SmokeMont Egress
Validate outbound network behavior from a Windows endpoint across DNS, HTTPS, WebSocket, UDP/443, HTTP/2, HTTP/3-style probes, and SSH-over-443 paths.
Windows portable | AGPLv3 source license | reserved SmokeMont branding
Authorized security validation
Portable Windows security tools for field operators.
SmokeMont packages three native Windows utilities for authorized teams: validate outbound paths with Egress, review endpoint appearance with Persona, and collect incident material with Material.
Products
Each SmokeMont app is a portable native executable with explicit operator action, clear evidence, and no service install workflow.
SmokeMont Persona
Assess endpoint appearance with profile fit scoring, local network fingerprint reporting, public egress identity review, session comparison, and PDF reporting.
Windows portable | AGPLv3 source license | reserved SmokeMont branding
SmokeMont Material
Collect read-only incident-response material from a Windows endpoint, including system identity, network posture, processes, startup entries, services, and recent event-log signals.
Windows portable | AGPLv3 source license | reserved SmokeMont branding
SmokeMont Egress
Egress validates what can leave a Windows endpoint through controlled, benign probes across common outbound paths.
Path validationRun DNS, HTTPS, WebSocket, UDP/443, HTTP/2 target, HTTP/3-style UDP/443, and SSH-over-443 checks.
Adapter controlUse automatic routing or bind checks to a specific IPv4 adapter for clearer path attribution.
Run evidenceCapture endpoint profile, target, adapter, status, timing, evidence tier, and exportable Markdown/PDF reports.
SmokeMont Material
Material helps responders gather host evidence quickly during authorized triage without installing an agent or changing endpoint configuration.
Local collectionGather system identity, adapters, DNS, gateways, TCP summary, running processes, startup entries, services, and recent event-log warnings or errors.
Case contextAttach case name, analyst, location, notes, collection depth, timestamps, and a report identifier to each collection run.
Evidence packageExport Markdown or PDF reports with category filtering, review counts, alert counts, and latest-run comparison.
Material is observational software. It does not remediate, quarantine, terminate processes, delete files, or modify host configuration.
SmokeMont Persona
Persona helps operators answer a practical security question: from local configuration, traffic metadata, and public egress identity, what does this endpoint appear to be?
Profile scoringCompare observed endpoint traits against Corporate Windows Laptop, MacBook Business Person, Android Phone, iPad, and Thin Client profiles.
Posture reviewReview OS family, hostname context, adapters, private IPs, gateways, DNS servers, public IP, network owner, and approximate region.
Evidence packageExport a PDF report with engagement metadata, fit score, latest-run comparison, generated profile traits, and safety boundaries.
Persona is observational software. It does not spoof, randomize, or mutate host settings; it provides a shared evidence trail for endpoint identity, exposure, and engagement reporting.
Downloads
Current official SmokeMont Windows builds are available as portable executables. Always run tools only on systems and networks where you have permission.
Capabilities
Across all three tools, SmokeMont emphasizes controlled execution, field portability, and reporting that stands up in technical review.
Controlled Operation
Actions run only after explicit operator input, with visible scope and conservative collection behavior.
Evidence-Driven Output
Reports document selected modes, observed signals, result meaning, timestamps, and operator context.
Portable Deployment
Native Windows executables support field use on authorized systems without a service install or heavyweight runtime workflow.
Brand Integrity
Official SmokeMont releases use reserved branding so teams can distinguish maintained builds from modified internal versions.
License And Branding
SmokeMont code is licensed under the GNU AGPLv3. The SmokeMont name, logo, icon, and related branding are reserved so users can distinguish official releases from modified builds.