Skip to content

WinFire V2.0

Choose a tag to compare

View all tags
@Masriyan Masriyan released this 29 Jan 16:58
· 18 commits to main since this release
WinFire_v2_Stable
b24ee59
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

[2.0.0] - 2026-01-29

🚀 Major Release - Threat Detection & Enhanced Analysis

This release transforms WinFire from a collection tool into a comprehensive threat detection and forensic analysis platform.

Added

Threat Detection Features

Feature Description
LOLBAS Detection Detect abuse of certutil, mshta, regsvr32, wmic, bitsadmin, and 10+ other binaries
Credential Indicators Detect LSASS access events, credential dumping tools, SAM/SECURITY hive copies
Advanced Process Analysis Identify suspicious parent-child relationships (e.g., Word → PowerShell)
Threat Scoring Automated 0-100 threat score with Low/Medium/High/Critical risk levels

New Artifact Collection

Feature Description
Defender Exclusions Collect and flag suspicious Windows Defender exclusions
PowerShell History Collect PSReadLine command history with threat pattern detection
RDP Analysis Analyze RDP sessions and connection history for lateral movement
Jump List Analysis Collect user activity from Jump Lists
LNK File Analysis Parse shortcuts for malicious targets and arguments

UI/UX Improvements

  • 🔥 Enhanced ASCII art banner with animated flame effects
  • 🌐 GitHub repository URL display in banner
  • 📊 Color-coded output with severity levels

Documentation

  • 📖 CONTRIBUTING.md - Comprehensive contributor guidelines
  • 🔒 SECURITY.md - Security policy with AV handling guidance
  • 📝 CHANGELOG.md - Version history (this file)
  • ⚠️ "Before You Use" section with AV detection warnings

Fixed

Bug Fix
Get-CService typo Changed to Get-Service with additional Win32_Service collection
Extension matching Fixed -in operator to use -contains with proper dot stripping
Environment variable Fixed $env:ProgramFilesx86 → ${env:ProgramFiles(x86)} syntax
Service collection Now collects both Get-Service and Win32_Service data

Changed

Item Before After
Script size ~1900 lines 2576 lines
Function count 12 forensic functions 21 forensic functions
TotalTasks 30 40
WinFireVersion 1.0 2.0

New Output Files

Raw_Data/
├── Defender_Exclusions.csv/.json      # NEW
├── PowerShell_History.csv/.json       # NEW
├── RDP_Analysis.csv/.json             # NEW
├── LOLBAS_Detection.csv/.json         # NEW
├── Credential_Indicators.csv/.json    # NEW
├── Advanced_Process_Analysis.csv/.json # NEW
├── Threat_Score.csv/.json             # NEW
├── JumpList_Analysis.csv/.json        # NEW
└── LNK_Analysis.csv/.json             # NEW
Assets 3
Loading