WinCyberScan™ Windows Security Threat Scanner
← Back to Home

What WSTS checks

Prefetch execution

Flags execution of known offensive-security tools and Windows LOLBins (Mimikatz, PsExec, certutil, mshta, and more).

Startup persistence

Inspects user and global Startup folders for suspicious scripts, shortcuts, and recently planted payloads.

Event-log tampering

Detects cleared or recently modified Security, System, and Application logs — a common anti-forensic move.

Credential stores

Checks DPAPI and Credential Manager artifacts for recent modification that may indicate theft attempts.

Amcache & NTUSER

Reviews application-execution history hives for recent tampering or unusual activity.

Local report

Results render in your browser at 127.0.0.1 — generated on-device and never uploaded.

Understanding your results

Every finding is shown in a table with five columns. Here is what each one means.

ColumnWhat it means
SEV Severity — how much attention this item deserves.
LOW Normal background activity worth noting.
MEDIUM Ran recently or is a commonly-abused tool — worth a quick look.
HIGH Known attack tool, suspicious location, or tampered log — investigate.
Executable The name of the program Windows recorded. Standard Windows processes like SVCHOST.EXE, MSEDGE.EXE, and DLLHOST.EXE are normal. Be alert to names you don’t recognise or known attack tools like MIMIKATZ.EXE or PSEXEC.EXE.
Last Run The exact date and time Windows last recorded that program running. Useful for checking whether activity happened at an unexpected time (e.g. 3 AM when nobody was at the computer).
Age How long ago the program ran, shown in hours or days (e.g. 0h = within the last hour, 2d = two days ago). Shorter ages mean more recent activity.
Flags The reason the item appears in the list. Common flags:
  • RAN_LAST_1H / RAN_LAST_24H — ran very recently. Not alarming on its own — just means it was active.
  • KNOWN_SUSPICIOUS_TOOL — matches a known hacking or exploitation tool by name. Investigate immediately.
  • POSSIBLY_CLEARED — an event log is empty or was recently wiped. Normal if you or IT cleared it; suspicious if unexplained.
  • RECENTLY_MODIFIED — a credential or registry artifact changed recently. Cross-check with your own activity.
  • SUSPICIOUS_LNK_TARGET / SCRIPT_IN_STARTUP — a startup shortcut points somewhere unusual, or a script is set to run at login. Worth reviewing.

Quick guide: is this finding a problem?

  1. Check the Executable name. Is it a program you recognise? Standard Windows names are almost always safe.
  2. Check the Last Run time. Did it run while you were at the computer doing something that explains it?
  3. Check the Flag. RAN_LAST_1H alone is informational. KNOWN_SUSPICIOUS_TOOL or POSSIBLY_CLEARED with no explanation — escalate.
  4. If you cannot explain a finding, do not ignore it. Disconnect the machine from the network and contact an IT or security professional.
Download WSTS — Free