The WinSecMon beta program (archived)

What the beta includes

• 244 checks across 20 domains — Active Directory, ADCS, attack paths, accounts, policy, host exposure and more. The check count is unchanged from 2.0.0-beta — 3.0.0-beta ships no new detections; it is a reliability release.
• Read-only, agentless execution — nothing is installed or changed on the target; the scan runs in memory.
• Forensic-grade reporting — HTML, CSV and JSON outputs, each with a SHA-256 evidence manifest and runtime integrity verification.
• Host profiles — tuned check sets for workstation, member server and domain controller roles.
• Offline / air-gapped mode — cloud-dependent checks auto-skip when the host has no connectivity.

What's new in 3.0.0-beta

• Bounded Security EventLog collection. v3.0.0-beta improves Security EventLog collection for noisy environments by using bounded per-event-ID collection. In lab validation, rare lockout and log-clear events were preserved under noisy failed-logon volume, truncation was reported honestly, and the controlled test showed faster collection. This is not a universal production speed guarantee.
• No detection changes. The catalog remains 244 checks across 20 domains — findings from a 2.0.0-beta scan and a 3.0.0-beta scan of the same host are directly comparable.

Current status

• Engine & reporting: stable — exercised in internal QA and on a live domain controller.
• Active Directory / ADCS / Entra / M365 / Graph checks: implemented and exercised in the field, but not yet independently lab-validated across every edge case. Review findings before acting on them.
• Code signing: beta builds are signed with ScaryByte’s publicly trusted SSL.com OV code-signing certificate (CN=SCARYBYTE (PTY) LTD), so Windows shows a verified publisher out of the box.

Known limitations

• The build is signed with a publicly trusted OV certificate, so Windows recognises the publisher automatically. SmartScreen may still show a one-time caution on a brand-new download until it accrues reputation — choose More info → Run anyway after verifying the SHA-256.
• Cloud and directory checks depend on the rights of the account running the scan; run elevated and with appropriate read access for full coverage.
• A small number of checks require Administrator rights; without elevation they report as not-applicable rather than failing.

Verify & trust the build

Before running any beta build, confirm its integrity and verify the publisher signature:

1. Download the package from the download section.
2. Verify the SHA-256 of the .zip against the published value below.
3. Optionally confirm the publisher: right-click WINSECMON.exe → Properties → Digital Signatures, or run Get-AuthenticodeSignature .\WINSECMON.exe — it should report Valid for CN=SCARYBYTE (PTY) LTD.
4. Launch WINSECMON.exe elevated. The tool re-verifies its own signed evidence manifest at runtime and reports INTACT when untampered.

WINSECMON-v3.0.0-beta.zip — SHA-256:

5106EC6E8A6129DA735C36E2F8D7E08CEAC0EEB2F126ED2146110468E695EEA0

Verify on Windows with:

Get-FileHash .\WINSECMON-v3.0.0-beta.zip -Algorithm SHA256

Share feedback

Found a false positive, a crash, or a check that misreports on your estate? That's exactly what the beta is for. Capture the generated logs/ folder from the run and send it to your ScaryByte contact so we can reproduce and fix it quickly.