Changelog

Highlights

Boot integrity auditing

• Adds a dedicated Boot Integrity audit covering Secure Boot, virtualization-based security (VBS), Hypervisor-Protected Code Integrity (HVCI), Kernel DMA Protection, test-signing, and kernel debugging state.

Reliability and CI hardening

• Repairs and bounds end-to-end audit smoke checks, including JSON validation, executable resolution, valid native exit-code handling, and fast module scoping.
• Restores Docker builds by limiting restore to the CLI and Service projects.
• Guards Threat Feed UI filtering during XAML initialization.

Maintenance

• Updates MinVer, test/coverage dependencies, and GitHub Actions dependencies.
• Synchronizes documentation with the 53-module audit catalog.

What's Changed

• deps(actions)(deps): bump actions/labeler from 6 to 7 by @dependabot[bot] in https://github.com/sauravbhattacharya001/WinSentinel/pull/248
• deps(actions)(deps): bump actions/stale from 10 to 11 by @dependabot[bot] in https://github.com/sauravbhattacharya001/WinSentinel/pull/249
• deps(nuget): Bump MinVer from 7.0.0 to 8.0.0 by @dependabot[bot] in https://github.com/sauravbhattacharya001/WinSentinel/pull/252
• deps(nuget): Bump coverlet.collector and 2 others by @dependabot[bot] in https://github.com/sauravbhattacharya001/WinSentinel/pull/253
• deps(nuget): Bump coverlet.collector and 2 others by @dependabot[bot] in https://github.com/sauravbhattacharya001/WinSentinel/pull/254
• fix(docker): restore only CLI/Service projects to fix Docker Build by @sauravbhattacharya001 in https://github.com/sauravbhattacharya001/WinSentinel/pull/255

Full Changelog: https://github.com/sauravbhattacharya001/WinSentinel/compare/v1.24.0...v1.25.0

WinSentinel v1.24.0

This release adds a large batch of new single-machine hardening audit modules and wires several previously-orphaned analyzers into --audit, plus test coverage and CLI fixes.

New audit modules

• Remote access & sessions: Remote Desktop (RDP) hardening, Automatic Sign-On (ARSO), Interactive Logon (logon banner + smart-card removal), Session Lock, Remote Access.
• Credential & LSA hardening: Credential Protection (LSA Protection / Credential Guard / WDigest), Kerberos encryption-type hardening, LSA inbound/outbound NTLM restriction, blank-password remote logon check, Windows Hello for Business posture.
• Attack-surface reduction: Print Spooler / PrintNightmare, Exploit Mitigation (SEHOP/ASLR/DEP), Diagnostics Hardening (MSDT / Follina), Optional Features (SMB1, PowerShell 2.0, Telnet, TFTP), Windows Recall, Attachment Manager / Mark-of-the-Web, Advanced Audit Policy.
• Network posture: Name Resolution poisoning (LLMNR/NBT-NS/mDNS/WPAD), NetBIOS node type (P-node), Firewall Logging, exposed dev database/cache ports (PostgreSQL, MySQL, Redis, MongoDB, Elasticsearch, Memcached).
• Defender & reputation: Defender Network Protection, SmartScreen reputation, Delivery Optimization, Hosts File Integrity, Time Synchronization, Office macro security.

Wiring / engine

• Registered previously-orphaned modules so they actually run in --audit: BackupAudit, RemoteAccessAudit, LsaHardening, WindowsScriptHost, WindowsInstaller, OfficeMacroSecurity, and 5 more.
• Deep per-rule firewall analysis now runs in live --audit.
• PowerShell audit now detects service-install / Run-key persistence and Enter-PSSession in profile scans.

Fixes & tests

• CLI: single source of truth for supported export formats.
• Host-state-independent SMB/NetBIOS checks.
• Added unit tests for RegistryHelper, SignatureHelper Authenticode graceful-failure, WindowsScriptHost and WindowsInstaller analyzers.

Full Changelog: https://github.com/sauravbhattacharya001/WinSentinel/compare/v1.23.0...v1.24.0

Full Changelog: https://github.com/sauravbhattacharya001/WinSentinel/compare/v1.23.0...v1.24.0

WinSentinel v1.23.0

Thirty-nine new single-machine security audit improvements since v1.22.0 — a large batch of new Free/OSS analyzers and hardening checks.

