This Windows/.NET Framework 4.8 companion implements automatic online collection and automatic installation of relevant vendor security fixes. It does not manufacture blocking rules from arbitrary exploit code.
The installer packages it under {app}\ExploitShield and registers the visible
SentinelExploitShield SYSTEM task: first eligible run about one minute later,
then every four hours. Task Scheduler network/power conditions apply. This is an
explicit online exception; Core, Service and Agent retain their outbound blocks.
The companion uses these fixed HTTPS metadata sources:
- CISA KEV via the official cisagov/kev-data repository.
- Exploit-DB's CSV index via its official GitLab repository.
- The nomi-sec/PoC-in-GitHub repository's GitHub tree index (third-party metadata).
Only CVE identifiers are used for selection. PoC payloads, repository scripts, arbitrary URLs, feed-provided commands and unsigned detection rules are not run. Public metadata is incomplete and can be mistaken or poisoned; it can only select among applicable security updates supplied by the machine's configured Windows Update/WSUS policy. Microsoft/vendor package verification remains Windows Update's responsibility. Third-party software outside that catalog is not automatically patched or reliably assessed by this module.
For each cycle, the companion downloads bounded metadata (32 MiB/source, 60 seconds/source, redirects rejected). KEV older than fourteen days, truncated GitHub indexes and malformed catalogs are rejected. A failed source is logged; other validated sources can still select updates, but the run reports degraded coverage. If all sources fail, no update is authorized. No persistent feed cache can silently authorize stale changes.
Windows Update supplies the installed-version applicability assessment and update CVE IDs. Only applicable, nonhidden software updates in its Security Updates classification with an explicit CVE intersection qualify. KEV matches go first. Before downloading/installing, the adapter rechecks applicability, exact update ID/revision, CVE intersection, classification, accepted EULA and noninteractive installation behavior. It does not accept new EULAs, override WSUS policy, install drivers, force updates, or select packages by title/filename. These are proactive vendor fixes, separate from Sentinel's Tier1/Tier2 process-response pipeline.
An administrator-only durable audit record is required before download/install.
Downloads and quiet installation use native Windows Update Agent COM APIs, not
shell commands or feed download links. The companion never requests a reboot;
existing Windows restart policy remains outside its control. A pending reboot is
not reported as remediation. After installation it queries installed state again;
only full success, exact revision read-back and no pending reboot produce
InstalledVerified. Even then the claim applies to that update, not all exploits.
Unmatched CVEs are unassessed: they may be irrelevant, already patched, affect unsupported software or have no available fix. A PoC lacking a CVE is counted as unmapped and cannot drive remediation. A zero-fix cycle is never proof that the machine is safe. There is no arbitrary-blog crawler, general CPE/version matcher, zero-day patch generator, or automatic new behavioral-rule authoring.
From an elevated terminal in the installed ExploitShield directory:
.\Sentinel.ExploitShield.exe --preview
.\Sentinel.ExploitShield.exe --apply
.\Sentinel.ExploitShield.exe --install
.\Sentinel.ExploitShield.exe --uninstall
.\Sentinel.ExploitShield.exe --health--preview fetches metadata and scans applicability without installing fixes.
--health probes local WUA history and protected audit access without fetching
feeds, scanning applicability, downloading, or installing an update.
--apply installs qualifying fixes automatically. --install registers the
four-hour task; --uninstall disables/stops/removes it without undoing vendor
security updates. Upgrade stops the old task before replacing files. Scheduler
registration requires trusted ownership and restrictive write ACLs under either
Program Files root; custom writable installation locations are rejected visibly.
Audit: %ProgramData%\SentinelExploitShield\activity.jsonl (20 MiB, three retained
rotations, SYSTEM/Administrators access). It records source failures, decisions,
update IDs, outcomes and outstanding reboot/manual requirements. The tool does
not modify the monitoring dashboard's protection status. A protected file lock
serializes runs. Exit 0 means the cycle completed, not universal protection;
2 means degraded feeds or unresolved applicable fixes, 1 a failed cycle, and 130
cancellation. Preview may also return 2 for degraded feeds. Windows Update's
synchronous COM operations cannot be interrupted safely mid-operation; cancellation
prevents the next operation. Scheduler's two-hour limit bounds the companion,
but an update already handed to Windows Update can continue after it exits.
Validation: the solution cross-build and inert/mocked regression checks can run on Linux. Real metadata has been retrieved and parsed from KEV and Exploit-DB. Native CI exercises actual WUA history access, protected SYSTEM task enrollment, execution and removal, audit permissions and rejection of writable install paths. Installation success/failure/reboot/revalidation paths use automation-object tests; no OS update is installed by CI. Target-machine patch installation/reboot and full installer lifecycle remain operational validation limits. No live PoC was executed and no machine was patched in this cloud session.