Skip to content

CHECKS.md

Latest commit

 

History

History
368 lines (332 loc) · 63.4 KB

CHECKS.md

File metadata and controls

368 lines (332 loc) · 63.4 KB
Raw

TCPK - Check Catalogue

Public cmdlets, grouped by bucket. This page covers a subset of the 335 that ship; run Get-TcpkInfo or Get-Command -Module TCPK for the authoritative live list. GATED cmdlets require Enable-TcpkExploit -Acknowledge.

Supported targets: TCPK is path-based, not installer-specific. Point it at an MSIX/AppX/.msixbundle/.zip package, an installed/extracted app folder, or a single .exe (portable apps). It works the same on MSIX, MSI, ClickOnce, Squirrel and portable apps; the 8 MSIX-manifest checks (bucket B) auto-skip when there is no AppxManifest.xml. For thin-client apps it audits the client-side binaries only -- the remote server/API is out of scope (separate web/API engagement), as is the thin-client terminal OS/appliance (run TCPK where the Windows PE binaries live, e.g. a Citrix/RDP published-app host).

A - Static binary analysis (92)

  • Get-TcpkPeHardening - Per-DLL binary-hardening matrix (ASLR / DEP / CFG / HighEntropyVA / ...).
  • Get-TcpkSigningMatrix - Per-DLL code-signing matrix (signed / not signed -- information only; SIGNED / CATALOG / UNSIGNED / TAMPERED / UNTRUSTED + signer). Drives the GUI 'DLL Signing' tab, HTML signing table and Excel 'DLL Signing' sheet.
  • Test-TcpkAmsiSurface - A26. AMSI integration and evasion surface detection.
  • Test-TcpkAotBinary - A27. .NET Native AOT binary detection (evades IL-based analysis).
  • Test-TcpkAppDomainHijack - A28. AppDomainManager injection surface in .NET executables (T1574.014).
  • Test-TcpkAppStack - A40. Application technology-stack fingerprint with analysis-coverage note.
  • Test-TcpkArchiveExpansion - A75. Shipped archives whose expansion ratio makes them a resource-exhaustion hazard.
  • Test-TcpkAssemblyBindingTrust - A70. Assembly load redirection and CLR trust downgrades in shipped .config. Rules: dotnet.codebase-remote (HIGH, <codeBase href> to http/UNC), dotnet.load-from-remote-sources, dotnet.legacy-security-policy, dotnet.probing-path-escape, dotnet.publisher-policy-disabled. A bare bindingRedirect is deliberately not reported.
  • Test-TcpkAuthFlags - A23. Client-side authentication / licensing boolean flags.
  • Test-TcpkBlePairing - A56. BLE pairing model. Extends A50 to report DevicePairingProtectionLevel.None (HIGH), Encryption without EncryptionAndAuthentication (MEDIUM), PairAsync with no protection literal (MEDIUM), ConfirmOnly-only DevicePairingKinds (HIGH), auto-accept via zero-arg Accept() in PairingRequested handler (HIGH), hardcoded passkey / 128-bit key material near BLE call sites (HIGH), 32feet.NET Confirm=true + no address check (HIGH), Qt pairingConfirmation(true) (HIGH), native BLUETOOTH_MITM_PROTECTION_NOT_REQUIRED (MEDIUM), and Nordic/TI/Silabs SDK legacy-pairing markers (MEDIUM). Gated on a BLE anchor in the same file to keep unrelated DevicePairingProtectionLevel usage (Wi-Fi Direct, Miracast) out.
  • Test-TcpkCallsites - A11. Static reference scan for dangerous API patterns, managed and native: weak hashes, ECB, non-crypto RNG, insecure temp files, cert-validation callbacks, XSLT injection, and the legacy Windows engines (MSHTML / WebBrowser control, Active Scripting, MSXML XSLT). Keys on COM interface names as well as .NET type names, so a native host is matched too.
  • Test-TcpkCefSharp - A52. Detects CefSharp / CEF JavaScript-to-native bridge registration, remote-debugging port, WebSecurityDisabled and file-scheme cross-access. HIGH on the bridge and disabled-security flags; INFO scope-only when CefSharp is embedded but nothing higher fires.
  • Test-TcpkCertBundle - A65. Certificates and key material shipped in the install tree: embedded private keys, SHA-1 signatures, weak RSA sizes, expired and near-expiry certs, self-signed roots. Skips OS CA bundles.
  • Test-TcpkClickOnce - A29. ClickOnce deployment hijack surface detection.
  • Test-TcpkCodeIntegrity - A15. AppxMetadata\CodeIntegrity.cat signature status.
  • Test-TcpkComInterop - A72. The target's own COM consumption: [ComImport] RCW surface and late-bound activation. TCPK's other COM checks read the registry server side; this reads the client. Literal-argument gate keeps hardcoded ProgIDs at INFO. Rules: com.interop-rcw-surface, com.late-bound-activation, com.bind-to-moniker, com.get-active-object.
  • Test-TcpkCrashReporter - A47. Electron / Crashpad crash-reporting exposure (T1005). Electron apps use Crashpad, not Windows Error Reporting, so the WER checks do not apply to them and this one does. Recovers crashReporter.start() config (uploadToServer, submitURL, extra{}) from app.asar and loose first-party JS, and inspects the Crashpad database under the app's own userData directory for dumps and a weak ACL. Attribution is by construction: the database lives inside %APPDATA%<productName>\Crashpad, so no other product's crash data is examined.