New audit modules

• Windows Error Reporting (WER) exposure audit
• Application Control (AppLocker/WDAC) audit
• UAC hardening audit
• Windows Installer (MSI) hardening analyzer
• Print Spooler / PrintNightmare hardening analyzer
• Windows Script Host (WSH) hardening analyzer (incl. per-user HKCU override bypass detection)
• WinRM / WS-Man single-machine hardening analyzer (wired into live --audit)
• SMB security hardening analyzer (CIS L1, wired into live --audit)
• ScreenLock session-lock hardening (CIS L1); flags passwordless console logon
• Office macro posture analyzer
• Windows Recall privacy posture analyzer
• LSA / credential-protection single-machine hardening analyzer

New / expanded checks

• LSA hardening: anonymous null-session access (RestrictAnonymous/…), NTLMv2 enforcement (LmCompatibilityLevel)
• SMB: null-session access, server encryption (EncryptData) requirement
• PowerShell: +8 profile LOLBin/defense-evasion tokens, script block invocation logging, persisted __PSLockdownPolicy CLM bypass, admin-group/shadow-copy/log-clearing/LSASS-dumping tooling detection
• Firewall: per-profile dropped-packet logging, undersized log trap, default outbound policy
• Network posture: TCP SYN-ACK & data retransmit caps (CIS MSS)
• Encryption: UEFI Secure Boot posture, hibernation/Fast Startup RAM-at-rest exposure
• Identity: Guest account state (CIS L1 2.3.1.1), LM/NTLM auth level
• Remote access: SSH TCP forwarding + GatewayPorts exposure; installed RMM/remote-access tool detection (T1219)
• Browser: DNS-over-HTTPS disabled by policy
• USB: removable-disk read-access restriction
• Event Log: audit-policy-change detection (Event ID 4719)

Reporting

• SARIF: real Core version, helpUri, and partialFingerprints

NuGet (WinSentinel.Cli / WinSentinel.Core) and GitHub Release assets (MSIX + portable/service ZIPs) publish automatically from this tag.

Full Changelog: https://github.com/sauravbhattacharya001/WinSentinel/compare/v1.22.0...v1.23.0

WinSentinel v1.22.0

This release ships 43 commits of new audit coverage and hardening since v1.21.0, expanding detection across network posture, PowerShell abuse, identity, and encryption.

Network posture hardening

• New checks: SMB client-side signing requirement, ICMP redirect acceptance, ICMP Router Discovery (IRDP), Dead Gateway Detection, IPv4/IPv6 source-routing acceptance, NetBIOS Name-Release-on-Demand.
• Detect active 6to4 / ISATAP IPv6 transition tunnels and add mDNS poisoning as a 4th spoofing vector (alongside LLMNR/NBT-NS/WPAD).
• Distinguish network-exposed high-risk ports from loopback-only listeners.

PowerShell & profile abuse detection

• Detect WMI/scheduled-task persistence, LOLBin execution/fetch, reverse shells, inline execution-policy bypass, and in-memory loaders in profile scripts.
• Flag AMSI reflection/kill-switch bypass (AmsiEnable=0), native-API injection, and offensive toolkit tokens (Mimikatz/Shellcode/PowerSploit).
• Audit WinRM CredSSP, Basic auth, and AllowUnencrypted plaintext transport.
• Add Protected Event Logging check; flag module logging with incomplete ModuleNames coverage and transcription without invocation headers (CIS L1).

Identity & credential protection

• Audit WDigest cleartext credential caching (UseLogonCredential).
• Correct RunAsPPL UEFI-lock semantics and recognize UEFI-locked LSA Protection; describe LSA Protection + Credential Guard.
• Registry: flag built-in Administrator bypassing UAC (FilterAdministratorToken).

Encryption

• Audit SChannel Diffie-Hellman minimum key length (Logjam) and Kernel DMA Protection.
• Flag weak BitLocker method on fully-encrypted drives; tier weak TLS cipher suites by severity (explicit 3DES/Sweet32).

Other checks & hardening

• Certificate audit: detect not-yet-valid certs; fix weak-algo thumbprint interpolation.
• Firewall: extract pure FirewallAnalyzer, detect wide-open inbound allow rules.
• Event logs: detect new account creation, privileged group additions, and successful remote logons from external IPs (4624 Type 3/10).
• Scheduled tasks: flag signed interpreters launching writable scripts.
• USB: audit WPD/MTP portable-device restriction. AppSecurity: audit MSIX/AppX sideloading & developer-mode. ASR: new Safe Mode + system-tool-impersonation rules. Browser: flag SSLVersionMin forcing TLS 1.0/1.1.

