Skip to content

v2.1.0 — WinSecHunter

Latest
Latest

Choose a tag to compare

View all tags
@paulmann paulmann released this 21 Oct 20:58
· 3 commits to main since this release
v2.1.0
f967841

WinSecHunter 2.1.0

Production hardening and the reporting surface an incident responder was missing.
This release also fixes three defects that made normal collection fail outright.

Highlights

  • 20 cmdlets — collection, analysis, enrichment, reporting and evidence in one module.
  • Per-channel execution — a missing Sysmon/RDP/firewall log is Skipped, not a failed sweep.
    WinSecHostResult.LogDetails explains every channel.
  • Incident report — Executive / Technical / Full templates, Markdown and a self-contained HTML
    document with verdict, severity, confidence, timeline, findings, IOCs, sessions and custody.
  • Abuse report — RFC 5322 .eml ready to send, abuse desk resolved from ASN/PTR, evidence
    attached as base64, consistent account pseudonyms with -RedactAccounts.
  • IOC export — CSV, grep-friendly text, JSON and STIX 2.1.
  • Evidence integrity — SHA-256 manifest, verification, and detection of files added after export.
  • Case re-import — typed events restored for follow-up work.

New cmdlets

Cmdlet Purpose
Show-WinSecHunterHelp whole-toolkit reference, one cmdlet, or Markdown
New-WinSecIncidentReport Executive / Technical / Full report to Markdown + HTML
New-WinSecAbuseReport RFC 5322 .eml, Markdown, JSON for the source network
Export-WinSecIocList CSV / TXT / JSON / STIX 2.1
Test-WinSecEvidenceIntegrity verify hashes; detect modified, missing and added files
Import-WinSecCase reopen a bundle with typed events

Fixed

  • Collection crashed whenever no time window was supplied ([AllowNull()][datetime] cannot bind $null).
  • Every -ComputerName sweep aborted on a ForEach-Object -Parallel scriptblock restriction.
  • -PassHostStatus output was lost when a channel was unavailable.
  • OTX endpoint corrected; IPv6 attribution cache used an illegal file name.
  • config.json is now written atomically; empty coverage timestamps no longer crash export.
  • -RedactAccounts now also masks account names inside attached CSV/JSON evidence.
  • Localized auditpol /r headers no longer break audit-policy analysis.

Install

$version = '2.1.0'
$zip = Join-Path $env:TEMP "WinSecHunter-$version-module.zip"
Invoke-WebRequest "https://github.com/paulmann/Get-Windows-Security-Events-By-IP/releases/download/v$version/WinSecHunter-$version-module.zip" -OutFile $zip -UseBasicParsing
Expand-Archive -LiteralPath $zip -DestinationPath (Join-Path $env:TEMP "WinSecHunter-$version") -Force

Import-Module (Join-Path $env:TEMP "WinSecHunter-$version/WinSecHunter/$version/WinSecHunter.psd1") -Force
(Get-Module WinSecHunter).ExportedFunctions.Count    # 20
@(Get-WinSecEventCatalog).Count                      # 156

Or from the repository:

git clone https://github.com/paulmann/Get-Windows-Security-Events-By-IP.git
cd Get-Windows-Security-Events-By-IP
./build/Install-Dev.ps1 -Force
Show-WinSecHunterHelp

Assets

  • WinSecHunter-2.1.0-module.zip — validated module package (imports in a clean child process).
  • Get-SecurityEventsByIP.ps1 — the legacy v5.0.2 script, preserved for continuity only.
    It was removed from main; the module replaces it and is the supported path.

Verification

./build/validate.ps1 -Tests    # 168 passed, 0 failed, 1 skipped; PSScriptAnalyzer 0/0

Documentation

Found a bug? Please open an issue:
https://github.com/paulmann/Get-Windows-Security-Events-By-IP/issues/new/choose

Checksums (SHA-256)

Asset SHA-256
WinSecHunter-2.1.0-module.zip 6A2490FF93C35D51395C120264BAA798783E4CBC06516CF1E1BAC33F321C00DE
Get-SecurityEventsByIP.ps1 5ECCC009BDF04885E1E36313BEE13EF299942F4A32A3A2339C1C0E42AC1BA375
Assets 4
Loading