Dubay Cyber Security Product Lab • Zero-DLL Pure-Rust Flagships

The Alaska Pure-Rust Cyber Arsenal:
Command • Sentinel • Forensics • Canary

Four standalone yet seamlessly interconnected pure-Rust security products engineered by Dubay Tech. Deploy individually as single-binary guardians or unite all 27 crates and 80 REST routes inside Alaska Command.

🛡️ Dedicated Suite Storefront: MyAlaska.me Experience live interactive Ransomware Fire-Drills, 7 HD Video Cinema tours, 25 White Papers & 23 Rugged Drive hardware bundles:

⚡ Live Command Portal ↗ 🎯 Sentinel 26-Tool Demo ↗ 🔬 Forensics Studio ↗ 🐤 Canary Simulator ↗ 🏛️ Gov P-Card (<$10k) ↗

Golden Rule Guarantee 100% Zero-DLL Pure Rust (`verify_zero_dll.py` Verified): Every product runs from a local install or portable USB Field Kit (`GetDriveTypeW` auto-detection) with 0 bytes of cloud telemetry.

Pair with 🌲 Alaska Vault™ Data Fortress →

🎖️ Flagship C2 / SOC Product • 27 Linked Workspace Crates • 80 REST Routes

Alaska Command (`alaskacommand`)

Alaska Command is Dubay Tech's central tactical SOC router and multi-crate orchestration product. Compiled into a single binary with an embedded 5,600-line Tactical HUD (`src/tactical_hud.rs`), it merges 27 specialized Rust crates and 80 REST API endpoints into one unified command deck—complete with live MITRE ATT&CK (`src/matrices/mitre.rs`) and NIST 800-53 evaluation matrices.

⚡ Sub-1ms Host Airlock (`alaskaairlock`)

Isolates compromised endpoints at the Windows Filtering Platform (WFP) boundary via `/api/airlock/isolate` while maintaining local SOC command access.

🔄 VSS & CoW Rollback (`alaskarecover`)

Protects Volume Shadow Copies and executes sub-second Copy-on-Write directory recovery (`/api/recover/status`) after canary containment.

🎯 Purple Team Drills (`alaskadrill`)

Built-in `PurpleTeamEngine` runs non-destructive MITRE ATT&CK simulations (`T1087`, `T1082`) to prove tripwires and alarms are 100% operational.

🧠 Offline DFIR AI Copilot (`alaskacopilot`)

Explains MITRE TTPs (`/api/copilot/explain/:ttp`), translates Sigma rules to KQL/Splunk/PowerShell (`alaskasigma`), and decodes XOR payloads (`alaskadecode`).

💡 Hint: Why & How Alaska Command Unites 27 Crates in One Binary (Windows + Linux)

Why Pure Rust: Traditional SOC stacks require 6+ separate agents, Elasticsearch clusters, and gigabytes of JVM RAM. Alaska Command links all 27 crates at compile time into one native binary with zero inter-process serialization overhead.

How It Executes: Launch in dual-mode (`launch_dual_mode` in `src/main.rs`) to start the background Axum server and native desktop window simultaneously, or run headless via `--daemon` on Windows Server and Linux fleets.

🐝 View Integrated AISwarm Reactor → 🛒 Self-Serve Checkout + Rugged SSD on MyAlaska.me ($399+) ↗

alaskacommand • 27 Linked Crates 80 REST ROUTES

anvaya-canary15 routes (/api/canary/*)

alaskacase7 routes (/api/cases/:id/seal)

alaskasinkhole6 routes (DNS DGA Radar)

alaskaharden6 routes (CIS Benchmarks)

alaskagate & alaskaledger10 routes (mTLS & Merkle)

alaskasigma & alaskabeacon10 routes (KQL/Splunk/Heartbeat)

alaskahunt & alaskaairlock8 routes (Hunt & WFP Isolate)

alaskasbom & anvaya-ai9 routes (CycloneDX & AI)

alaskadrill, decode, copilot9 routes (Purple Team/XOR)

alaskanet, recover, kernelCore Socket/VSS/ETW Engines

🛡️ Active Endpoint EDR Guardian • 13 Linked Crates • STIX 2.1 & SARIF Output

Alaska Sentinel (`alaskasentinel`)