Full Changelog: https://github.com/sauravbhattacharya001/WinSentinel/compare/v1.21.0...v1.22.0

WinSentinel v1.21.0

Five new detections land in this release, expanding coverage across network posture,

Windows servicing, DNS privacy, PowerShell logging, and Microsoft Defender health. All

changes ship with new unit tests.

Network posture hardening

• WPAD auto-discovery poisoning check — NetworkAudit now flags Web Proxy

Auto-Discovery (WPAD) being left enabled, a classic man-in-the-middle vector where an

attacker on the LAN answers WPAD queries to silently redirect a machine's HTTP(S)

traffic through a rogue proxy.

Windows servicing / update health

• End-of-life build detection — UpdateAudit flags Windows installations running an

out-of-support build that no longer receives security updates, so an EOL OS is surfaced

as a finding instead of silently rotting.

DNS privacy

• DoH resolver validation — DnsAudit now flags DNS-over-HTTPS pointed at an

unrecognized / untrusted resolver, catching cases where encrypted DNS is quietly routed

through an unexpected third party.

PowerShell logging fidelity

• Explicitly-disabled vs. unset logging — PowerShell logging analysis now

distinguishes a policy value explicitly set to 0 (logging deliberately turned off)

from a value that is simply absent, reducing false "not configured" noise and correctly

escalating deliberate tamper-down of Script Block / Module logging.

Microsoft Defender health

• Protection-disabled event detection — the event-log analyzer now detects Windows

Defender protection-disabled events (IDs 5001 / 5010 / 5012), surfacing real-time

protection or antivirus/antispyware being switched off — a common precursor to malware

execution.

---

Packages

• WinSentinel.Cli and WinSentinel.Core publish to NuGet.org and GitHub Packages once

the release automation finishes indexing.

• MSIX + portable/service ZIP assets are built and attached by the release workflow.

Full Changelog: https://github.com/sauravbhattacharya001/WinSentinel/compare/v1.20.2...v1.21.0

WinSentinel v1.20.2

This ships the v1.20.0 payload — the ~110-commit hardening batch — as the first release of this line to actually reach NuGet.

What's in this line

• RemoteAccess hardening: RDP / WinRM checks and fixes tightened.
• Microsoft Defender coverage: Attack Surface Reduction (ASR), Controlled Folder Access (CFA), and PUA protection checks.
• Parser hardening across the check pipeline for more robust input handling.
• Dead "Fix" button repairs — several checks whose remediation button was a no-op now actually apply their fix.
• LLMNR FixCommand fix — the LLMNR remediation now runs the correct command.
• Scope reduction: the Pro fleet feature was removed from the OSS core, so this build is single-machine only.

Why v1.20.2 (and not v1.20.0 / v1.20.1)

v1.20.0 and v1.20.1 were tagged but never published to NuGet: the release pipeline re-ran the full test suite as a hard publish gate and tripped on environment-flaky tests (registry / async-timing) on the hosted runners. That redundant gate has been removed — publishing is now build → pack → push, with CI remaining the test gate — so v1.20.2 is the first release of this line to actually publish to NuGet. It supersedes v1.20.0 and v1.20.1, which stay as-is.

Full Changelog: https://github.com/sauravbhattacharya001/WinSentinel/compare/v1.20.1...v1.20.2

WinSentinel v1.20.1

This is a patch release that ships the full v1.20.0 payload plus a fix to the LLMNR remediation so the package actually publishes to NuGet. v1.20.0's own publish step failed on a FixCommand test, so v1.20.1 supersedes it as the installable release.

Fix in this release

• LLMNR remediation now uses PowerShell Set-ItemProperty to write the EnableMulticast DWORD under HKLM\Software\Policies\Microsoft\Windows NT\DNSClient. The previous reg add form failed the FixCommand unit test and blocked the NuGet publish. The remediation behaviour is unchanged; only the command form was corrected so CI is green and the package can ship.

Included from v1.20.0 (110-commit hardening batch)

• RemoteAccess / RDP / WinRM family checks and remediations.
• Microsoft Defender coverage: Attack Surface Reduction (ASR) rules, Controlled Folder Access (CFA), and Potentially Unwanted Application (PUA) protection.
• Parser hardening across the check pipeline for more robust input handling.
• Dead "Fix" button repairs — remediation actions that previously no-oped are now wired up correctly.

