Changelog

Version 1.4.0

Performance

• Descriptions are formatted only when they’re used. Formatting was about 85% of the cost of reading an event, and most scanned events are never displayed. Events a rule or the reboot card needs are formatted while reading; the rest are formatted the first time you look at them, by jumping straight back to the record (about 2 ms). Drill-down rows format only as they scroll into view.
• Events no rule uses skip the expensive parsing step, and the raw XML of each event is no longer kept in memory — nothing read it.

Changed

• “All available” now means all. The per-log read cap rose from 4,000 to 50,000 events (200,000 for an opened .evtx), which reads default-size logs — Security included — in full. On the test machine a scan now covers 70,815 events instead of 13,623, so expect more (older) incidents than before. The cap remains as a safety net and is reported when it is hit.

Added

• Hides can expire. A picker beside Mark as expected sets 7, 30 or 90 days (the default) or Always; the item reappears afterwards. Critical items can be hidden for at most 90 days, and the status line says so if you chose Always. The expected-items manager shows each hide’s end date. Items hidden by earlier versions stay hidden permanently, and the saved list is upgraded automatically.

Version 1.3.0

Added — new audit checks

• Startup folders — the all-users folder and every user’s own, with shortcuts resolved to the program and arguments they actually run. Flags a program or script dropped in directly, a shortcut into a temp or public folder or to a missing file, an encoded PowerShell launch, or a script host (mshta, wscript, powershell, …).
• Unquoted service paths — Critical when a hijack file already exists (e.g. C:\Program.exe), High when an ordinary user could create one (the folder’s real permissions are checked), otherwise Low.
• SilentProcessExit hijacks — a “monitor” program launched whenever another program exits. Critical when armed, Medium when configured but not yet switched on.
• Per-user logon shell — a Shell value in a user’s own Winlogon key, which needs no admin rights and leaves the machine-wide setting looking normal.
• 32-bit IFEO debuggers, Group Policy Run keys, the 32-bit RunOnce key, and Defender exclusions set by Group Policy.
• One window at a time. Launching DeepDig while it is already open brings the open window to the front, and “Restart as administrator” hands over cleanly.

Changed

• The Registry findings tab is now Security audit, since it covers Startup-folder files too. Each finding’s location is labelled Registry path or File path, and file findings get a Show in Explorer button.
• What was checked — an expandable list of every check and its result, so a clean machine shows the checks really ran. The detail pane has a proper empty state.
• The “partial scan” notice is one short line, with the per-log detail in its tooltip — it had grown into a paragraph.

Version 1.2.0

Added — new detections

• Password spraying — one source failing against 10 or more different accounts within 10 minutes. Brute-force detection counts failures per account, so a spray — one or two guesses per account, under the lockout limit — never triggered it.
• Encoded PowerShell launches. The script-block log only ever sees the decoded script, so a powershell -EncodedCommand … launch was invisible. DeepDig now also reads the classic Windows PowerShell log, which records the full command line, and decodes the payload (one nested layer deep, too). A payload that downloads code, bypasses AMSI, changes Defender or loads code into memory — or a launch that hides its window — is High and always gets its own card. Anything else is Low and grouped by the launching tool, so it can be marked as expected once. Shaped by real data: on the test machine all 25 encoded launches came from one developer tool — grouped per payload they would have been 25 un-dismissable High cards.
• Defender exclusion added — path, process, extension or IP exclusions, including policy ones, named in the title.
• Defender protection switched off by setting — real-time, behaviour, download/attachment, script and process scanning, the whole antivirus, and Tamper Protection. Cannot be marked as expected. Shaped by real data: matching every “Disable…” setting flagged Defender’s own internal feature flags, which it flips during updates (8 false alarms on the test machine); it now matches only the user-facing protections.
• Defender could not remove a threat (Critical) — when the threat may still be present.
• Any other event log cleared, naming the log. Cannot be marked as expected.
• Account locked out, naming the machine the attempts came from.
• Security service disabled — Defender, Defender for Endpoint, Security Center, Firewall, Base Filtering Engine, Event Log or Sysmon set to Disabled. Routine start-type changes Windows makes constantly are ignored.
• New correlations: encoded launch → service, task or exclusion; spray → remote-desktop sign-in or lockouts; brute force → lockout; Defender switched off ↔ its setting change.

Changed

• The Defender-disabled rule now also covers malware and virus scanning being disabled, each on its own card and saying what was switched off.

