Skip to content

v1.8.0 - TESTING ONLY - Post-AV persistence investigation

Pre-release
Pre-release

Choose a tag to compare

View all tags
@pupontech pupontech released this 08 Oct 10:14
v1.8.0
b731c5e

v1.8.0 — post-AV persistence investigation (TESTING ONLY)

TESTING ONLY - post-AV persistence prototype. Owner live Windows acceptance is required.

  • Added a mandatory persistence investigation after AV scans in both runners,
    including when scanners are declined, unavailable or skipped with -sa.
    The no-execution -WhatIf preview remains an explicit exception.
  • Added local evidence collection for tasks/task XML/hidden-task discrepancies,
    registry autoruns, loaded user hives, startup folders, services, WMI, script
    file hashes, process/network context, Defender, accounts and logon/RDP context.
    Collection gaps and bounded/truncated evidence remain explicit and incomplete.
  • Added separate selection and typed REMOVE approval for suspicious scheduled
    tasks, Run/RunOnce values and startup files, with rollback prerequisites,
    per-item backup, fresh target revalidation and post-action verification.
    -sr suppresses cleanup only; -ExecuteRemoval cannot approve this new scope.
  • Added persistence status, findings, coverage errors and removal outcomes to
    the HTML report, plus aggregate-only sanitized share metadata. Raw evidence,
    commands, paths, task XML, scripts and histories are not added to sharing.
  • Services/WMI/hidden-task artifacts/Winlogon remain review-only. Original
    offline user hives, raw script samples and PowerShell history are not collected.
  • Added fixture/refusal/report/privacy/workflow tests to the Windows 2022/2025
    PowerShell 5.1 and pwsh matrix; package parsing now includes PowerShell modules.
  • This is the existing guided cleanup tool, not a full-cleanup WPF GUI release.
    No live detector, scanner, installation or destructive Windows cleanup was
    performed by the agents; live selection, UAC and rollback acceptance are pending.

Verification and provenance

  • Source commit: b731c5e42ada4df71f0099fef06de00869e32ee7 on feat/post-av-persistence. This release does not merge or replace the separate WPF GUI work.
  • Hosted Windows CI: https://github.com/pupontech/screenconnect-cleanup/actions/runs/37760866006 — Windows Server 2022 and 2025, PowerShell 5.1 and 7, including native link-count fixtures, batch success/failure replay, and extracted-ZIP fixture execution.
  • Local gate matrix: 32 commands passed; independent Luna source-security/spec/standards reviews had no unresolved release blocker.
  • The release ZIP is the tested Windows 2022 artifact, copied without rebuilding. Both runner ZIPs passed integrity, exact 45-member hash manifest, full source SHA, version, ASCII/no-BOM and CRLF checks.
  • SHA-256: 2d768cfe9b57a398d513c52159f0e721ad3b1620759e03ab00abe22233582b0e

Test it

  1. Verify the .sha256 sidecar and extract the entire ZIP into a new folder.
  2. Read DEPLOY.md and docs/12-post-av-persistence.md; then launch START-HERE.bat on an authorized disposable Windows test machine. This attended legacy runner uses elevation, not the standard-user DetectOnly GUI.
  3. Decline every AV scanner and confirm Step 6d still runs; check report.html for persistence status, coverage gaps, candidate reasons and cleanup outcomes.
  4. Test only harmless lab entries. Declining approval must leave them intact; selected cleanup requires typed REMOVE, current-run rollback prerequisites, backup and target revalidation.

-sa skips AV, not persistence. -sr disables persistence cleanup, not collection. -WhatIf, an aborted preflight, or a terminated process does not run the collector. A heuristic match is not a malware verdict; incomplete evidence is never clean.

Remaining acceptance limits

Owner live collection coverage, interactive approval/UAC behavior, actual task/registry/startup mutation, backup usefulness and quarantine restoration remain pending. Agents ran fixtures only: no live AV scanner, live cleanup, installation or malicious sample. Services/WMI/hidden tasks/Microsoft-folder tasks/Winlogon remain review-only; offline hive loading, shell history and script samples are intentionally omitted. Raw persistence evidence stays local and may contain sensitive commands, users and IPs; sanitized sharing adds aggregate metadata only.

Direct mirror: https://screenconnect.aygross.xyz/#screenconnect-cleanup-latest

Assets 4
Loading