  • Test-TcpkCryptoMisuse - A13. Crypto-misuse hunter -- hardcoded key material + weak KDF / padding. Also emits crypto.iv-equals-key HIGH Confirmed when the SAME identifier is assigned to both .Key and .IV within 512 chars in the source text, OR when the same byte-array literal is used for both - the AES-GCM nonce-reuse / CBC deterministic-encryption failure mode.
  • Test-TcpkCsvInjection - A39. CSV / spreadsheet formula injection on export (CWE-1236): export sink with no formula-character neutralization.
  • Test-TcpkDebugFlags - A16. Debug switches, security-disabling flags, and backdoor markers.
  • Test-TcpkDependencyConfusion - C29. Dependency confusion attack surface in package manager configuration.
  • Test-TcpkDeserBinder - A71. Whether a type-reconstructing formatter sink is actually guarded by a SerializationBinder. Absence assembly-wide is what makes the sink exploitable; a call-site scan is silent about it. Rules: deser.binder-absent (HIGH), deser.binder-present (INFO, de-escalation evidence).
  • Test-TcpkDeserialization - A10. Static heuristic for unsafe .NET deserialization patterns.
  • Test-TcpkDevArtifacts - A36. Leftover dev/build artifacts shipped in the release (build hygiene): debug symbols, source, backups, dev-config, API specs, .git/IDE dirs.
  • Test-TcpkDeviceComm - A50. Device-communication surface: serial, USB HID/WinUSB/libusb, BLE, Bluetooth Classic and DeviceIoControl driver calls. Reads .NET IL and native PE imports; emits one finding per channel referenced.
  • Test-TcpkDiagConfig - A30. Shipped diagnostic/logging framework configs with exposure risk.
  • Test-TcpkDiscoveryProtocols - A51. Local-network discovery protocols the client speaks: mDNS, SSDP/UPnP, WS-Discovery, ONVIF, LLMNR/NetBIOS, vendor UDP broadcast.
  • Test-TcpkDllSideload - A31. DLL side-loading opportunities via known target DLL names (T1574.002). Examines every first-party PE module (.exe, .dll, .node, .pyd), not just executables, since DLL-to-DLL side-loading is the same primitive. Delay-load imports count too and are called out as the stronger case. Emits one finding per target DLL listing its importers, rather than one per importing module.
  • Test-TcpkDotenvSecrets - A60. Parses shipped .env / .env.local / .env.production files as KEY=VALUE and flags secrets by KEY NAME rather than value entropy - closes the low-entropy blind spot in Test-TcpkEntropySecrets. Rules: cfg.dotenv-secret-name HIGH per line whose key matches a curated pattern (*_PASSWORD, *_SECRET, *_API_KEY, AWS_SECRET_ACCESS_KEY, STRIPE_SECRET_KEY, JWT_SECRET, ...) with a non-placeholder value, cfg.dotenv-secret-url-embedded CRITICAL when a value is a URL containing user:pass@, cfg.dotenv-shipped-in-release LOW inventory rule for every .env in the tree (downgrades for .env.example / .env.sample / .env.template). Values are masked in evidence.
  • Test-TcpkDotnetHostHijack - A43. Modern .NET host redirection (T1574.012 / T1574.001). Covers the .NET Core / 5+ vectors that replaced AppDomainManager injection: CLR profiler (COR_PROFILER / CORECLR_PROFILER, an unmanaged DLL loaded before any managed code runs), DOTNET_STARTUP_HOOKS, runtimeconfig.json additionalProbingPaths, writable runtimeconfig.json / deps.json, and single-file bundle extraction (DOTNET_BUNDLE_EXTRACT_BASE_DIR). Findings are split by attribution: the app's own files and shipped launchers are vendor-reportable, while profiler and hook variables already set in the machine or user environment are labelled as environment state the vendor cannot fix, and are reported only when they resolve to something.
  • Test-TcpkElectron - A24. Electron / Chromium-embedded insecure configuration (renderer flags incl. nodeIntegration / contextIsolation / sandbox / webSecurity / nodeIntegrationInSubFrames / experimentalFeatures / enableBlinkFeatures / nodeIntegrationInWorkers / webviewTag / webSQL / experimentalCanvasFeatures). Also flags TLS certificate-validation bypass in the bundled JS (electron.cert-validation-bypass, electron.cert-error-accept-all): a setCertificateVerifyProc with no callback(-2) reject path, rejectUnauthorized:false, NODE_TLS_REJECT_UNAUTHORIZED=0, or an accept-all certificate-error handler.
  • Test-TcpkElectronFuses - A42. Electron Fuses audit: parses the @electron/fuses wire from the app binary and flags insecure fuse states as Confirmed facts (EnableCookieEncryption off = plaintext cookies; RunAsNode / EnableNodeCliInspectArguments on = node-exec / --inspect LOLBins; EnableNodeOptionsEnvironmentVariable on = NODE_OPTIONS=--require ./x.js LPE under the signed app identity; EnableEmbeddedAsarIntegrityValidation off = tamperable app.asar) plus a full fuse-posture summary.