Upgrade

dotnet tool update -g WinSentinel
winsentinel --version   # 1.20.1

Full Changelog: https://github.com/sauravbhattacharya001/WinSentinel/compare/v1.20.0...v1.20.1

WinSentinel v1.20.0

A large release: 110 commits since v1.19.1, adding two new audit modules, a broad set of

Remote Access and Microsoft Defender checks, several new CLI commands, and a wide sweep of

analyzer hardening, parser correctness fixes, and Fix-button repairs. Scheduled scans and the

real-time monitor are now free (full single-machine power); Pro is fleet-only.

New audit modules

• Identity & Credentials audit — credential hygiene and identity posture checks.
• USB & Removable Media audit (F6) — removable-storage exposure and policy.

Remote Access hardening

• Audit RDP drive + clipboard and printer + COM/LPT redirection policy.
• Flag RDP session shadowing that allows silent view/control without consent.
• Audit RDP Plug-and-Play device redirection (fDisablePNPRedir) and always-prompt-for-password-on-connect (fPromptForPassword).
• Flag WinRM listeners that accept connections from any source IP.
• Audit WinRM CredSSP delegation and wildcard TrustedHosts.
• Warn on unsolicited Remote Assistance (Offer RA).

Microsoft Defender

• Audit Attack Surface Reduction (ASR) rules with a one-click enable-all fix.
• Audit Controlled Folder Access with a one-click enable fix.
• Audit PUA (potentially-unwanted application) protection.
• Detect tampered profile.ps1 PowerShell persistence (T1546.013).

New CLI commands & UX

• winsentinel diff — standalone posture-diff command.
• winsentinel why — per-finding explanations.
• winsentinel agent — start/stop/status/install/uninstall the background agent.
• winsentinel fleet commands — Pro dispatch-history view (fleet: status, scan-all, push-policy, nodes).
• badge command handler and polished findings export (flag-style formats, smart defaults, CSV).

Compliance

• Added SOC 2 and Essential 8 framework mappings.

Ecosystem & distribution

• GitHub Action for the Marketplace ("winsentinel security audit") plus CI security-audit actions and SARIF/JSON export wiring.
• winget manifest with auto-submission; opt-in telemetry service + CLI command.
• Localization scaffolding (en-US) with Spanish translation wired into severity labels.
• Plugin architecture repurposed as community extensibility (no longer Pro-gated).

Reliability: analyzer extraction + test expansion

• Extracted pure, unit-testable analyzers from their audits — Defender, USB, NetworkPosture,

PowerShellSecurity, BrowserSecurity, Encryption, IdentityCredential, EventLog, ProcessLineage —

plus FleetRequestBuilder and WatchDeltaCalculator.

• Hundreds of new tests across services (KillChain, FlightRecorder, Kpi, Prophecy, Canary,

ThreatHunt, Mentor, Autopsy, MaturityAssessment, AgentService) and audits.

Correctness, parser hardening & Fix-button repairs

• Repaired multiple dead Fix buttons and guarded every analyzer fix command against the

sanitizer so the Fix button actually works; added actionable fixes to Encryption findings.

• Hardened parsers: LLMNR/NetBIOS, SMB/RDP registry flags, listening-ports, IPv6/Teredo,

arp -a lines, and audit-policy/EventLog boundaries.

• Fixed EncryptionAnalyzer BitLocker %/TPM handling, NetworkPosture WPA/cipher classification,

EventLog retention semantics, ComplianceMapper word-boundary matching, ScoreForecaster /

SecurityDecayPredictor / streak/heatmap date-boundary bugs, SARIF rule-ID trailing hyphen,

and CSV formula-injection bypass in export --csv.

_Release assets (MSIX, portable/service ZIPs) are attached by the Release workflow;

WinSentinel.Cli / WinSentinel.Core publish to NuGet.org once the NuGet workflow finishes indexing._

What's Changed

• fix(ci/nuget): wire version_override through MinVerVersionOverride (#225) by @sauravbhattacharya001 in https://github.com/sauravbhattacharya001/WinSentinel/pull/226
• ci: BVT gating, E2E smoke test, coverage PR comments by @sauravbhattacharya001 in https://github.com/sauravbhattacharya001/WinSentinel/pull/227
• feat(plugins): interface guard, fingerprint display, entitlement vocabulary by @sauravbhattacharya001 in https://github.com/sauravbhattacharya001/WinSentinel/pull/228

