WatchLattice 0.8.0

Added

• Browser extension watchdog (BrowserExtensionWatchdog module, on by
  default): every five minutes it inventories the extensions in every Edge,
  Chrome and Firefox profile of every user on the PC (from each profile's
  Preferences, Secure Preferences and extensions.json), and the
  policies and registry entries that install extensions from outside the
  browser (ExtensionInstallForcelist, ExtensionSettings, Firefox
  Extensions\Install, and the Software\...\Extensions registrations
  other programs write). The first check records a baseline; after that each
  extension added is a warning naming its ID, name, version, browser, profile
  and user, how it was installed (store, policy, another program, unpacked)
  and whether by policy, and each policy added is a warning too. Removals,
  new profiles and deleted profiles are Info. Read-only; it never disables or
  removes an extension. New Event IDs 10001 to 10015. See its
  README. (#39)
• Approve as baseline on the dashboard's Alerts tab: select an
  Autostart entry added or changed alert (or the verification alert that
  follows it) and approve the entry exactly as it is now, so it raises no
  alert when it comes back with that value, for example after an app removed
  and re-added its Run value, or a task flipped back to a known setting. Any
  other value still alerts. For a New browser extension alert it adds the
  extension's ID to IgnoredExtensionIds. Approvals are stored in the hub's
  appsettings.json (new Persistence:ApprovedEntries, one
  sha256:<hash> <source>/<entry> line each), so approving goes through the
  administrator prompt and the settings editor, keeps a settings backup and
  restarts the hub; approved alerts are marked acknowledged, and an approval
  is revoked by removing its line in Settings. ENTRY_ADDED and
  ENTRY_CHANGED messages now end with a Fingerprint: sha256:<hash> line
  for this. Event IDs are unchanged and approving raises no new events. See
  approving entries.
  (#40)
• Script host audit (ScriptHostAudit module, off by default): reads
  Security log event 4688 every 30 seconds and reports launches of
  PowerShell, mshta, wscript, cscript, rundll32, regsvr32, certutil,
  bitsadmin and similar programs, with the parent program, user, elevation,
  command line and why it was reported. A launch is a warning when an Office
  app, a browser, a PDF reader or another script host started it, when its
  command line uses an encoded PowerShell command, a hidden window, a
  download, Invoke-Expression, javascript: or a known abuse of the
  program (such as certutil -urlcache or regsvr32 scrobj.dll), or when a
  Windows program runs from outside the Windows folder; critical when a
  suspicious parent combines with another reason. Ordinary launches are not
  reported unless MinimumSeverity is Info. It only works when Windows
  process creation auditing is already on, and never turns it on: when it is
  off the dashboard shows one informational alert saying so, with the
  auditpol command in the README. Known-good launches are allowed with
  AllowedLaunches wildcard rules or with Approve as baseline (new
  ScriptHostAudit:ApprovedLaunches, the exact parent, program and command
  line). A cleared or overwritten Security log is reported. Read-only; it
  never blocks or stops a process. New Event IDs 11001 to 11009. See its
  README. (#41)
• What to check by hand on Windows now has the
  0.8.0 checks: upgrading the 0.7.0 MSI, then the browser extension
  watchdog, approving entries as baseline and the script host audit.

Changed

• Upgrading from 0.7.0: run the 0.8.0 MSI over an MSI install, or use
  Install update in the tray on either kind of install. Your
  appsettings.json is kept; the browser extension watchdog starts on its
  own (its first check records a baseline and raises nothing else), and the
  script host audit stays off until you turn it on. Existing baselines and
  alert history are unchanged.

What's Changed

• Add a browser extension watchdog module by @notbrianbob in #39
• Approve startup entries and browser extensions as baseline from the dashboard by @notbrianbob in #40
• Add a script host audit module (off by default) by @notbrianbob in #41
• Prepare v0.8.0: changelog section and Windows hand checks by @notbrianbob in #42

Full Changelog: v0.7.0...v0.8.0

WatchLattice 0.7.0

Added

• MSI installer: each release also ships
  WatchLattice-<version>-win-x64.msi, built from the same files as the zip.
  It sets up what Install.cmd does (the ScanAlways Protection service, the
  alert feed folder and its permissions, the event log source, the tray at
  sign-in and the Start menu shortcut) with the first-run defaults, takes
  TRAYUSER, CANARYFOLDERS, DECOY, UPDATECHECK and TRAYAUTOSTART
  for unattended installs, upgrades in place keeping appsettings.json, and
  uninstalls from Settings > Apps as completely as uninstall.ps1. The zip,
  Install.cmd and the in-hub updater are unchanged, and SHA256SUMS.txt
  now lists both files. CI installs, upgrades and uninstalls it on every
  pull request. See the MSI. (#36)
• winget manifests: each release also carries
  WatchLattice-<version>-winget.zip, manifests for publishing the MSI to
  winget as notbrianbob.WatchLattice (templates in packaging/winget),
  rendered with the release's MSI URL, SHA-256 and ProductCode, depending on
  the .NET 8 Desktop Runtime, and checked with winget validate. CI renders
  and validates them for a test MSI on every pull request. Nothing is
  submitted to winget automatically; see
  publishing to winget. (#37)
• What to check by hand on Windows now has the
  0.7.0 checks: updating from 0.6.0, then installing, reinstalling and
  uninstalling the MSI and trying the winget manifests.

