Stop hiring
the subscription
not the candidate.

// Sentinel Windows Detection Engine
// Toolhelp32Snapshot — enumerate all processes
var snap = CreateToolhelp32Snapshot(
  TH32CS_SNAPPROCESS, 0);

// Check process name against threat DB
foreach (var proc in GetProcessList(snap)) {
  if (ThreatDB.IsKnownSignature(proc.Name))
    RaiseViolation(proc, Severity.Critical);

  // Detect system-name spoofing
  if (WindowsSystemNames.Contains(proc.Name)
    && !IsLegitSystemProcess(proc))
    RaiseViolation(proc, Severity.Critical);
}

// EnumWindows — scan for invisible overlays
EnumWindows((hwnd, _) => {
  var style = GetWindowLong(hwnd, GWL_EXSTYLE);
  // Flag WS_EX_LAYERED + WS_EX_TRANSPARENT combo
  if (style.HasFlag(WS_EX_LAYERED) &&
      style.HasFlag(WS_EX_TRANSPARENT))
    FlagOverlayWindow(hwnd);

  // Check DWM composition bypass
  if (IsDxgiOverlay(hwnd))
    RaiseViolation(hwnd, Severity.Critical);
}, IntPtr.Zero);

// Virtual audio driver detection
var audioDevs = MMDeviceEnumerator
  .EnumerateAudioEndPoints(DataFlow.Capture);
foreach (var dev in audioDevs)
  if (VirtualAudioSignatures.Match(dev.DeviceID))
    RaiseViolation(dev, Severity.Critical);