No AI answers. No uploads. Just the references.
A wrong description, a command it does not know, a rule that should or should not match: say what you expected. This page sends nothing. The report opens in your mail app, where you read it before you send it.
Chains, wrappers such as cmd /c and sudo, and scripts are split into the processes they would start. Each option is quoted from the program's reference.
-EncodedCommand is decoded and read too. Backticks inside words, split strings and cmd's carets are undone.
AWS, Azure, docker and kubectl commands, and NetScaler ADC, FortiOS, Cisco IOS XE and Junos configuration lines.
LOLBAS and GTFOBins abuse, 1,614 Sigma process creation rules with their authors, and MITRE ATT&CK techniques.
No AI writes any result: every description is quoted from documentation written by people, every verdict is a public Sigma rule, and it all runs in your browser. The identifier is the identify() verb of Ceplin, a terminal for security triage, compiled to run in this page. In Ceplin, the URLs and addresses it finds go straight on to reputation, DNS and hosting lookups. Sources and licences lists where every description comes from, and the programs pages explain each of the 722 programs LOLBAS and GTFOBins list.