Changed

• Dependencies: Microsoft.Extensions.* and System.Diagnostics.EventLog
  10.0.13 (from 8.0.x), plus System.Threading.AccessControl 10.0.13, which
  EventLog 10 needs on .NET 8 but does not pull in. Microsoft.NET.Test.Sdk 18.11.0 and
  xunit.runner.visualstudio 4.0.1. All of them ship .NET 8 builds, so
  WatchLattice still targets and runs on the .NET 8 runtime; the installer's
  requirement is unchanged. The alert feed now restores its history and
  writes its first snapshot before the modules start, which Hosting 10 no
  longer did on its own. (#34)
• Upgrading from 0.6.0: Install update in the tray updates a zip
  install as before. To move to the MSI, uninstall first; the MSI refuses to
  install over an Install.cmd install (and the other way round). Nothing
  needs reconfiguring and no new baselines are recorded.

Fixed

• Alert feed: a hub stopped right after it started could leave the feed
  marked online until it went stale, because Hosting 10 may never run the
  delivery loop whose clean-up marked it offline. The feed is now marked
  offline when the service stops. (#36)
• State files: writing the alert feed or another state file retries a
  replace that Windows briefly refuses while a reader or a scan has the
  file open, instead of skipping that write. (#36)

What's Changed

• Update Microsoft.Extensions to 10, Test.Sdk to 18 and the xunit runner to 4 by @notbrianbob in #34
• Add an MSI installer alongside the release zip by @notbrianbob in #36
• Add winget manifests for the MSI to each release by @notbrianbob in #37
• Prepare v0.7.0: changelog section and Windows hand checks by @notbrianbob in #38

Full Changelog: v0.6.0...v0.7.0

WatchLattice 0.6.0

Added

• Hosts file and proxy watchdog (HostsProxyWatchdog module, on by
  default): every minute it reads the hosts file Windows actually uses
  (following Tcpip's DataBasePath) and the proxy settings in WinINET (each
  signed-in user and the machine, including policies and the binary
  connection settings), WinHTTP, and HTTP_PROXY-style environment
  variables. The first check records a baseline; after that every change is
  reported with before and after. Hosts entries that block or redirect
  Windows Update, Defender, SmartScreen or WatchLattice's update hosts are a
  standing critical alert, and a hosts file moved to another folder is a
  warning. Read-only; it never edits the hosts file or resets a proxy. New
  Event IDs 8001 to 8009. See its
  README. (#30)
• Services and WMI subscriptions in the persistence auditor: the
  Persistence module now also inventories auto-start Windows services
  (program or service DLL, account, failure command; settings
  WatchServices) and permanent WMI event subscriptions in
  root\subscription (filters, consumers and bindings; setting
  WatchWmiSubscriptions). Both are on by default and start with an
  informational baseline. A new or changed WMI subscription, or a service
  that runs from a user-writable folder, is a critical alert. New and changed
  services are verified automatically like scheduled tasks (file location,
  signature, publisher, privilege changes), and a service whose program only
  moved to a new version folder inside Windows or Program Files (Defender
  platform updates, for example) is informational when verification follows.
  Read-only; existing Event IDs are reused. See the
  Persistence README. (#31)
• Alert export: Export… on the dashboard's Alerts tab saves the list
  as shown (grouped or not, with or without dismissed rows) to CSV or JSON,
  and --export-alerts <path> [--format csv|json] [--group] does the same
  from the command line for scripts. CSV cells that a spreadsheet would run as
  a formula are prefixed with '. See
  exporting alerts. (#32)
• Daily summary: once a day (8:00 local by default) the hub raises one
  Info alert counting the last 24 hours' alerts per module and severity, with
  the most repeated ones; the dashboard's Overview shows the latest. A
  summary missed while the PC was off is written soon after the hub starts.
  New settings section Alerts:DailySummary and Event ID 1007. Nothing
  leaves the PC. See the daily summary.
  (#32)
• What to check by hand on Windows: one list of the
  manual checks for the 0.5.0 and 0.6.0 features.

Changed

• Upgrading from 0.5.0: the first check after the update records new
  baselines for the hosts file and proxy settings, services and WMI
  subscriptions as Info alerts, without warnings for what was already there.