Full Changelog: https://github.com/sauravbhattacharya001/WinSentinel/compare/v1.19.1...v1.20.0

v1.19.1 — Plugin System Refinements

Follow-up improvements to the community plugin architecture:

• Improved plugin isolation: Plugins load in separate AssemblyLoadContexts for safety
• Better error handling: Graceful degradation when a plugin fails to load
• Plugin validation: Schema checks on plugin manifests before loading
• Documentation: Added plugin authoring guide to the wiki

The plugin system is fully open — no license or paid tier required. Build and share audit plugins freely.

v1.19.0 — Plugin Architecture for Community Extensibility

WinSentinel now supports a fully open plugin architecture. Anyone can write custom audit plugins to extend the security scanning engine:

• Open ecosystem: Write your own audit modules using the IAuditPlugin interface
• Drop-in loading: Place plugin DLLs in the plugins directory — auto-discovered at runtime
• Full API access: Plugins get the same finding/severity/fix infrastructure as built-in modules
• Community-driven: Share plugins via NuGet or GitHub — no gatekeeping, no paid tiers required

This release lays the foundation for a vibrant community of security-focused developers building specialized audit modules for their environments.

Other changes

• Plugin discovery and loading infrastructure
• Plugin manifest schema for metadata and versioning
• Sample plugin template included in the repo

v1.18.0 — Threat Horizon Forecaster + machine-readable --version

A focused minor release that adds one new agentic advisor and finally makes

winsentinel --version safe to call from CI, inventory, and packaging scripts.

✨ New: Threat Horizon Forecast Advisor

ThreatHorizonForecastAdvisor is the sixth agentic sibling alongside

FixOrchestrationPlanner, AlertRoutingAdvisor, AttackerProfileSynthesizer,

PostureRegressionExplainer, and PolicyExceptionRiskAdvisor.

It produces a forward-looking 7-day threat-pressure forecast (0–100) by

blending recent attacker-side recon signals with defender-side posture context:

• Attacker signals (8): port scans, brute-force attempts, IOC matches,

phishing waves, rogue DNS, dark-web mentions, anomalous outbound, etc.

Each contribution is weighted by velocity, freshness, and distinct-source

dedup so a single noisy source can't dominate.

• Defender overhang (5): open critical findings, attack-surface size,

recent posture regressions, recently revoked exceptions, exposed assets.

• Risk-appetite shift: Cautious +5 / Aggressive −5.
• Verdict ladder: Calm → Elevated → Imminent → UnderPressure,

graded A–F.

• Per-day forecast curve with attacker-decay modeling.
• P0-first hardening playbook (BLOCK_KNOWN_IOCS, RATE_LIMIT_AUTH,

HARDEN_PERIMETER, war-room convene on 2+ P0s, …).

• Cross-signal insights: network / auth / user heat concentration,

compound pressure, sustained pressure.

• Renderers: Text / Markdown / JSON.

🐛 Fixes

• #194 — Machine-readable --version. Adds two CI/inventory-friendly

variants that compose with the existing 4-line human banner:

• winsentinel --version --quiet → bare version string (e.g. 1.18.0)
• winsentinel --version --json → stable JSON

{ product, version, informationalVersion, runtime, os, machine }

After --version, only --quiet / --json are greedily consumed; any

other trailing flag is rejected with a clear error.

• #192 — --version now reflects the real installed version.

PrintVersion was reading Assembly.GetName().Version, which returns

the static AssemblyVersion attribute (pinned at 1.0.0.0 for binding

stability). With MinVer driving the package version from git tags into

AssemblyInformationalVersion, the printed banner was stuck at v1.0.0

even though the installed tool was 1.16.1+. Switched the banner to read

AssemblyInformationalVersionAttribute (with AssemblyFileVersion +

AssemblyName.Version as fallbacks) and strip the SourceLink

+commitsha metadata so the output stays clean for support tickets.

Covered by 4 new regression tests in ConsoleFormatterTests.

🧹 Maintenance

• Dependabot config: group minor+patch updates (NuGet, GitHub Actions,

Docker) into single PRs per ecosystem, add an analyzers group, expand

the test-stack group, and **ignore semver-major bumps on

mcr.microsoft.com/dotnet/{sdk,runtime,aspnet}** base images. The

Dockerfile is pinned to 8.0-windowsservercore-ltsc2022 to match the

net8.0-windows TFM across every project; major base-image bumps

require a coordinated TFM migration and are now tracked manually

instead of re-opened weekly by Dependabot.

