leakage, and model integrity
• Fast containment and evidence-first reporting

This profile README is a high-level inventory with links to each repo.

(Available for authorized public use; follow each repo’s README and license.)

• Botnet Radar — Host-level botnet/DDoS early warning and scoring.
  https://github.com/RichardBarron27/redspecter-botnet-radar

• Offensive Framework — Ethical lab toolkit for recon → reporting (authorized testing only).
  https://github.com/RichardBarron27/red-specter-offensive-framework

• ScriptMap — Script inventory and supply-chain visibility.
  https://github.com/RichardBarron27/redspecter-scriptmap

• Email OSINT — Passive domain-based email intelligence.
  https://github.com/RichardBarron27/redspecter-emailosint

• Evidence Collector — DFIR/pentest evidence ledger into structured case files.
  https://github.com/RichardBarron27/redspecter-evidence-collector

• DDoS Flood Sentinel — UDP flood / carpet detection heuristics and alerts.
  https://github.com/RichardBarron27/redspecter-ddos-flood-sentinel

• Port Surge Guardian — Sudden listening-port exposure change alerts.
  https://github.com/RichardBarron27/redspecter-port-surge-guardian

• Threat Recon Watcher — Brute-force / high-volume IP detection from logs.
  https://github.com/RichardBarron27/redspecter-threat-recon-watcher

• C2 Hunter — Outbound monitoring for C2-like behaviour.
  https://github.com/RichardBarron27/redspecter-c2-hunter

• AI Breach Monitor — Detects likely sensitive data leaks in AI prompt logs.
  https://github.com/RichardBarron27/redspecter-ai-breach-monitor

• AI Endpoint Guard — Endpoint visibility into AI tool usage.
  https://github.com/RichardBarron27/redspecter-ai-endpoint-guard

• AI Usage Watchdog — Privacy-first Linux telemetry for AI/LLM usage signals.
  https://github.com/RichardBarron27/redspecter-ai-usage-watchdog

• AI Firewall Proxy — Policy-enforcing proxy to control and log AI model access.
  https://github.com/RichardBarron27/redspecter-ai-firewall-proxy

(Internal and restricted. Not for public distribution without authorization.)

• Breach Containment Switch — One-command web containment + evidence snapshot.
• AI ShadowOps Detector — Covert AI usage detection with evidence logs.
• Cognitive Drift Sentinel — Model behaviour drift monitoring over time.
• Ransomware Canary Sentinel — Pre-encryption mass-change alerts without encryption.
• AI Jailbreak IDS — Prompt-injection / jailbreak intent detection with logging.
• AI Decision Provenance — Cryptographic decision logging for AI accountability.
• LLM Memory Forensics Kit — Scans AI memory/log dumps for risky indicators + tamper-evident reports.
• Red Defender — Autonomous multi-agent defensive AI prototype.
• Log Anomaly Sentinel — Rare command and log pattern detection.
• Beacon Detector — Timed C2 beaconing detection.
• Companion Sentinel — Manipulation/dependency pattern detection in AI companion chats.
• Botnet Radar Pro — Enterprise-tier botnet scoring and enrichment.
• Red Specter Lab — Internal lab scripts, SOPs, and tooling backbone.
• Takedown Dossier Generator — Converts telemetry into evidence-ready takedown packs (IOCs, timeline, templates, tamper-evident hashes).
• Deepfake Verification Guard — Liveness + out-of-band verification packs for voice/video fraud (includes Ticket/QR Verification Pack).
• Agentic Action Gatekeeper — Policy enforcement + circuit breaker for agent actions (framework-agnostic gateway with auditable decisions).
• Red Specter Scrambler — Reverse-proxy chokepoint + tripwire scoring to disrupt agentic/automated intrusion workflows (traps, RS Event v1 alerts, evidence packs).
• Kernel Trust Sentinel — Kernel trust posture + module/tracing cross-checks (rootkit-deception indicators) → RS Event v1 evidence.
• PoisonWatch — Defensive poisoning/backdoor scanner for datasets & RAG corpora (prompt-injection + obfuscation heuristics) → RS Event v1.
• Phish Interceptor (Defensive) — .eml phishing/BEC triage → IOCs + RS Event v1 + tamper-evident case pack.

A fully integrated, production-ready platform for AI security.

Red Specter AI Shield unifies 17 security modules—from prevention to forensic response—into a single deployable suite.
It is functional, integrated, and tested end-to-end for controlled pilot deployments.

Core Deliverables: ✅ Integrated Platform: 17 modules on a unified event schema (RS Event v1)
✅ Forensic Evidence: Automated, tamper-evident case packaging (timeline + IOCs + hashes)
✅ Operational Coverage: 18 playbooks mapped to modules + sanity coverage checker
✅ Status: Deployment Ready — available for pilot evaluation (private)

New capability added:

• AI Usage Watchdog Baseline + Drift — baselining + drift scoring + RS Event v1 alert emit + export-ready JSONL
• Phish Interceptor (Defensive) — phishing/BEC .eml triage → IOC extraction + evidence pack output

Interested in a pilot deployment or technical walkthrough?
Connect with me on LinkedIn to discuss controlled evaluation.

The threat market is actively selling “malicious AI” packages and automation aimed at phishing, BEC, and social engineering.

Red Specter’s stance is simple:

• detect early
• block where you can
• contain fast
• prove everything (evidence, hashes, timelines)

That’s the gap AI Shield is built to close.

• Public tools: follow each repo’s README, licensing, and usage notes.
• Private R&D: restricted to internal staff and vetted partners. Do not attempt to run or distribute without approval.

Some tooling and research can be misused.
You must follow applicable laws, have written authorization for offensive testing, and follow employer/client policies.
Always obtain explicit permission before testing systems you do not own.

• Open an issue for feature requests and larger proposals.
• For fixes: fork, branch, PR, and include tests + docs.