Every tool, in detail.

Scans 27 Windows autostart families, including registry Run keys, services and drivers, ServiceDll, scheduled tasks, Winlogon, AppInit, IFEO/SilentProcessExit, WMI subscriptions, startup folders, LSA packages, print monitors and providers, credential providers, browser helper objects, Windows Load/Run values, COM hijacks, screensavers and .NET profiler injection. Every image is Authenticode checked, with optional VirusTotal enrichment. It reads the command line too, not just the file: a signed Windows interpreter — rundll32, mshta, regsvr32, powershell — pointed at a remote location, a per-user path, an encoded script or a scriptlet is flagged even though the executable verifies perfectly, and scheduled tasks report their arguments so the DLL or script a task actually loads is visible.

ACTION → Inspect details, reveal the validated file location, or open Windows Startup apps.

LIMITS → A notable result is a signal to investigate, not proof of malware. The command-line check reads what is written. A payload assembled at runtime, or one that is neither remote, per-user nor encoded, is out of its reach. v0.12.0 and v0.13.0 did not recognise the genuine Windows interpreters: their compiled-in name was read from the language (.MUI) file. v0.14.0 fixes it.

Per-application block/allow enforced through the Windows Filtering Platform by an opt-in LocalSystem service. Starts audit-only; an elevated operator arms enforcement through the dashboard's authenticated IPC flow. Desired intent and effective runtime state are always reported separately.

ACTION → Set policies and enable enforcement through the dashboard only. Direct mutation aliases are disabled by design.

LIMITS → The service is not installed by setup. Installing it is an explicit elevated decision, and it needs WinSight installed for all users: the service refuses to run from a folder the user can write, such as the default per-user install. No per-connection interactive prompts; policy is set per application.

A decision window the moment a new startup item appears: Allow silences it, Block removes it into a restorable quarantine, and "decide later" keeps it for review. What changed while WinSight was not running is reconciled at the next start.

ACTION → Review the new item, its signature verdict, and who wrote it.

LIMITS → It acts once an item has appeared; preventing the write itself would require a signed kernel driver, which is not shipped. Block covers the current user's Run/RunOnce values and Startup files; machine-wide items can be allowed but not yet blocked.

Visible, machine-varied decoy files plus rename/delete-burst and entropy-on-write heuristics. The one feature that writes anything (its decoys, in your Documents, Desktop, Pictures, Downloads, Videos and Music folders), which is why it stays off until you turn it on. Turning it off, or uninstalling, removes the decoys it can prove are its own and unchanged. The integrity check also reports whether Windows' own kernel-level blocker, Microsoft Defender Controlled Folder Access, is actually switched on.

ACTION → Investigate the flagged process; write attribution names it when running elevated. If Controlled Folder Access is off, WinSight links you to the Windows Security page where you turn it on.

LIMITS → Detection, not interception. It alerts on suspicious activity but does not block file writes; blocking a write mid-encryption needs a signed kernel minifilter WinSight does not ship. It reads and reports Controlled Folder Access posture, but never enables, disables or configures it: the operator changes that in Windows.

Current and historical webcam and microphone use from the consent store Windows keeps, per application, with a desktop app matched to its running process where possible, plus live CLI transitions with av --watch.

ACTION → Identify the application and open Windows privacy settings.

LIMITS → Reads the consent-store records Windows maintains; access that bypasses Windows' capability broker, such as legacy DirectShow capture or a driver, leaves no record and is not seen.

IPv4/IPv6 TCP and UDP connections with owner process, image and signature; resolver-cache DNS records and administrator-only live ETW queries. External established connections whose owner is unsigned, untrusted or trusted only through a root certificate this user installed are notable.

ACTION → Inspect the executable, correlate domains with activity, or open Resource Monitor.

LIMITS → DNS cache data is historical visibility and does not by itself attribute every query to a process; live DNS ETW needs elevation. No packet inspection and no traffic-volume graphs.

Authenticode, catalog and verified MSIX package verdicts, used consistently by every other tool, with a six-state verdict model that never fabricates an unsigned result from an inconclusive check. Any file can be checked on demand: File Explorer's “Check signature with WinSight” opens a window with the verdict, signer, trust caveats and MD5/SHA-1/SHA-256, and winsight sign <path> gives the same from the command line.

ACTION → Trust the verdict states: what was checked is always stated explicitly.

LIMITS → A valid signature is evidence of origin, not of good behaviour. Revocation is checked against the local cache only, because the optional VirusTotal lookup is WinSight's one outbound connection: a certificate whose revocation Windows has never fetched is reported as trusted, with its revocation state undetermined.

Unquoted service paths, writable service directories and PATH entries, and phantom DLL imports, each graded by whether it is actually exploitable on this machine. It writes nothing: Windows' own access check answers whether the non-elevated user could create a file there.

ACTION → Fix the exploitable findings first; the grading tells you which ones matter.

LIMITS → Grades exploitability on the scanned machine's current ACLs; results differ between machines. Run as SYSTEM or with UAC off, where no non-elevated token exists, it reads the ACLs for the well-known unprivileged groups instead, which misses a grant to one named user, and the report says so.