// runnable playbook

stalkerware sweep (mobile)

covertly installed monitoring apps on a personal phone. iOS + android are very different surfaces: hidden config profiles + pairing records on iOS, sideloaded APKs + accessibility-abuse on android.

a guided path, not automation — each step opens a tool you run yourself; nothing uploads. progress is saved only in this browser.

// based on the curated pipeline

wraps the stalkerware sweep — multi-source correlator preset — drop artifact bundles from multiple tools → correlate shared IOCs → draft case report

methodology guide →worked example →full tool list + 1 more pipeline →

guided steps

0/5 done

01
evidence manifest generator
hash every bundle so the source set is reproducible
open tool →methodology
your note (local only)
02
ioc deduplicator and normalizer
merge + dedupe IOCs across all artifact bundles
suggested options · lowercase: true · dropPrivate: false
open tool →methodology
your note (local only)
03
multi-artifact correlator
surface IOCs that appear in more than one bundle
open tool →methodology
your note (local only)
04
ioc bulk validator & triage
triage shared IOCs by severity
open tool →methodology
your note (local only)
05
case report generator
draft a report linking shared indicators to the suspect device
suggested options · title: stalkerware sweep
open tool →methodology
your note (local only)

when you're done

export a run summary — a small JSON record of which steps you marked done, your notes, and a self-hash so the record can't be silently altered. it is your reproducibility note, not a per-tool receipt: each tool emits its own input→output receipt when you run it.