What's Changed

• Add a hosts file and proxy settings watchdog module by @notbrianbob in #30
• Watch auto-start services and WMI event subscriptions for persistence by @notbrianbob in #31
• Add alert export (CSV/JSON) and a daily alert summary by @notbrianbob in #32
• Prepare v0.6.0: changelog section and Windows hand-check list by @notbrianbob in #33

Full Changelog: v0.5.0...v0.6.0

WatchLattice 0.5.0

Added

• Install integrity check (InstallIntegrity module): every hour the hub
  re-hashes its own Hub/ and Tray/ files against
  Hub/WatchLattice.files.sha256, a per-file manifest that releases now
  ship, and alerts when a listed file is changed or missing or an unexpected
  .exe or .dll appears. Problems are re-checked after 30 seconds before
  alerting, and a manifest from a different release (an update waiting for a
  restart) is skipped. Read-only; it never repairs anything. New Event IDs
  7001 and 7002; --verify-install runs one check by hand. See
  install integrity check. (#28)
• Grouped alerts with acknowledge and dismiss in the dashboard: repeats of
  one alert (same module, code and resource) show as one row with a count,
  first and last seen, and the highest severity. Review state is kept per user
  in %LOCALAPPDATA%\ScanAlways\alert-review.json, and a new repeat makes a
  row new again. The alert feed, Event Log and event IDs are unchanged. (#27)
• CHANGELOG.md, used as the release notes for each tagged version.

Changed

• After a failed update check (for example, no network yet at boot) the hub
  retries after 1, 2, 4 minutes and so on, up to the normal 12-hour interval,
  instead of waiting the full 12 hours. (#24)
• Build and test tooling updated: actions/checkout v7, actions/setup-dotnet
  v6, actions/upload-artifact v7, xunit 2.9.3, Microsoft.NET.Test.Sdk
  17.14.1 and xunit.runner.visualstudio 3.1.5. Shipped runtime packages are
  unchanged. (#26)

Fixed

• The tray now restarts itself when an update replaced its files. Before,
  an update installed from anywhere other than that tray left the old tray
  running until it was exited by hand. (#25)

What's Changed

• Retry soon after a failed update check instead of waiting 12 hours by @notbrianbob in #24
• Restart the tray when an update replaced its files by @notbrianbob in #25
• Update GitHub Actions and test tooling by @notbrianbob in #26
• Group repeated alerts and add acknowledge/dismiss to the dashboard by @notbrianbob in #27
• Check WatchLattice's own installed files against per-file release hashes by @notbrianbob in #28
• Add a changelog and use it for release notes by @notbrianbob in #29

Full Changelog: v0.4.0...v0.5.0

WatchLattice 0.4.0

What's Changed

• Dashboard with activity, module switches and an admin-only settings editor by @notbrianbob in #19
• Verify changed scheduled tasks behind persistence alerts by @notbrianbob in #20
• Fix timing race in persistence verification tests by @notbrianbob in #21
• Grade persistence alerts by what changed by @notbrianbob in #22
• Decoy: wait between sweeps so an empty scan root cannot spin by @notbrianbob in #23

Full Changelog: v0.2.0...v0.4.0

WatchLattice 0.3.0

What's Changed

• Watch Defender exclusions, ASR rules and cloud protection by @notbrianbob in #15
• Rename to WatchLattice and add reproducible demos with measured overhead by @notbrianbob in #4
• Sign release binaries through SignPath and check signatures on update by @notbrianbob in #16
• Write alerts to the Windows Event Log with stable event IDs by @notbrianbob in #17
• Add a one-step installer and uninstaller to the release by @notbrianbob in #18

Full Changelog: v0.1.0...v0.3.0

WatchLattice 0.2.0

What's Changed

• Watch Defender exclusions, ASR rules and cloud protection by @notbrianbob in #15
• Rename to WatchLattice and add reproducible demos with measured overhead by @notbrianbob in #4
• Sign release binaries through SignPath and check signatures on update by @notbrianbob in #16
• Write alerts to the Windows Event Log with stable event IDs by @notbrianbob in #17
• Add a one-step installer and uninstaller to the release by @notbrianbob in #18

Full Changelog: v0.1.0...v0.2.0

WatchLattice 0.1.0

What's Changed

• Add always-scanning decoy tool and multi-tool suite layout by @notbrianbob in #1
• Add canary file watcher and Defender health watchdog by @notbrianbob in #3
• Add suite hub, repo hygiene, CI and CodeQL by @notbrianbob in #2
• Move CodeQL workflow to codeql-action v4 by @notbrianbob in #10
• Add persistence auditing, shared alerts, and a Windows tray companion by @notbrianbob in #11
• Add Windows Firewall health watchdog module by @notbrianbob in #12
• Add in-hub update checker and verified, user-approved installer by @notbrianbob in #13
• Keep the release version out of the release workflow's test build by @notbrianbob in #14

New Contributors

• @notbrianbob made their first contribution in #1

Full Changelog: https://github.com/notbrianbob/WatchLattice/commits/v0.1.0