⬆️ Upgrade

dotnet tool update --global WinSentinel.Cli
winsentinel --version --json

Full Changelog: https://github.com/sauravbhattacharya001/WinSentinel/compare/v1.17.0...v1.18.0

What's Changed

• fix(build): retarget Core/Cli to net8.0-windows; unblock CI by @sauravbhattacharya001 in https://github.com/sauravbhattacharya001/WinSentinel/pull/190
• feat: Impact Detector - MITRE ATT&CK TA0040 detection (57 tests) by @sauravbhattacharya001 in https://github.com/sauravbhattacharya001/WinSentinel/pull/183
• fix(ci): unbreak Coverage Gate parser and Dockerfile line continuations by @sauravbhattacharya001 in https://github.com/sauravbhattacharya001/WinSentinel/pull/191
• feat: add Collection Detector (MITRE ATT&CK TA0009) by @sauravbhattacharya001 in https://github.com/sauravbhattacharya001/WinSentinel/pull/179

Full Changelog: https://github.com/sauravbhattacharya001/WinSentinel/compare/v1.16.1...v1.17.0

v1.16.1 — Elevated FixEngine wrapper hardening

🔒 Security

• FixEngine.ExecuteElevatedAsync: escape apostrophes in temp paths before embedding them in the elevated PowerShell wrapper.

The elevated remediation path builds a PowerShell try/catch wrapper around Path.GetTempPath()-derived script/output/error paths and runs it with Verb=runas (UAC). GUID nonces kept the file names safe, but the directory portion (%USERPROFILE%\AppData\Local\Temp by default) is attacker-influenceable — a Windows account display name containing an apostrophe (e.g. O'Brien) or a hijacked TEMP / TMP env var would close the PowerShell single-quoted literal and turn the wrapper into a command-injection sink running with administrator privileges.

The fix adds EscapePowerShellSingleQuoted (doubles every ', matching the PowerShell / SQL single-quoted escape rule) and applies it to the script, output, and error paths before interpolation.

✅ Tests

• New FixEngineTests.EscapePowerShellSingleQuoted_* theory + null case covering plain, empty, normal Windows temp paths, apostrophe-bearing user paths, raw injection payloads, and null.

🧱 Build

• WinSentinel.Core.csproj: switch to the proper <ItemGroup>-scoped <InternalsVisibleTo Include="WinSentinel.Tests" /> form so the test project can exercise the new internal helper.

Full diff: https://github.com/sauravbhattacharya001/WinSentinel/compare/v1.16.0...v1.16.1

WinSentinel v1.16.0

A feature-heavy release expanding MITRE ATT&CK coverage and polishing the agentic analysis layer. 25 commits since v1.15.1.

New: ATT&CK Detector Suite

Five new autonomous detectors stitched into the analysis pipeline:

• Credential Access Detector (TA0006) — LSASS dumping, Kerberoasting, brute-force, password spraying, keylogging, NTLM relay, and more. Builds harvest chains and recommends containment.
• Initial Access Detector (TA0001) — phishing, exploit-public-facing, supply-chain, valid-account abuse.
• Discovery Detector (TA0007) — host/network/account reconnaissance signal extraction.
• Execution Detector (TA0002) — script interpreter abuse, scheduled-task / WMI execution, LOLBin patterns.
• Command & Control Detector (TA0011) — beaconing, encrypted-channel and proxy abuse heuristics.

Performance

• SecurityNerveCenter now sorts audit history once and threads the result through BuildSignals / BuildAlerts instead of re-sorting per call.
• InsiderThreatProfiler.DetectDeviations collapsed 6+ separate Where().Count() passes into a single-pass event bucketing loop.

Refactors / Reliability

• InsiderThreatProfiler risk-tier classification cleanup: removed an unreachable Critical arm in the first ternary that was immediately shadowed by a corrective if/else ladder; collapsed both into a single highest-first ClassifyInsiderRiskLevel helper with a named CriticalRiskThreshold = 85 constant.
• NuGet publish workflow fix.
• Preview package CI for pre-release builds.

CI / Release Plumbing

• nuget.yml triggers on published releases and packs both WinSentinel.Core and WinSentinel.Cli against the release tag version.
• Version-sync workflow keeps csproj <Version> aligned with MinVer-derived tags.