  • Test-TcpkElectronJs - A41. Electron/JS vulnerable-code-pattern scan: dangerous sinks in the bundled JS (child_process/eval/Function/string-setTimeout exec, shell.openExternal file://, innerHTML/document.write/v-html DOM XSS, unsanitized markdown, resource-protocol path traversal, missing navigation guard, prototype pollution, script-initiated navigation (location.href/window.open/javascript:), CSS-injection/scriptless, weak CSP unsafe-inline/eval/hardcoded-nonce, unsafe tag, wildcard postMessage, dangerous command-line switches, dynamic executeJavaScript, insertCSS, always-allow permission handler) emitted as Inferred leads. Rules in Data/electron-js-sinks.json.
  • Test-TcpkElectronUpdaterFeed - A67. electron-updater / Squirrel feed audit. Rules: update.electron-feed-plaintext, update.electron-feed-generic-nopin (generic provider with no publisherName to pin the installer signer), update.electron-dev-update-shipped, update.electron-no-publisher.
  • Test-TcpkEmbeddedBlobs - A48. Whole-file signature scan: find file formats embedded at arbitrary offsets.
  • Test-TcpkEmbeddedScripts - A20. Embedded script files shipped in the package.
  • Test-TcpkEndpoints - A09 -- URL extraction + dev / qe / staging classifier.
  • Test-TcpkEntropySecrets - A12. Entropy-based secret detection in text / config / source files.
  • Test-TcpkFirmwareImages - A49. Firmware images shipped inside the install tree (UF2, DFU, ELF, Intel HEX, SREC, raw .bin, ZIP flash bundles). Escalates to HIGH when the resting DACL is user-writable.
  • Test-TcpkFirmwareManifest - A55. Parses JSON firmware manifests (files that name both a version and a download URL) and reports whether they carry a signature, an integrity hash, and downgrade protection. Rules: plaintext-url (HIGH), no-signature (HIGH), hash-only (MEDIUM), weak-hash (HIGH -- MD5/SHA1/CRC32/xxhash), no-rollback-guard (LOW). Static complement to K25 Invoke-TcpkFirmwarePlantProbe.
  • Test-TcpkGoRustDeps - Recover the dependency set embedded in statically-linked binaries: Go build-info modules and versions, and Rust crate names/versions inferred best-effort from Cargo registry source paths. Feeds the same OSV/CVE matching as NuGet and npm.
  • Test-TcpkHollowingApis - A32. Process hollowing / DLL injection / APC injection P/Invoke patterns in .NET PEs.
  • Test-TcpkIotCloudCreds - A63. AWS IoT Core Thing certificates and Azure IoT Hub connection strings shipped in the artifact.
  • Test-TcpkJavaBundle - A35. Crack shipped Java archives (jar/war/ear) and scan entries for secrets + insecure-TLS markers.
  • Test-TcpkJavaNativeLoad - A46. Java/JNI native library loading (T1574.001 / T1129). Java thick clients load Windows DLLs through System.loadLibrary (resolved against java.library.path) and System.load (an absolute path). Flags a writable directory on java.library.path set by a shipped launcher, .bat/.vbs/.cmd wrapper or config file; a writable JAR whose manifest Class-Path pulls in siblings; and shipped native libraries next to the JARs. A loadLibrary call whose path TCPK cannot resolve statically is reported as an unevaluated lead (jni.load-path-unevaluated) rather than silently dropped, so an unresolvable case is visible instead of looking clean.
  • Test-TcpkJavaSigning - JAR signing structure: unsigned archives (severity raised when the containing directory is writable), mixed-signature JARs where content entries appear in no .SF or MANIFEST.MF Name section, and MD5/SHA1 digest algorithms. Structural reading only; no signature is cryptographically verified, so pair it with jarsigner -verify.
  • Test-TcpkJsSourceMap - A61. JavaScript source-map exposure. Rules: js.sourcemap.shipped MEDIUM (a .js.map file ships alongside a shipped .js; DevTools reconstructs the original TypeScript / JSX including comments, private class names and inline endpoints), js.sourcemap.comment-inline MEDIUM (a shipped .js has a //# sourceMappingURL= comment), js.sourcemap.datauri HIGH (the sourceMappingURL is data:application/json;base64,... - pre-bundle source embedded verbatim in the shipped .js). Skips known third-party vendor paths (node_modules/@types|@babel|react|electron|..., site-packages/, resources/electron/, vendor/) so the report stays scoped to first-party JS.
  • Test-TcpkJwt - A14. Embedded JSON Web Token (JWT) discovery + weakness analysis.
  • Test-TcpkMarkOfTheWeb - FS02. Whether content the application brings in from outside carries the zone mark.
  • Test-TcpkMqttSurface - A57. MQTT client surface across MQTTnet, uPLibrary.Networking.M2Mqtt, System.Net.Mqtt (archived Xamarin), paho.mqtt (Python), Eclipse Paho C, and esp-mqtt. Rules: mqtt.cleartext-uri (HIGH), mqtt.tls-explicit-disable (HIGH), mqtt.mqttnet-tls-absent (HIGH), mqtt.paho-python-tls-absent (HIGH), mqtt.tls-verify-off (HIGH), mqtt.hardcoded-credentials (CRITICAL, WithCredentials("u","p") literal pair), mqtt.static-clientid (HIGH), mqtt.root-wildcard-subscribe (HIGH), mqtt.esp-transport-tcp (HIGH), mqtt.paho-c-nontls-build (HIGH, paho-mqtt3c.dll without the TLS sibling), mqtt.systemnetmqtt-unmaintained (MEDIUM), mqtt.no-keepalive (LOW). Every rule gated on a per-file MQTT library anchor.