Version 1.1.1

Fixed — “Mark as expected” hid too much

• Encoded-PowerShell detections all shared one signature, so hiding one known-good command hid every encoded command run afterwards. Each is now fingerprinted by its script.
• “Security log cleared” and “Defender real-time protection disabled” can no longer be marked as expected (the button explains why); earlier hides of them are ignored. Repeats still collapse into one card with a count.
• Registry findings were hidden by location only, so changing a hidden value kept it hidden — repointing a Run key, adding a new Defender exclusion, swapping a debugger or service binary. Findings now include a fingerprint of the evidence, so a changed value resurfaces.
• Items hidden in 1.1.0 stay hidden. On the first scan an old entry is carried over to the specific items it covers at that moment, then retired, so it can’t swallow a value that changes later.

Fixed — wrong or noisy results

• Unrelated detections were merged into one incident because they shared the SYSTEM account. An unexpected shutdown and a Defender detection minutes apart became “… (+1 related)”. Built-in service identities and machine accounts no longer link alerts, and account names match case-insensitively.
• “Member added to privileged group” fired for any group — joining Users raised a High alert. It now matches the well-known privileged groups (Administrators, Backup/Account/Server/Print Operators, Remote Desktop Users, Hyper-V Administrators, Domain/Schema/Enterprise Admins, …), works with localised group names, and names the member added.
• Self-updating services were a new detection on every update, because their version is part of the name and path. Versions and GUIDs are now ignored when recognising a service; the binary path still counts, so a look-alike pointing somewhere else is still flagged.
• Encoded PowerShell was missed in several spellings PowerShell accepts — -ec, -enco and any other prefix of -EncodedCommand, a / switch, and en/em dashes. The registry check also recognises pwsh.
• A brute-force burst raised one alert per failure past the threshold — 100 failed sign-ins made 96 alerts. It now fires once per 5-minute window per account.
• Identical Defender cards — detections are now titled with the threat name.
• “Unexpected shutdown” matched event 41 from any source; it now requires Kernel-Power.
• The full path to Windows’ own Explorer was flagged as a replaced logon shell.
• Remote-session alerts said “reconnected” for disconnects. Titles now state which.

Fixed — Live mode and scanning

• Live mode mixed this PC’s alerts into an imported file’s results. Opening a file now stops Live, and going Live over a file’s results rescans this PC first.
• Starting a scan during the registry audit could leave two scans fighting over the screen. Only the newest scan now updates the window.
• Live mode no longer floods the interface on a busy Security log — it decodes only the events a rule looks at and updates its counter on the regular refresh tick.
• A scan cut short by the per-log read limit looked complete. The status line now names any log that was cut short and how far back it reached.
• Registry findings marked as expected no longer drop out of the hidden-item count after a rescan.

Security

• CSV export neutralises formula cells. A cell starting with =, +, - or @ is prefixed so spreadsheet apps don’t evaluate it — defence in depth for names an intruder can choose (services, tasks, accounts).

Version 1.1.0

Fixed — wrong results

• Application-crash detections matched any source using event ID 1000, including one that logs a whole stack trace as a parameter — which then became the incident title and the CSV export. Crash and hang rules now require the genuine Application Error and Application Hang sources. On a real machine this cut a noisy 279 “incidents” down to 13 real ones.
• Rescanning the same source reported detections that were not there. The sliding-window state inside the stateful rules (brute force, for instance) survived between scans and replayed earlier timestamps — a second scan of an identical log went from 6 alerts to 10. Each scan now starts clean, and opening an older .evtx after a live scan no longer disables its rules.
• Severity counters counted alerts rather than incidents — a burst of 100 failed sign-ins read as “HIGH 96” next to a single card. They now match the list beside them.
• Template placeholders leaked into the text you read — “reported in module {{param4}}”. A missing property now renders as “(not recorded)”, and long values are collapsed to one line.
• “Mark as expected” silently did nothing on a correlated incident. Only the primary alert was suppressed, so the rest immediately re-formed the same card. Every signature in the chain is now suppressed — and the registry side updates its hidden-item count like the event side always did.

Fixed — crashes, hangs and exports

• Chart drill-downs and the reboot “View all” button threw an error instead of opening.
• A corrupt or truncated .evtx could spin the CPU indefinitely — a failing read neither advanced nor counted, so the loop never ended. Both readers now give up after 25 consecutive failures.
• CSV exports opened mangled in Excel — en dashes, middots and “×” in the narratives came through as gibberish. A failed export (read-only folder, file open elsewhere) now reports on the status line instead of raising a crash dialog.
• Turning Live off during its baseline scan still started the watchers, and drag-and-drop bypassed the busy guard, allowing a second analysis to run on top of the first.
• The log file did not roll at midnight — a session left running overnight kept appending to the previous day’s file.

