v1.21.0

WinSentinel v1.21.0

Five new detections land in this release, expanding coverage across network posture,
Windows servicing, DNS privacy, PowerShell logging, and Microsoft Defender health. All
changes ship with new unit tests.

Network posture hardening

• WPAD auto-discovery poisoning check — NetworkAudit now flags Web Proxy
  Auto-Discovery (WPAD) being left enabled, a classic man-in-the-middle vector where an
  attacker on the LAN answers WPAD queries to silently redirect a machine's HTTP(S)
  traffic through a rogue proxy.

Windows servicing / update health

• End-of-life build detection — UpdateAudit flags Windows installations running an
  out-of-support build that no longer receives security updates, so an EOL OS is surfaced
  as a finding instead of silently rotting.

DNS privacy

• DoH resolver validation — DnsAudit now flags DNS-over-HTTPS pointed at an
  unrecognized / untrusted resolver, catching cases where encrypted DNS is quietly routed
  through an unexpected third party.

PowerShell logging fidelity

• Explicitly-disabled vs. unset logging — PowerShell logging analysis now
  distinguishes a policy value explicitly set to 0 (logging deliberately turned off)
  from a value that is simply absent, reducing false "not configured" noise and correctly
  escalating deliberate tamper-down of Script Block / Module logging.

Microsoft Defender health

• Protection-disabled event detection — the event-log analyzer now detects Windows
  Defender protection-disabled events (IDs 5001 / 5010 / 5012), surfacing real-time
  protection or antivirus/antispyware being switched off — a common precursor to malware
  execution.

---

Packages

• WinSentinel.Cli and WinSentinel.Core publish to NuGet.org and GitHub Packages once
  the release automation finishes indexing.
• MSIX + portable/service ZIP assets are built and attached by the release workflow.

Full Changelog: v1.20.2...v1.21.0