  • Test-TcpkMsixPsf - A33. Package Support Framework (PSF) script injection in MSIX packages.
  • Test-TcpkNativeInterop - A18. Native interop -- unsafe Marshal / pointer patterns.
  • Test-TcpkNugetConfigCreds - A62. Shipped nuget.config credential leak. Rules: supply.nuget.cleartext-password CRITICAL (a <packageSourceCredentials> block carries <add key="ClearTextPassword" value="..."/>), supply.nuget.dpapi-password HIGH (DPAPI-encrypted <add key="Password" value="..."/> - only reversible on the origin machine + user context, but shipped regardless), supply.nuget.private-feed LOW inventory rule for every <packageSources> entry that isn't api.nuget.org (helpful scope info; combine with the credential rules for the full private-feed supply-chain picture).
  • Test-TcpkOAuthState - C35. OAuth 2.0 state parameter CSRF bypass and implicit flow detection.
  • Test-TcpkPacker - A22. Packer / obfuscator detection -- and the inverse: source-recoverable. Also emits packer.licensing-drm MEDIUM when the PE links against a commercial licensing / DRM runtime (Wibu Systems CodeMeter WibuCm*.dll, Thales Sentinel LDK hasp_windows*.dll / haspds_*.dll / sntl_adminapi_*.dll, SafeNet HASP HL hasp4_* / aksclt* / aksfridge, Flexera FlexNet lmgr11.dll / flexnet.dll, SoftwareShield SmartLicense). These wrappers dominate enterprise thick clients but their section names drift across product versions, so import-DLL basename is the stable fingerprint. Marks the PE PackedOpaque so downstream string / callsite / entropy checks are graded UNRELIABLE rather than clean.
  • Test-TcpkPasswordPolicy - A74. Local password and lockout policy declared in shipped configuration.
  • Test-TcpkPdbPathLeak - A59. Reads the PE debug directory's CodeView RSDS record and emits per-shape findings for the PdbPath stamped into the shipped .exe/.dll (present even when the .pdb is not shipped). Rules: pe.debug.pdb-path-userprofile MEDIUM (path contains C:\Users<name>), pe.debug.pdb-path-unc MEDIUM (UNC path leaks build-server hostname), pe.debug.pdb-path-repo LOW (path has \src\ / \repo\ / \projects\ segments), pe.debug.pdb-path-leak LOW (any PdbPath present). Distinct from Test-TcpkDevArtifacts which only fires when the .pdb file itself ships.
  • Test-TcpkPeExports - A04. PE export surface enumeration (for proxy-DLL planning).
  • Test-TcpkPeImports - A03 -- Phantom DLL imports (DLL hijack candidates).
  • Test-TcpkPeMitigations - A02 -- PE compile-time mitigations (ASLR, DEP, CFG, HighEntropyVA). NOT in the default audit (opt-in / compliance use): the audit reports hardening as posture in the GUI Hardening tab (Get-TcpkPeHardening), not as findings.
  • Test-TcpkPhantomDlls - A34. Phantom DLL planting opportunities in PE import tables. Scans BOTH the normal import table (dllsearch.phantom-dll) and the delay-import table, data directory 13 (dllsearch.delayload-phantom, resolved at first call, so a wider hijack window). Calibrated against live KnownDLLs and System32/SysWOW64 to suppress names that cannot be planted, and severity is gated on install-root writability.
  • Test-TcpkPInvokeImportMap - A69. The assembly's real native import surface, read from the ImplMap metadata table. A [DllImport] never reaches the PE import table (the CLR resolves it lazily), so a PE-import scan cannot see it. Rules: interop.pinvoke-surface, interop.pinvoke-unsafe-native (escalates when the full allocate+write+execute triad is declared), interop.pinvoke-unqualified-module (search-order plantable module).
  • Test-TcpkPInvokeSurface - A17. P/Invoke surface -- bare-name DllImport declarations.
  • Test-TcpkPlatformAuth - A73. Windows Hello / platform authentication: whether biometric is a cryptographic gate or a boolean.
  • Test-TcpkProvisioningPoP - A58. IoT provisioning Proof-of-Possession material shipped inside a Windows companion app. Covers ESP-IDF Wi-Fi provisioning (prov.esp.security0 HIGH, prov.esp.pop-hardcoded HIGH, prov.esp.default-pop-sentinel HIGH for the sample abcd1234, prov.esp.security2-creds-hardcoded HIGH), AWS IoT Fleet Provisioning (prov.aws.claim-cert-shipped HIGH when a claim.crt + claim.key pair AND a $aws/certificates/create topic anchor both appear, prov.aws.fleet-topic MEDIUM), Azure DPS (prov.azure.dps-symkey-hardcoded HIGH for SecurityProviderSymmetricKey + a 32/64-byte base64 literal), Matter commissioning (prov.matter.passcode-hardcoded HIGH, prov.matter.sample-pin HIGH for CHIP SDK samples 20202021/12345678, prov.matter.qr-shipped MEDIUM), Zigbee (prov.zigbee.default-tclk CRITICAL for ZigBeeAlliance09, prov.zigbee.install-code-hardcoded HIGH), and BLE SMP Just-Works fallback (prov.ble.just-works-fallback MEDIUM).
  • Test-TcpkPythonCallsites - A64. Unsafe Python callsites in shipped/frozen Python (eval, exec, pickle.load, os.system, subprocess with shell=True, yaml.load, marshal). Skips the CPython stdlib and vendored trees, and gates literal-argument calls, so the result is first-party code only.