Alaska Sentinel is our lightweight, zero-DLL endpoint detection, forensic audit, and threat fusion product (`AlaskaSentinelFusionEngine` in `src/fusion.rs`). It combines active canary containment with deep Windows EVTX Sigma log hunting, File Integrity Monitoring, Prefetch MAM XPRESS decompression, and network recon auditing.

📜 EVTX Sigma & Timeline Engine

`evtx_sigma_engine.rs` & `timeline_engine.rs` evaluate Windows Event Logs against built-in Sigma rules and construct chronological incident timelines.

🔒 File Integrity Monitor (`fim_auditor`)

Computes cryptographic `FimBaseline` records and flags unauthorized binary, config, or system file tampering in real time.

🧬 Artifact Studio & PCAP Inspector

Decompresses Windows 10/11 MAM XPRESS Prefetch files (`decompress_prefetch_mam`) and inspects raw packet captures (`pcap_inspector.rs`).

☁️ Cloud AWS, Email SPF/DMARC & LAN Recon

Includes `cloud_aws_auditor.rs` (IAM/S3), `email_sec_auditor.rs` (SPF/DMARC), `lan_sweeper.rs`, and `port_scanner.rs` with SARIF & STIX 2.1 export.

💡 Hint: How Alaska Sentinel Runs on Both Windows Services & Linux Systemd

`src/service.rs` includes both native Windows Service control (`my_service_main`) and automated Linux `systemd` unit generation (`generate_systemd_unit`) with `LinuxFirewallKind` detection (`nftables`/`iptables`/`ufw`).

🛒 Configure Sentinel + Rugged Drive on MyAlaska.me ↗

alaskasentinel • 13 Linked Crates ZERO-DLL EDR

1. anvaya-audit-forensics: EVTX Sigma, FIM, Prefetch MAM, PCAP

2. anvaya-audit-system: `ProcessTreeAuditor` & live process hierarchy

3. anvaya-audit-recon: AWS IAM/S3, Email SPF/DMARC, CIDR LAN Sweeper

4. anvaya-audit-report & core: STIX 2.1 bundles & SARIF 2.1.0 logs

5. anvaya-canary & anvaya-ai: 15 Canary routes + 5 AI Sentinel routes

6. anvaya-mobile-core: QR `HandoverTokenManager` & BLAKE3 dedup

🔬 Deep Live Memory & DFIR Workstation • 35+ Forensic Endpoints

Alaska Forensics (`alaskaforensics`)

Alaska Forensics is our specialized incident response and live memory triage workstation. Designed to run either installed or directly from a hardware write-blocked Rugged FIPS USB drive, it gives investigators immediate visibility into volatile RAM, process hollowing, PE headers, YARA signatures, and CISA KEV vulnerabilities.

🧠 Driverless Live RAM Minidumps

Captures full process memory dumps (`/api/memory/dump/:pid`) and suspends/resumes malicious threads (`/api/process/:pid/suspend`) without unstable kernel drivers.

🔍 PE Header, YARA & Entropy Hunter

Analyzes Portable Executable imports/sections (`/api/pe/analyze`), runs in-memory YARA scans (`/api/yara/scan`), and hunts high-entropy hollow processes (`alaskahunt`).

⚖️ Sealed Court-Admissible Cases (`alaskacase`)

Tracks every forensic artifact in a tamper-evident chain of custody and seals the case (`/api/cases/:id/seal`) with BLAKE3 & Ed25519 signatures.

🛡️ CISA KEV & MITRE Layer Exporter

Cross-references findings against the CISA Known Exploited Vulnerabilities catalog (`/api/cisa/kev`) and exports MITRE ATT&CK Navigator JSON layers.

