$ show SpecterOps/Nemesis
Nemesis is an offensive security data processing platform by SpecterOps that ingests, enriches, analyzes, and alerts on files collected during red team and DFIR operations. The system is architected as a suite of microservices orchestrated via Dapr (pub/sub, workflows, state management), with services implemented in Python (FastAPI), Go (Titus secret scanner), and C# (ILSpy .NET decompiler). Key data flows: files are ingested via a CLI (supporting Cobalt Strike, Mythic, Outflank connectors) or REST API, then processed through a Dapr workflow that performs basic analysis (magic, hashes), runs pluggable enrichment modules (PE, .NET, Chromium/DPAPI decryption, YARA, SQLite, containers), invokes the Titus secret scanner, and finally publishes findings and alerts. A React frontend with Hasura GraphQL provides a dashboard for file browsing, enrichment status, YARA management, LLM-based triage agents, and reporting. The platform is deployment-agnostic with Docker Compose and Helm charts for k8s. Notable technical depth includes a standalone DPAPI decryption library (nemesis_dpapi) with multiple storage backends and write-once semantics, a rule-based file linking engine, and an AI agent framework using pydantic-ai and LiteLLM.
The LLM identified 4 files worth highlighting for reuse:
A standalone DPAPI decryption library with multiple storage backends (in-memory, PostgreSQL), write-once enforcement, event-driven retroactive decryption, and a clean protocol-based design. It can be extracted and reused in any project needing Windows DPAPI key management and blob decryption.
A collection of pluggable enrichment modules following a consistent interface (should_process/process). Each module can be independently developed and tested. Includes a reusable test harness that mimics storage and database dependencies, enabling isolated module testing without external infrastructure.
A YAML-driven rule engine that defines triggers and linked file patterns for forensic artifact correlation. Supports both forward and backward placeholder resolution (e.g., <WINDOWS_USERNAME>). This pattern is reusable for any evidence linking use case.
A durable workflow tracking service that persists workflow lifecycle (status, enrichment results) to PostgreSQL. Provides methods to update, query, and purge stale workflows. This component encapsulates Dapr workflow monitoring logic and can be reused in other Dapr-based orchestrations.