  • Test-TcpkQtSurface - Qt/C++ security surface: QSettings credential storage in .ini/.conf/.cfg (value always masked), the QProcess single-string command API family (surface, not proven injection), bundled Qt WebEngine Chromium and its observed version, QML dynamic construction (Qt.createQmlObject / Qt.include / eval) and remote QML, plus a .rcc resource-bundle inventory.
  • Test-TcpkReflectionLoading - A16. Dynamic code loading via reflection.
  • Test-TcpkRegistryCredentialStore - A35b. First-party code writing credentials to registry (insecure local-data-storage anti-pattern).
  • Test-TcpkReparseLoops - NTFS junction / reparse-point loops under a target that can hang a naive recursive walker.
  • Test-TcpkResources - A07. Embedded resource audit.
  • Test-TcpkScanCoverage - A44. Reports what the scan could NOT read, so a partial scan is not mistaken for a clean result. The safe walker drops three classes of subtree: unreadable (ACL, which is the norm for WindowsApps), past the depth cap, and reparse points it refuses to follow. All three were previously silent. Runs LAST in the audit so the counters cover the whole run. LOW when directories were unreadable (a genuine unknown), INFO when only the deliberate limits fired. Says nothing about the application: it is a statement about the completeness of the audit.
  • Test-TcpkSecrets - A08 -- Hardcoded-secret scan (regex rules over UTF-8 + UTF-16LE views).
  • Test-TcpkSessionHandling - A33. Session-handling hygiene (cookie HttpOnly/Secure/SameSite, token in URL, weak token generation, expiry) over shipped config / scripts / PE strings.
  • Test-TcpkShippedTooling - D09. Vendor programming CLIs shipped inside the install tree (esptool, espefuse, ST-LINK, J-Link, OpenOCD, dfu-util, avrdude, nrfjprog, and 15 others). Fuse and secure-boot writers grade HIGH; flashers and debuggers grade MEDIUM.
  • Test-TcpkSignature - A01. Authenticode chain validation.
  • Test-TcpkSqlInjection - C31. SQL injection via string concatenation in source code and embedded SQL.
  • Test-TcpkStrings - A06. Strings extraction with summary classification.
  • Test-TcpkStrongName - A05. .NET assembly strong-name presence check.
  • Test-TcpkTauriConfig - A38. Audit a Tauri app config (tauri.conf.json) for insecure CSP / allowlist / shell / fs / IPC / updater settings (v1 + v2).
  • Test-TcpkTempFileToctou - C37. Predictable temp file TOCTOU (time-of-check to time-of-use) race condition.
  • Test-TcpkTlsBypass - A12. TLS validation bypass patterns.
  • Test-TcpkUiLeakSurface - A37. UI data-leak surface: screen-capture protection (SetWindowDisplayAffinity) and clipboard-history / cloud-clipboard hygiene.
  • Test-TcpkUnsafeIl - A68. Unsafe/unverifiable IL opcodes (localloc, cpblk, initblk, calli) and CLR header CorFlags, read from the shipping assembly. Complements Test-TcpkNativeInterop, whose C#-source needles (stackalloc, Marshal.Copy) do not survive compilation. Rules: interop.unsafe-il, pe.corflags-mixed-mode, pe.corflags-32bit-required. Confidence Confirmed (IL).
  • Test-TcpkUnsafeNativeApis - A25. Dangerous C/C++ runtime functions in native binaries (overflow surface).
  • Test-TcpkUpdateChannel - A53. Firmware-updater surfaces the base F02 check does not test: release-channel selectability, update endpoint in a Users-writable config file, and locally persisted current-version state that a client-side comparison would trust. Also flags the connected-device fanout pattern.
  • Test-TcpkUserRules - A54. Runs every user-authored rule under TCPK/Data/rules/*.json against the target. Phase 1 supports the file-regex check type (glob + regex over file contents). Sandboxed by construction: rules can match, they cannot execute. Malformed rules surface as Skipped rules.malformed findings rather than being dropped. See docs/EXTENDING.md.
  • Test-TcpkV8Bytecode - A45. Electron JavaScript compiled to V8 bytecode (bytenode / .jsc). When an app ships bytecode instead of source, asar extraction succeeds but every JS check reads nothing, so a clean report would be WRONG rather than merely incomplete. Detects .jsc files (loose and inside app.asar, verified binary not just by extension), bytenode as a declared dependency, and bytenode API use. Deliberately does NOT flag v8-compile-cache or Electron's code cache, which sit alongside readable JS and blind nothing. Severity rises when little readable .js remains.
  • Test-TcpkWcfConfig - A14. Audit shipped WCF config files for cleartext / unauthenticated bindings.
  • Test-TcpkWebViewNavTargets - A21. URLs that an embedded WebView2 will navigate to.
  • Test-TcpkXxe - A13. XXE indicators in shipped XML + risky XML reader settings in code.
  • Test-TcpkZipSlip - A15. Archive-extraction (zip-slip / path-traversal) surface detection.

