wymcmd 0.3.0

A console window flashed on your screen and vanished. This tells you what opened it, and why —
including launches that happened while nothing of ours was running.

Install

Download wymcmd-0.3.0-win-x64.zip, unpack it anywhere, then:

wymcmd install

That copies both files to %LOCALAPPDATA%\Programs\wymcmd, adds the folder to your PATH and puts
a shortcut in the start menu — no administrator needed. Open a new terminal and wymcmd works
from any folder.

The binary is not code-signed, so SmartScreen will call it an unrecognised app the first time:
"More info", then "Run anyway". A .sha256 ships beside every download.

Watched, or worked out afterwards

Every answer this tool gives is either something it saw happen or something it rebuilt afterwards
from what Windows kept. It can finally tell you which one you are holding.

wymcmd coverage --last 7d

Capture sessions are recorded with a heartbeat, so a session that ended with the machine losing
power knows to the minute where its coverage stopped instead of claiming it watched a switched-off
computer. Two watchers at once count once.

Blind is not the same as off. An hour with no recording only counts against you if the machine
was up for it, read from the power transitions Windows writes to the System log — no elevation and
no audit policy needed. The percentage is measured against the time the machine was actually on, so
a laptop shut for the weekend is not reported as unwatched.

The black box counts as a watcher. Windows starts it at boot with nothing of ours running, so
it covers exactly the stretches the window cannot. How far back it reaches is read from the oldest
event still in the trace rather than from when the session was created, because the file is
circular and wraps.

wymcmd why says it out loud too: an explanation for a moment nothing was recording is marked as
rebuilt, not read back.

What else a launch now carries

ATT&CK technique names. why and --json label a launch with the MITRE techniques the
evidence already establishes — the scheduled task read out of the task store, the encoded command
that was decoded, the interpreter that actually ran. Nothing is inferred and nothing is scored: a
technique appears only where the finding behind it is in hand, so a launch can be looked up,
matched against a detection rule or pasted into a ticket.

Where it reached. The connections and DNS queries Sysmon recorded for that process while it was
alive. Only Sysmon records this per process; without it the section is absent rather than filled in
from the machine's DNS log, which cannot say which process asked.

Four more places a launch can come from: Active Setup stubs, the Winlogon Shell and Userinit
values, a logon script named in the user's own environment, and a COM server registered per user
that shadows the machine-wide one of the same class.

Also

• Reading a Windows event log is given a time budget, so a machine with a long history cannot hold
  the window while a filtered read walks a log end to end.
• The rules file is no longer written with a second copy of every enabled rule in it.

115 tests. Everything in 0.2.1 is included.