Install

dotnet tool install --global WinSentinel.Cli --version 1.16.0

---

_Tag-driven release; NuGet publish workflow will run automatically on publish._

Bug Fix

🐛 Fixed: Stack Overflow crash in EventLogAudit module

Impact: WinSentinel crashed with a StackOverflowException every time an audit was run (--audit, --score, or any command that triggers the EventLog module).

Root Cause: The AddFinding and AddFindings helper methods in EventLogAudit.cs were calling themselves recursively inside a lock block instead of calling esult.Findings.Add(). This caused infinite recursion (19,234+ calls) until the stack overflowed.

Fix: Replaced recursive self-calls with direct esult.Findings.Add(finding) operations.

This was introduced in v1.11.0 and affected all subsequent versions through v1.15.0.

What's New in v1.15.0

🕵️ Insider Threat Behavioral Profiler

Autonomous user risk analysis engine that profiles insider threat indicators:

• Behavioral pattern scoring across access, data movement, and temporal anomalies
• User risk classification with confidence-weighted threat levels
• CLI integration with formatted insider threat reports

🔀 Lateral Movement Detector (MITRE ATT&CK TA0008)

Detects lateral movement techniques across the network:

• SMB/WMI/RDP/PsExec/SSH hop chain detection
• Movement graph construction with source-destination-technique edges
• Autonomous pivot point identification and path analysis
• 486 tests covering detection accuracy and edge cases

⚡ Privilege Escalation Detector (MITRE ATT&CK TA0004)

Identifies privilege escalation attempts matching MITRE ATT&CK TA0004:

• Token manipulation, service abuse, UAC bypass, and scheduled task detection
• Group policy audit integration for misconfiguration-based escalation paths
• 378 tests validating detection coverage

📊 Security Posture Momentum Analyzer

Tracks the trajectory of security posture over time:

• Momentum scoring with velocity and acceleration metrics
• Trend detection (improving, degrading, stagnant) with configurable windows
• Posture delta analysis between assessment periods

🏗️ Infrastructure

• Coverage gate workflow with per-component thresholds and Codecov integration
• 21 new files, ~5,962 lines of production + test code

Test Coverage

| Component | Tests |

|-----------|-------|

| Insider Threat Profiler | 345 |

| Lateral Movement Detector | 486 |

| Posture Momentum Analyzer | 236 |

| Privilege Escalation Detector | 378 |

Full Changelog: https://github.com/sauravbhattacharya001/WinSentinel/compare/v1.14.0...v1.15.0

What's New

🔗 Kill Chain Reconstructor

Autonomous attack phase mapping and progression detection. Maps security audit findings to 14 MITRE ATT&CK kill chain phases, detects multi-phase attack progressions across 10 templates (ransomware, APT, credential theft, insider threat, etc.), predicts next likely phases using Markov-based transition probabilities, and generates prioritized response plans.

\\\ash

winsentinel --kill-chain [--json] [-o report.json]

\\\

🧬 Threat DNA Profiler

Generates a unique vulnerability fingerprint for a system by analyzing historical audit findings. Extracts threat 'genes' (recurring vulnerability patterns), tracks frequency/persistence/resistance to fixes, maps to MITRE ATT&CK techniques, and detects mutations over time.

\\\ash

winsentinel threat-dna [--threat-dna-days 90] [--threat-dna-top 15] [--json]

\\\

Features:

• Evolutionary tracking with snapshot history and mutation detection
• Resilience scoring (0–100) with phase detection (Emerging → Stabilizing → Hardening → Resilient)
• SHA256-based DNA hash fingerprint for quick comparison
• Targeted hardening plan with priority, effort, and resilience gain estimates

🐳 Docker Orchestration Improvements

• Build ARGs for VERSION, BUILD_DATE, VCS_REF with OCI image labels
• Dedicated test stage (\--target test\) for CI integration
• HEALTHCHECK for CLI and Service runtime stages
• docker-compose.yml with cli/service/scheduled-audit services

📖 Security Operations Runbook

Comprehensive operational guide covering daily operations, incident response (4-phase), scheduled maintenance, compliance workflows, fleet management, alert configuration, escalation matrix, and integration patterns.

