Default checks require Python 3.8 or newer, no administrator and no added packages.

Single file (simplest): download zero-breach.py, verify it using the release checksums, then open a terminal in the download folder. On Windows use python; on macOS or Linux use python3 in place of python in the commands below.

python -X utf8 zero-breach.py            # full scan
python -X utf8 zero-breach.py --quick    # faster; skips file fingerprinting
python -X utf8 zero-breach.py --json report.json

Optional Candiru file patterns: Download requirements-patterns.txt from the same release as the scanner. This mode needs Python 3.9 or newer. From the folder containing both downloads, make a separate Python environment and install the hash-pinned YARA-X wheel:

# Windows PowerShell
python -m venv .venv
.venv\Scripts\python.exe -m pip install -r requirements-patterns.txt
.venv\Scripts\python.exe -X utf8 zero-breach.py --patterns

# macOS / Linux
python3 -m venv .venv
.venv/bin/python -m pip install -r requirements-patterns.txt
.venv/bin/python -X utf8 zero-breach.py --patterns

--pattern-path ABSOLUTE_PATH limits this extra file check to a chosen local file or folder; it can be repeated. The normal browser, hash and host checks keep their usual scope. Pattern matches are leads for investigation, not proof of an active infection. A no-match result cannot rule out Candiru or other spyware. Without --pattern-path, the optional check first examines up to 128 safe local files named by per-user Windows COM registrations, then its usual file roots. A COM registration by itself is not a spyware finding. The two published rules only apply to files smaller than about 1 MB, so larger files remain outside their detection scope.

On Windows, the DNS-history check reads up to the newest 50,000 retained events. If older retained records remain, the report marks that history as partial rather than complete. This does not turn on logging or recover events that were never recorded.

From source:

python -X utf8 scan/adint-scan.py

The scan changes no system settings and needs no administrator. It makes no intentional network requests or indicator lookups. Redirected paths and Windows remote drives are skipped, and online certificate verification is disabled. On POSIX, network mounts can still be read through ordinary filesystem calls. Locked database snapshots are temporary; cleanup is attempted after use, and any cleanup failure is reported with the retained location. --json writes the requested report.

Exit codes: 0 nothing found, 2 an indicator matched, 1 the scan could not be set up (e.g. a bad indicator file).