Skip to content

Security: Masriyan/WinFire

Security

Report a vulnerability

SECURITY.md

Security Policy 🔒

This document outlines security considerations, vulnerability reporting, and important notices for WinFIRE users.

Repository: https://github.com/Masriyan/WinFire/

📋 Table of Contents

✅ Supported Versions

WinFIRE follows its own version line (see CHANGELOG.md). Security fixes target the current release.

Version Status Support
0.3.x 🟢 Current Full support, security updates
0.2.x 🟡 Legacy Critical fixes only
0.1.x 🔴 EOL No support

🛡️ Antivirus Detection

⚠️ WinFIRE WILL trigger antivirus and EDR alerts. This is expected and normal.

Why Detection Occurs

WinFIRE performs operations that security tools flag as potentially malicious:

┌─────────────────────────────────────────────────────────────────┐
│                    WHY AV/EDR DETECTS WINFIRE                     │
├─────────────────────────────────────────────────────────────────┤
│                                                                   │
│  🔍 Registry Access        → Exports & YARA-scans persistence keys│
│  📊 Process Memory Reads    → VirtualQueryEx + YARA over live RAM │
│  🧬 Injection Detection     → RWX / unbacked-executable scanning  │
│  💽 Raw Volume / MFT Reads  → RawCopy of locked $MFT (anti-rootkit)│
│  📜 Event Log Parsing       → Reads PowerShell 4104 script blocks │
│  ⏰ Persistence Enumeration → Autoruns, services, tasks, WMI subs │
│                                                                   │
│  These are LEGITIMATE forensic operations, but they match         │
│  patterns used by threat actors during reconnaissance.            │
│                                                                   │
└─────────────────────────────────────────────────────────────────┘

Handling Detection

Option 1: Add Exclusion (Recommended)

# Add the WinFIRE folder to Windows Defender exclusions
Add-MpPreference -ExclusionPath "C:\Tools\WinFIRE"

# Verify exclusion was added
Get-MpPreference | Select-Object -ExpandProperty ExclusionPath

Option 2: Temporary Disable (Use with Caution)

# Disable real-time protection temporarily
Set-MpPreference -DisableRealtimeMonitoring $true

# Run WinFIRE
WinFIRE.bat -Full -OutputPath "C:\Forensics\Case001" -CaseNumber INC-001

# IMMEDIATELY re-enable protection
Set-MpPreference -DisableRealtimeMonitoring $false

Option 3: Enterprise/EDR Environments

Contact your security team to:

  1. Allowlist the script/binary hashes
  2. Add a process exclusion for the PowerShell process running WinFIRE
  3. Create an approved forensic collection policy

Document for Chain of Custody

Always record AV handling in your notes — WinFIRE also writes a raw\chain_of_custody.json per run:

Chain of Custody Note:
- Date/Time: 2026-06-02 10:30:00
- Action: Added Windows Defender exclusion for C:\Tools\WinFIRE
- Reason: Enable forensic artifact collection
- Removed: 2026-06-02 12:00:00 (after collection complete)

🐛 Reporting Vulnerabilities

What to Report

Report Don't Report
Code execution vulnerabilities AV detection (expected)
Privilege escalation bugs Feature requests
Data exfiltration risks General bugs (use Issues)
Path traversal / injection Documentation errors

Report Process

  1. DO NOT open a public GitHub issue
  2. Email: sudo3rs@protonmail.com
  3. Subject: [SECURITY] Brief Description
  4. Include:
    • Vulnerability description
    • Steps to reproduce
    • Potential impact
    • Suggested fix (optional)

Response Timeline

Phase Timeframe
Acknowledgment 48 hours
Initial Assessment 1 week
Fix Development 2 weeks
Disclosure 30 days after fix

Recognition

Security researchers who responsibly disclose vulnerabilities will be:

  • Credited in CHANGELOG.md (unless anonymity requested)
  • Acknowledged in release notes
  • Added to the Security Hall of Fame

