Every tool, in detail.

Scans 22 Windows autostart families: registry Run keys, services and drivers, ServiceDll, scheduled tasks, Winlogon, AppInit, IFEO/SilentProcessExit, WMI subscriptions, startup folders, LSA packages, print monitors, credential providers, browser helper objects, COM hijacks and screensavers. Every image is Authenticode checked, with optional VirusTotal enrichment.

ACTION → Inspect details, reveal the validated file location, or open Windows Startup apps.

LIMITS → A notable result is a signal to investigate, not proof of malware.

Per-application block/allow enforced through the Windows Filtering Platform by an opt-in LocalSystem service. Starts audit-only; an elevated operator arms enforcement through the dashboard's authenticated IPC flow. Desired intent and effective runtime state are always reported separately.

ACTION → Set policies and enable enforcement through the dashboard only. Direct mutation aliases are disabled by design.

LIMITS → The service is not installed by setup. Installing it is an explicit elevated decision. No per-connection interactive prompts; policy is set per application.

A live tray alert the moment a new startup item appears, plus reconciliation of everything that changed while WinSight was not running.

ACTION → Review the new item, its signature verdict, and who wrote it.

LIMITS → Observes and alerts; real-time blocking would require a signed kernel driver, which is not shipped.

Hidden decoy files plus rename/delete-burst and entropy-on-write heuristics. The one feature that writes anything (its decoys), which is why it stays off until you turn it on, and removes them when you turn it off. The integrity check also reports whether Windows' own kernel-level blocker, Microsoft Defender Controlled Folder Access, is actually switched on.

ACTION → Investigate the flagged process; write attribution names it when running elevated. If Controlled Folder Access is off, WinSight links you to the Windows Security page where you turn it on.

LIMITS → Detection, not interception. It alerts on suspicious activity but does not block file writes; blocking a write mid-encryption needs a signed kernel minifilter WinSight does not ship. It reads and reports Controlled Folder Access posture, but never enables, disables or configures it: the operator changes that in Windows.

Current and historical Capability Access usage for webcam and microphone, plus live CLI transitions with av --watch.

ACTION → Identify the application and open Windows privacy settings.

LIMITS → Reads the Capability Access records Windows maintains; software that bypasses Windows capability accounting is out of scope.

IPv4/IPv6 TCP and UDP connections with owner process, image and signature; resolver-cache DNS records and administrator-only live ETW queries. External established connections with unsigned owners are notable.

ACTION → Inspect the executable, correlate domains with activity, or open Resource Monitor.

LIMITS → DNS cache data is historical visibility and does not by itself attribute every query to a process; live DNS ETW needs elevation. No packet inspection and no traffic-volume graphs.

Authenticode verdicts with catalog fallback, used consistently by every other tool. Six-state verdict model that never fabricates an unsigned result from an inconclusive check.

ACTION → Trust the verdict states: what was checked is always stated explicitly.

LIMITS → A valid signature is evidence of origin, not of good behaviour.

Unquoted service paths, writable service directories and PATH entries, and phantom DLL imports, each graded by whether it is actually exploitable on this machine.

ACTION → Fix the exploitable findings first; the grading tells you which ones matter.

LIMITS → Grades exploitability on the scanned machine's current ACLs; results differ between machines.