B - MSIX manifest (11)

  • Test-TcpkMsixIntegrity - B11. Package integrity posture. Rules: msix.sparse-or-modification-package, msix.publisher-signer-mismatch (decodes AppxSignature.p7x and compares the signer DN against the manifest publisher), msix.blockmap-sha1.

  • Test-TcpkMsixAppInstaller - B05. AppInstaller (auto-update) declaration in AppxManifest.xml.

  • Test-TcpkMsixAppInstallerFile - B10. Parses shipped .appinstaller XML files (distinct from B05 which only reads the uap5 pointer inside AppxManifest.xml). Rules: msix.appinstaller.plaintext-uri HIGH (any Uri attribute is http://), msix.appinstaller.hotpath-uri HIGH (HotPath / HotSource / SharedContentPath / RepairPackage / OptionalPackage / ContentGroupMap - live-file patch into the installed dir under the signed package identity), msix.appinstaller.force-update-any-version HIGH (allows downgrade to a known-vulnerable older release), msix.appinstaller.silent-update MEDIUM (OnLaunch ShowPrompt=false + UpdateBlocksActivation=false), msix.appinstaller.dependency-cross-domain MEDIUM (a <Dependencies>\<Package> Uri host differs from MainPackage / MainBundle host), msix.appinstaller.self-uri-mismatch MEDIUM (root <AppInstaller Uri> host differs from MainPackage host).