🔐 Security Best Practices

Before Collection

┌──────────────────────────────────────────────────┐
│           PRE-COLLECTION CHECKLIST                │
├──────────────────────────────────────────────────┤
│ □ Obtain written authorization                   │
│ □ Document system state before collection        │
│ □ Verify tool integrity (hash check)             │
│ □ Prepare secure storage for output              │
│ □ Note AV/security tool handling                 │
└──────────────────────────────────────────────────┘

During Collection

  • Run from a dedicated forensic workstation / USB when possible
  • Use -CaseNumber, -Investigator, and -Purpose for organization and custody
  • Monitor for collection errors in winfire.log

After Collection

┌──────────────────────────────────────────────────┐
│          POST-COLLECTION CHECKLIST                │
├──────────────────────────────────────────────────┤
│ □ Verify findings.json / chain_of_custody.json   │
│ □ Move the case folder to encrypted storage       │
│ □ Re-enable any disabled security tools           │
│ □ Remove any temporary exclusions                 │
│ □ Complete chain of custody documentation         │
└──────────────────────────────────────────────────┘

📦 Data Handling

What WinFIRE Collects

Category Data Types Sensitivity
System / Triage Autoruns, services, scheduled tasks Medium
Persistence Registry Run/Winlogon keys, WMI subscriptions High
Process Memory Region maps, YARA matches, injection flags High
Event Logs PowerShell script blocks, security events High
Artifacts Prefetch / Amcache / Shimcache / SRUM, MFT High
Findings / Report findings.json, report.html, decoded data High

WinFIRE produces findings plus raw artifacts in the case folder; it does not copy browser profile databases or dump LSASS. Decoded payloads (from the Deobfuscate module) may contain attacker content — treat the whole case folder as sensitive.

Data Protection Requirements

  1. Encrypt at Rest
    • Use BitLocker on forensic drives
    • Store case folders in encrypted containers
  2. Limit Access
    • Need-to-know basis only
    • Document all access
  3. Secure Transfer
    • Use encrypted channels (SFTP, HTTPS)
    • Password-protect ZIP archives of case folders
  4. Retention
    • Follow organizational policies
    • Honor legal-hold requirements
    • Securely delete when no longer needed

Secure Deletion

# Securely delete a forensic case folder (Windows)
cipher /w:C:\Forensics\Case001

# Or use SDelete (Sysinternals)
sdelete -p 3 -s C:\Forensics\Case001

⚖️ Legal Disclaimer

Authorized Use Only

WinFIRE is intended EXCLUSIVELY for:

  • ✅ Digital forensics investigations
  • ✅ Authorized incident response
  • ✅ Security assessments with written permission
  • ✅ System administration on owned systems

User Responsibilities

┌─────────────────────────────────────────────────────────────────┐
│                    USER RESPONSIBILITIES                        │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  📋 AUTHORIZATION                                               │
│     Obtain proper written authorization before use              │
│                                                                 │
│  🎯 SCOPE                                                       │
│     Only collect from authorized systems                        │
│                                                                 │
│  📜 COMPLIANCE                                                  │
│     Follow applicable laws and regulations                      │
│     - GDPR (EU)                                                 │
│     - CCPA (California)                                         │
│     - HIPAA (Healthcare)                                        │
│     - PCI-DSS (Payment data)                                    │
│                                                                 │
│  🔒 PRIVACY                                                     │
│     Respect individual privacy rights                           │
│                                                                 │
│  📝 DOCUMENTATION                                               │
│     Maintain chain of custody for legal proceedings            │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

Liability

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND. The authors and contributors are not responsible for:

  • Unauthorized or illegal use
  • Data loss or corruption
  • System damage or downtime
  • Legal consequences of misuse

Unauthorized use may violate computer crime laws in your jurisdiction.

Questions? Contact: sudo3rs@protonmail.com

Repository: https://github.com/Masriyan/WinFire/

There aren't any published security advisories