Sift — Open-Source Secrets/Credential Scanner

What it is

Sift (Stratus Security) is a Native AOT secrets/credential scanner and Snaffler replacement, run from sift.exe with per-source subcommands: local, domain, network, m365, slack, atlassian, and analyze. The summary names the sources and features; the page adds the operational detail an operator needs to actually run it and author rules.

What to do

Core invocations verbatim from the page:

.\sift.exe local --path C:\
.\sift.exe network --device SRV01 --output srv01-findings.log
.\sift.exe domain --username pentester --password '<password>' --domain CONTOSO --domain-controller 10.0.0.10
.\sift.exe network --subnet 10.0.0.0/24 --username Administrator --password '<password>' --local --output findings.log

Pass-the-hash (NTLMv2), keeping the hash out of shell history/process args:

$env:SIFT_NT_HASH = Read-Host 'NT hash' -MaskInput
.\sift.exe network --device 10.0.0.25 --username Administrator --nt-hash-env SIFT_NT_HASH --local --output findings.log
Remove-Item Env:SIFT_NT_HASH

Scan once, then re-run LLM validation offline elsewhere (findings never leave for a cloud API — Ollama only):

.\sift.exe local --path C:\ --output findings.json --output-format json
.\sift.exe analyze --input findings.json --llm-validate --ollama-model gemma4:31b --sensitive-only --output findings.log

Throttle on sensitive production targets: --threads 8 --max-read-mib-per-second 32 (throughput is unlimited by default). Use --enum-only to list shares/roots without reading content, and --resume (same command + output path) to continue a checkpointed scan.

Preconditions / Affected

• Pass-the-hash scope is limited. PtH via explicit NTLMv2 works only for network --device and network --subnet. The domain command discovers hosts through LDAP and still requires a password, Kerberos ticket, or the current Windows identity.
• NT hash only. Sift rejects LM hashes, LM:NT pairs, NetNTLM challenge-responses, and Kerberos keys — supply a 32-char NT hash.
• Kerberos strict mode (-k) rejects the default per-host NTLM fallback and requires DNS hostnames for SPNs.
• Cross-platform (macOS/Windows/Linux) but with "varying feature support."

Rule authoring gotchas (the part most likely to bite)

• A custom --rules directory replaces the bundled catalogue entirely — it is not additive. Include every sifting and ignore rule you want; if no sifting rules load, Sift silently falls back to bundled defaults.
• Content regexes run on .NET's non-backtracking engine with a one-second match timeout; avoid .* over large regions. The whole match is the reported evidence — capture groups don't narrow it.
• Keywords are a pre-filter optimisation, not evidence; a bad keyword can suppress valid matches.
• New Validator checks (checksums, token structure) require a code change — JSON cannot load executable code, only built-in names from ClassifierValidatorCatalog.
• Ignore rules and path scopes use filesystem wildcards (*, ?, classes), not regex, and run before content is read; directory/path/share ignores prune whole branches, so test broad patterns.

Caveats

• Release binaries are not code-signed — verify downloads against SHA256SUMS.txt.
• Licensed AGPL-3.0-only.
• Binary-file (e.g., Word) support is opt-in (-b) and "isn't perfect yet."
• Benchmark claims ("fastest and most effective") are vendor self-tests: Snaffler was patched to report completion immediately for the comparison, dated 24 August 2026; the actual measured numbers aren't in this text.