Windows security sensor for real-time threat detection, using system-event monitoring and behavioral rules with memory scanning, forensic replay, and extensible multi-destination output for defenders.