Added

• Scan time range — last 24 hours, 7 days, 30 days, or all available. Live channels are filtered at the source, so narrowing the window is genuinely faster rather than reading everything and discarding it. For an imported .evtx the window is anchored on the file’s own newest event, so “last 7 days” of a months-old export still returns its last 7 days.
• A Cancel button for a scan or registry audit already in flight.
• Open several .evtx files at once — multi-select or drop a batch — and analyse them as one correlated timeline. A corrupt or locked file is skipped without losing the rest of the batch.
• An expected-items manager. Review everything you have hidden, see whether each came from an event detection or a registry finding, and restore them individually instead of all-or-nothing.
• Search and a severity filter over the incident list, with a live “X of Y” count and a Clear action.
• A new detection for remote sessions being reconnected or disconnected. The existing rule only caught a fresh remote sign-in, so someone who parks a session and reattaches later produced nothing at all.
• Registry paths and evidence are selectable and copyable, with explicit Copy buttons — they are the strings you paste into the registry editor or a ticket.
• The command-line --analyze mode gained --days=N and accepts several .evtx paths, mirroring the window.

Changed

• DeepDig follows your Windows light/dark preference and tracks changes live, instead of being locked to dark.
• Live monitoring no longer rebuilds the incident list when nothing has changed. It used to reset your scroll position and selection every 800 milliseconds. Correlation also retires closed clusters rather than re-testing every cluster it has ever created.
• Severity chips are now chosen by measured contrast rather than a rough brightness test. The critical-red chip sat at 3.5:1, below the 4.5:1 accessibility floor, and is now 5.2:1; all five severities pass, and a test keeps them passing.
• The results area survives higher display scaling instead of colliding with the view switcher, stat tiles wrap rather than clipping the longest label at minimum window size, and all counts are thousands-separated.
• A recurring incident shows its count once as a badge rather than twice, and the empty state no longer flickers between two messages.
• Accessibility — names on interactive elements for screen readers, and a visible keyboard focus ring on the custom buttons and pills.

Testing

• 48 tests, up from 21 — covering rescan repeatability, the crash-rule source filter, placeholder leakage, multi-file analysis and its error isolation, time ranges, the remote-session rule, the expected-items manager, and severity-chip contrast.
• A new test asserts that every colour the interface references resolves in both themes. A missing one neither crashes nor fails the build — it just renders blank — and this caught a real one.

Version 1.0.0

Analysis

• Event-log analysis — live local scan (“Scan This PC”) and offline .evtx import through a single engine.
• Built-in detection rules across credential access, persistence, privilege escalation, lateral movement, defense evasion, execution, stability and performance.
• Correlation & plain-English narratives — related alerts grouped into incidents with a readable story, severity, recommended actions and a MITRE ATT&CK mapping.
• De-duplication (“seen N×”) and suppression (“Mark as expected”), remembered across runs.
• Live real-time monitoring — a Live toggle streams new alerts with continuously updated correlation.
• Export incidents to CSV or JSON.

Trends & insights

• Trends view — charts of detections and events over time, top event types, and a by-category breakdown. A Detections | All events toggle switches each chart between active detections and the whole scanned log; click any bar to open a time-ordered, human-readable event list.
• Last-reboot card — last boot time, reason and kind (planned / unexpected); click for the full startup and shutdown history.

Registry Security Audit

• A read-only state inspection that runs after a local “Scan This PC”, in its own Registry findings tab. Checks Run/RunOnce keys, Winlogon tampering, IFEO debugger hijacks, UAC-bypass artifacts, Defender disable/exclusions, PowerShell policy and logging, suspicious-path services, installed remote-access tools, and USB / outbound-RDP history.
• Every finding carries a registry path, the evidence, an explanation, remediation, and a MITRE ATT&CK mapping — and can be marked as expected.
• USB findings show each device’s exact last-connected date and time.

App & reliability

• Branded splash and About window ((i) button) with the version and build number and a clickable backendside.com link; the product logo appears in the title bar and sidebar.
• Runs as the normal user (no forced prompt). When not elevated, a dismissible hint offers Restart as administrator for full coverage (live Security log + admin-only registry checks); the Microsoft Store build uses .evtx import for full coverage instead.
• Local rolling logs kept on your PC for the last few days (no telemetry), plus graceful error handling so a failure is reported rather than crashing the app.

Notes

• The Registry findings tab appears only after a local scan, not for imported .evtx files.
• Administrator rights unlock the live Security log and a few machine-wide registry checks; everything else works without admin.