  • Test-TcpkMsixCapabilities - B01. Risky capabilities declared in AppxManifest.xml.

  • Test-TcpkMsixComServers - B06. COM server registrations in AppxManifest.xml.

  • Test-TcpkMsixVfs - B14. VFS redirections a Desktop Bridge package declares over system folders. Reports which locations the package overlays and how much executable content sits under each. A redirection over System32 or Windows means code opening a system path is served the package copy, so a user-writable install tree becomes a way to place content at what the app treats as a system location. Presence is not itself a defect.

  • Test-TcpkMsixDeclaredVsUsed - B08. Declared-vs-used capability cross-check.

  • Test-TcpkMsixExtensions - B07. fullTrustProcess / appExecutionAlias / contextMenu / shortcutInfo extensions. Flags msix.alias-shadowing (HIGH) when an appExecutionAlias name collides with a common PATH tool.

  • Test-TcpkMsixFileAssocs - B04. File type associations declared in AppxManifest.xml.

  • Test-TcpkMsixFrameworkDeps - B02. Framework dependencies (VCLibs / WindowsAppRuntime) declared correctly.

  • Test-TcpkMsixProtocols - B03. URI scheme handlers declared in AppxManifest.xml. Adds a sink-reachability pass: emits protocol.sink-reachable (HIGH) when a binary both handles activation args and references a dangerous sink.

  • Test-TcpkUacManifest - B09. UAC execution level in embedded RT_MANIFEST (and sidecar .manifest).

