Skip to content

v1.20.0

Choose a tag to compare

View all tags
@sauravbhattacharya001 sauravbhattacharya001 released this 03 Jul 20:50
v1.20.0
c4f494b

WinSentinel v1.20.0

A large release: 110 commits since v1.19.1, adding two new audit modules, a broad set of
Remote Access and Microsoft Defender checks, several new CLI commands, and a wide sweep of
analyzer hardening, parser correctness fixes, and Fix-button repairs. Scheduled scans and the
real-time monitor are now free (full single-machine power); Pro is fleet-only.

New audit modules

  • Identity & Credentials audit — credential hygiene and identity posture checks.
  • USB & Removable Media audit (F6) — removable-storage exposure and policy.

Remote Access hardening

  • Audit RDP drive + clipboard and printer + COM/LPT redirection policy.
  • Flag RDP session shadowing that allows silent view/control without consent.
  • Audit RDP Plug-and-Play device redirection (fDisablePNPRedir) and always-prompt-for-password-on-connect (fPromptForPassword).
  • Flag WinRM listeners that accept connections from any source IP.
  • Audit WinRM CredSSP delegation and wildcard TrustedHosts.
  • Warn on unsolicited Remote Assistance (Offer RA).

Microsoft Defender

  • Audit Attack Surface Reduction (ASR) rules with a one-click enable-all fix.
  • Audit Controlled Folder Access with a one-click enable fix.
  • Audit PUA (potentially-unwanted application) protection.
  • Detect tampered profile.ps1 PowerShell persistence (T1546.013).

New CLI commands & UX

  • winsentinel diff — standalone posture-diff command.
  • winsentinel why — per-finding explanations.
  • winsentinel agent — start/stop/status/install/uninstall the background agent.
  • winsentinel fleet commands — Pro dispatch-history view (fleet: status, scan-all, push-policy, nodes).
  • badge command handler and polished findings export (flag-style formats, smart defaults, CSV).

Compliance

  • Added SOC 2 and Essential 8 framework mappings.

Ecosystem & distribution

  • GitHub Action for the Marketplace ("winsentinel security audit") plus CI security-audit actions and SARIF/JSON export wiring.
  • winget manifest with auto-submission; opt-in telemetry service + CLI command.
  • Localization scaffolding (en-US) with Spanish translation wired into severity labels.
  • Plugin architecture repurposed as community extensibility (no longer Pro-gated).

Reliability: analyzer extraction + test expansion

  • Extracted pure, unit-testable analyzers from their audits — Defender, USB, NetworkPosture,
    PowerShellSecurity, BrowserSecurity, Encryption, IdentityCredential, EventLog, ProcessLineage —
    plus FleetRequestBuilder and WatchDeltaCalculator.
  • Hundreds of new tests across services (KillChain, FlightRecorder, Kpi, Prophecy, Canary,
    ThreatHunt, Mentor, Autopsy, MaturityAssessment, AgentService) and audits.

Correctness, parser hardening & Fix-button repairs

  • Repaired multiple dead Fix buttons and guarded every analyzer fix command against the
    sanitizer so the Fix button actually works; added actionable fixes to Encryption findings.
  • Hardened parsers: LLMNR/NetBIOS, SMB/RDP registry flags, listening-ports, IPv6/Teredo,
    arp -a lines, and audit-policy/EventLog boundaries.
  • Fixed EncryptionAnalyzer BitLocker %/TPM handling, NetworkPosture WPA/cipher classification,
    EventLog retention semantics, ComplianceMapper word-boundary matching, ScoreForecaster /
    SecurityDecayPredictor / streak/heatmap date-boundary bugs, SARIF rule-ID trailing hyphen,
    and CSV formula-injection bypass in export --csv.

Release assets (MSIX, portable/service ZIPs) are attached by the Release workflow;
WinSentinel.Cli / WinSentinel.Core publish to NuGet.org once the NuGet workflow finishes indexing.

What's Changed

Full Changelog: v1.19.1...v1.20.0

Contributors

sauravbhattacharya001
Assets 5
Loading