winforensics-mcp 1.4.2
Bug-fix release correcting Shell Link target timestamps, expanding registry logon-persistence coverage, and tightening malicious API-pattern semantics.
Fixed
- Decode creation, access, and modification FILETIME values directly from the Shell Link header and emit timezone-aware UTC values independent of the analysis host timezone.
- Preserve the existing timestamps response while adding explicit target_timestamps and timestamp_source fields.
- Require min_match to be satisfied by required APIs; optional APIs now enrich evidence but cannot trigger a finding by themselves.
- Apply the required/optional threshold consistently to static PE imports and API Monitor captures.
Added
- Add Winlogon persistence inspection for Userinit, Shell, AppSetup, and Taskman.
- Return Winlogon key LastWrite time, expected defaults, suspicious deviations, and value details alongside existing Run-key and service results.
- Report required and optional API matches separately for clearer pattern evidence.
Verification
- Full test suite passing: 275 passed, 27 optional artifact tests skipped.
- Timestamp regressions run under both UTC and Europe/Prague with identical UTC results.
- Registry fixtures cover suspicious and default Winlogon values.
- Static PE and API Monitor tests cover COM-only false positives, valid WMI patterns, and retained anti-debug detection.