🛒 Configure Forensics Field Kit ($499+) on MyAlaska.me ↗

alaskaforensics • Live Triage API COURT-READY

POST /api/memory/dump/:pidRAM Minidump

POST /api/process/:pid/suspendThread Freeze

POST /api/pe/analyzePE Section Audit

POST /api/yara/scanYARA Pattern Match

GET /api/persistenceAutorun & Registry

POST /api/cisa/kevCISA KEV Triage

POST /api/cases/:id/sealEd25519 Case Seal

🐤 Proactive Ransomware Trap & Key Extractor • `anvaya-canary` (`canaryd`)

Alaska Canary (`anvaya-canary`)

Alaska Canary turns the tables on ransomware and lateral intruders. Instead of guessing whether a binary is malicious, Alaska Canary plants high-value Alphabetical Sandwich honeyfiles, Registry tripwires, Lure credentials, and Network decoy listeners. The microsecond an unauthorized process touches a decoy, it extracts the ransomware's encryption keys from RAM and freezes the process.

🥪 Alphabetical Sandwich (`alphabetical.rs`)

Deploys realistic decoys sorting first (`!00_passwords.xlsx`) and last (`zz_vault_keys.kdbx`) in every protected folder so directory-walking ransomware hits a trap on file #1.

🔑 Driverless RAM Key Extraction & Freeze

`memory_forensics.rs` invokes `MiniDumpWriteDump` + `scan_memory_keys` to salvage in-RAM AES/ChaCha keys while `freeze.rs` suspends the process via `NtSuspendProcess`.

🌐 5 Network Decoy Listeners (`src/network/*`)

Spawns zero-false-positive honeypot listeners for `RDP` (`rdp.rs`), `SMB` (`smb.rs`), `SSH` (`ssh.rs`), `Database` (`database.rs`), and `Web Portal` (`web_portal.rs`).

🪪 Cloud, WinCred & Document Lure Tokens

Generates `AwsCanaryKey` (`cloud_keys.rs`), `WindowsCredLure` (`cred_manager.rs`), `DatabaseCanaryRow`, and PDF/Office Webbug tokens (`pdf_token.rs`, `office_doc.rs`).

🪤 Launch Interactive Canary Simulator on MyAlaska.me ($149) ↗

anvaya-canary • Sub-1ms Containment 15 REST ROUTES

• deploy_alphabetical_sandwich() (!00_ & zz_)

• spawn_rdp / smb / ssh / db_decoy()

• generate_aws_canary_key() & WinCredLure

• dump_process_memory_driverless()

• scan_memory_keys() + freeze_process()

• GET /api/canary/insurance-certificate

The Alaska Pure-Rust Cyber Arsenal:
Command • Sentinel • Forensics • Canary

Alaska Command (`alaskacommand`)

Alaska Sentinel (`alaskasentinel`)

Alaska Forensics (`alaskaforensics`)

Alaska Canary (`anvaya-canary`)

Sovereign Rust Architecture & Fleet Rollout Guide

📋 Top 3 Deployment Steps (Home, Clinic & Indie ISV)

Offline "3:00 AM Panic Playbooks" — Sub-Millisecond Containment

Request License or Hardware BOM

The Alaska Pure-Rust Cyber Arsenal: Command • Sentinel • Forensics • Canary

Alaska Command (`alaskacommand`)

Alaska Sentinel (`alaskasentinel`)

Alaska Forensics (`alaskaforensics`)

Alaska Canary (`anvaya-canary`)

Sovereign Rust Architecture & Fleet Rollout Guide

📋 Top 3 Deployment Steps (Home, Clinic & Indie ISV)

Offline "3:00 AM Panic Playbooks" — Sub-Millisecond Containment

Request License or Hardware BOM

The Alaska Pure-Rust Cyber Arsenal:
Command • Sentinel • Forensics • Canary