Skip to content

v1.22.0

Latest
Latest

Choose a tag to compare

View all tags
@sauravbhattacharya001 sauravbhattacharya001 released this 20 Jul 15:01
v1.22.0
f6b2dda

WinSentinel v1.22.0

This release ships 43 commits of new audit coverage and hardening since v1.21.0, expanding detection across network posture, PowerShell abuse, identity, and encryption.

Network posture hardening

  • New checks: SMB client-side signing requirement, ICMP redirect acceptance, ICMP Router Discovery (IRDP), Dead Gateway Detection, IPv4/IPv6 source-routing acceptance, NetBIOS Name-Release-on-Demand.
  • Detect active 6to4 / ISATAP IPv6 transition tunnels and add mDNS poisoning as a 4th spoofing vector (alongside LLMNR/NBT-NS/WPAD).
  • Distinguish network-exposed high-risk ports from loopback-only listeners.

PowerShell & profile abuse detection

  • Detect WMI/scheduled-task persistence, LOLBin execution/fetch, reverse shells, inline execution-policy bypass, and in-memory loaders in profile scripts.
  • Flag AMSI reflection/kill-switch bypass (AmsiEnable=0), native-API injection, and offensive toolkit tokens (Mimikatz/Shellcode/PowerSploit).
  • Audit WinRM CredSSP, Basic auth, and AllowUnencrypted plaintext transport.
  • Add Protected Event Logging check; flag module logging with incomplete ModuleNames coverage and transcription without invocation headers (CIS L1).

Identity & credential protection

  • Audit WDigest cleartext credential caching (UseLogonCredential).
  • Correct RunAsPPL UEFI-lock semantics and recognize UEFI-locked LSA Protection; describe LSA Protection + Credential Guard.
  • Registry: flag built-in Administrator bypassing UAC (FilterAdministratorToken).

Encryption

  • Audit SChannel Diffie-Hellman minimum key length (Logjam) and Kernel DMA Protection.
  • Flag weak BitLocker method on fully-encrypted drives; tier weak TLS cipher suites by severity (explicit 3DES/Sweet32).

Other checks & hardening

  • Certificate audit: detect not-yet-valid certs; fix weak-algo thumbprint interpolation.
  • Firewall: extract pure FirewallAnalyzer, detect wide-open inbound allow rules.
  • Event logs: detect new account creation, privileged group additions, and successful remote logons from external IPs (4624 Type 3/10).
  • Scheduled tasks: flag signed interpreters launching writable scripts.
  • USB: audit WPD/MTP portable-device restriction. AppSecurity: audit MSIX/AppX sideloading & developer-mode. ASR: new Safe Mode + system-tool-impersonation rules. Browser: flag SSLVersionMin forcing TLS 1.0/1.1.

Full Changelog: v1.21.0...v1.22.0

Assets 5
Loading