WinSecMon documentation

Requirements

• OS: Windows 10 / Windows Server 2016 or newer (tested up to Windows 11 / Server 2025). Best-effort legacy support back to Windows 7 / Server 2008 R2 with WMF 5.1.
• Shell: Windows PowerShell 5.1 (PowerShell 7 supported for Windows-only APIs).
• Privileges: Administrator recommended — a handful of checks are admin-only. The scan is always read-only.
• Network: optional. Cloud / M365 checks automatically skip when the host is offline or air-gapped.

Verify the publisher & trust

The beta package is Authenticode-signed with ScaryByte's publicly trusted SSL.com OV code-signing certificate (CN=SCARYBYTE (PTY) LTD), so Windows already recognises the publisher — no certificate import is required. Confirm the signature before running:

:: From the extracted package
Get-AuthenticodeSignature .\WINSECMON.exe

It should report Valid for CN=SCARYBYTE (PTY) LTD. SmartScreen may still show a one-time caution on a brand-new download until it accrues reputation — choose More info → Run anyway after verifying the SHA-256.

Running a scan

The simplest path is to double-click WINSECMON.exe — it self-elevates and runs a thorough assessment with the profile that best matches the host. From a shell you have more control:

:: Default assessment (auto profile)
.\WINSECMON.exe scan

:: Pick a host profile explicitly
.\scarybyte.ps1 scan -Profile workstation
.\scarybyte.ps1 scan -Profile server
.\scarybyte.ps1 scan -Profile domaincontroller

:: Air-gapped / offline (skip cloud checks)
.\scarybyte.ps1 scan -NetworkMode offline -Offline

Host profiles

• workstation — endpoint hardening, local accounts, exposed services and legacy protocols.
• server — member-server roles, exposure and service posture.
• domaincontroller — full AD, ADCS and attack-path coverage in addition to host checks.

Reports & forensic evidence

Each run writes a timestamped report set plus an evidence manifest:

• HTML — a summary and a detailed report for analysts and stakeholders.
• CSV / JSON — machine-readable findings for pipelines and ticketing.
• Evidence manifest — a SHA-256 manifest over every output file, with per-file sidecars.

Findings are graded Pass, Fail, Warn, Info or NotApplicable, each carrying a severity, the supporting evidence, and a remediation recommendation. The tool re-verifies its own manifest at the end of a run and reports INTACT when nothing has been altered.

Reading the exit code

• 0 — completed, no failing findings.
• 1 / 2 / 3 / 4 — completed with Low / Medium / High / Critical findings present on the host (expected on un-hardened systems, not a tool error).
• 10 — a fatal error prevented the scan from completing.

Scope & honesty

WinSecMon reports posture; it does not change configuration and it does not assert that any third-party security control (such as Microsoft Defender or SmartScreen) will or won't react to it. During the beta, AD / ADCS / Entra / M365 / Graph checks are implemented and exercised in the field but are not yet independently lab-validated across every edge case — always confirm a finding before acting on it in production.