🔧 CI/CD

• Removed redundant build.yml (consolidated into ci.yml matrix)
• Added dependency-review on PRs (actions/dependency-review-action@v4)
• Added SBOM generation (SPDX) via Microsoft.Sbom.DotNetTool

Full Changelog

https://github.com/sauravbhattacharya001/WinSentinel/compare/v1.13.0...v1.14.0

What's New in v1.13.0

🔍 Process Lineage Audit

Autonomous parent-child process chain analysis that detects suspicious process relationships mapped to MITRE ATT&CK techniques:

• 12 detection rules covering Office macro exploitation (T1204.002), browser exploitation chains (T1189), LOLBin abuse (T1218), WMI lateral movement (T1047), malicious service installation (T1543.003), scheduled task persistence (T1053.005), and more
• Orphaned process detection for parent-PID spoofing indicators
• Auto-remediation commands for critical findings
• \winsentinel lineage [--json] [--quiet] [-o report.json]\

📡 Network Beacon Detector

Detects C2 (Command & Control) beaconing patterns by analyzing network connection timing regularity:

• Statistical jitter analysis — low jitter + consistent intervals flag likely C2 beacons
• Signature matching against 10 known C2 framework profiles (Cobalt Strike, Metasploit, Sliver, Empire, Havoc, Brute Ratel, PoshC2, etc.)
• Confidence classification (Low/Medium/High/Critical) with risk scores
• MITRE ATT&CK T1071 mapping with prioritized remediation recommendations
• \winsentinel beacon [--json] [--quiet] [-o output.json]\

🔄 Security Regression Predictor

Analyzes audit history to identify findings that keep returning after fixes, predicts which recent fixes are most likely to regress:

• Finding lifecycle tracking across audit runs with pattern classification (Chronic/Periodic/Sporadic)
• Root cause inference heuristics (superficial fix, config drift, periodic revert)
• Per-module stability profiling (Stable/Shaky/Volatile)
• Composite regression score (0–100) with risk level classification
• \winsentinel --regression [--regression-days 90] [--regression-top 15] [--regression-module <mod>] [--json]\

🐛 Fixes

• Docker attestation: Fixed \ttest-build-provenance\ using tag string instead of sha256 digest — now captures correct digest after push
• Weekly vulnerability rescan: New \docker-rescan.yml\ workflow for scheduled Trivy scans of published container images with SARIF upload to GitHub Security tab

---

Full Changelog: https://github.com/sauravbhattacharya001/WinSentinel/compare/v1.12.0...v1.13.0

What&#39;s New

🎯 Autonomous Threat Hunt Engine

Proactive, hypothesis-driven threat hunting that automatically generates and validates security hypotheses against system telemetry — shifting from reactive alerting to active threat pursuit.

🐦 Security Canary Command (\--canary\)

Honeypot tripwire network that deploys decoy files, registry keys, and network listeners across the system. Any interaction with these canaries triggers immediate alerts, catching lateral movement and insider threats.

⚔️ Security War Game Command (\--wargame\)

Interactive adversarial simulation that models attack scenarios against the current security posture, helping identify defensive gaps before real attackers do.

🔍 Shadow IT Detector (\--shadow\)

Discovers unauthorized software, services, and cloud integrations running outside IT governance — surfacing hidden risk from unapproved tools.

💓 Vitals Dashboard (\--vitals\)

Medical-monitor-style real-time security health dashboard with vital signs, heartbeat monitoring, and at-a-glance system security status.

📚 Documentation & Testing

• Comprehensive CONTRIBUTING.md with architecture overview, chat command guide, service catalog, and helper reference
• 58 new tests for SecurityCompassService and VitalSignsService
• Documentation for all 30 audit modules (expanded from 13)
• Removed duplicate test files superseded by comprehensive versions

🔧 Dependency Updates

• Bump MinVer 6.0.0 → 7.0.0
• Bump actions/checkout 4 → 6
• Bump actions/upload-artifact 4 → 7
• Bump Microsoft.SourceLink.GitHub 10.0.202 → 10.0.203
• Bump aquasecurity/trivy-action 0.35.0 → 0.36.0

Full Changelog: https://github.com/sauravbhattacharya001/WinSentinel/compare/v1.11.0...v1.12.0

What&#39;s New

✈️ Security Flight Recorder CLI (\--flightrecorder\)

Continuous security event recording with black-box-style replay capability. Captures real-time security events, system state changes, and threat indicators into a persistent flight log that can be reviewed after incidents — like an airplane&#39;s flight recorder but for your Windows security posture.

Full Changelog: https://github.com/sauravbhattacharya001/WinSentinel/compare/v1.10.0...v1.11.0