C - OS integration (46)

  • Compare-TcpkFileSnapshot - C19b. Diff two file-system snapshots -- files the app created/modified/deleted at runtime (exec drops HIGH).
  • Compare-TcpkRegistrySnapshot - C18b. Diff two registry snapshots (Regshot-style) -- what the app changed.
  • Expand-TcpkAsar - Parse an Electron app.asar file-table, extract each module to disk, and scan the extracted JS/config for secrets + insecure Electron flags.
  • Get-TcpkTasvsMap - Map findings / rule IDs to a thick-client security category and risk class (report-time lookup; pipe findings, pass -RuleId, or dump the table).
  • Save-TcpkFileSnapshot - C19a. Regshot-style file-system snapshot (path/size/mtime/SHA-256) for before/after diffing.
  • Save-TcpkRegistrySnapshot - C18a. Regshot-style registry snapshot (before/after the app runs).
  • Test-TcpkAppInitDlls - C25. AppInit_DLLs and AppCertDlls (T1546.010 / T1546.009). Every user-mode process that loads user32.dll also loads whatever AppInit_DLLs names, which makes it a machine-wide injection point. Reports the configured state, whether Secure Boot / RequireSignedAppInit mitigates it, and whether any listed DLL is writable. Separates the two attributions that matter: a DLL the AUDITED APP registered is a vendor finding, while a value already present from other software is machine state the vendor cannot fix. Emits appinit.clean on a clean read so silence is not ambiguous.
  • Test-TcpkAppInitVendorOwned - C25. AppInit_DLLs and AppCertDlls global injection registrations (read-only).
  • Test-TcpkAppPaths - C10. App Paths registry entries.
  • Test-TcpkAutoStart - C04. Autostart entries (Run / RunOnce keys + scheduled tasks).
  • Test-TcpkAvExclusions - C17. Microsoft Defender exclusions attributable to the app.
  • Test-TcpkComHijack - C20. Per-user COM CLSID hijack opportunities (T1546.015), plus the two server-side cases: the registered server image exists and is user-writable, and the image is ABSENT while the path it names is one a standard user can create (a dangling registration, which needs no registry write at all). That last case is reported only when the path is under the audited tree, since the registration can name anywhere on the machine; the rest are counted in a census record rather than reported against the vendor. Managed (.NET) servers are followed through the mscoree.dll shim to the CodeBase assembly and graded the same way.
  • Test-TcpkComMachineDefaults - C25. Machine-wide DCOM posture. Rules: com.enable-dcom-network, com.machine-default-perms-weak (parses the REG_BINARY launch/access SDDL and grades broad-principal ACEs), com.machine-default-absent.
  • Test-TcpkComOrphanedClsid - C27. CLSIDs the application activates that are registered nowhere, so an attacker can register them first.
  • Test-TcpkComPrivilegeEscalation - C34. COM AppID privilege escalation surface for servers the target registers: privileged RunAs, and both DCOM descriptors graded. LaunchPermission and AccessPermission are each reported when absent (inherits the machine default) AND when set but granting Everyone / Authenticated Users / Users / INTERACTIVE / ANONYMOUS. Plus UAC auto-elevation (Elevation\Enabled=1).
  • Test-TcpkFirewallRules - C16. Windows Firewall rules created by the app (overly-broad inbound).
  • Test-TcpkFolderAcls - C05. Recursive ACL audit on a folder.
  • Test-TcpkHostNameResolution - C21. Host-side name-resolution posture and shipped-config bare-hostname surface. Rules: host.llmnr-enabled MEDIUM (registry DNSClient EnableMulticast != 0), host.nbtns-enabled MEDIUM (any NetBT interface with NetbiosOptions != 2), host.mdns-enabled LOW (Dnscache EnableMDNS != 0), and cfg.bare-hostname-endpoint MEDIUM per shipped config that names a backend by bare hostname (no dot, not a loopback / test alias) via URI scheme (http://db01, mqtt://broker) or key form ("Host": "app01") - the Windows resolver falls through DNS to LLMNR / NBT-NS on those, letting Responder capture the auth handshake.
  • Test-TcpkIfeoHijack - C11. Image File Execution Options debugger-key hijack.
  • Test-TcpkInstallDirAcl - C01. Non-admin-writable files in an admin-installed directory.
  • Test-TcpkInstallerHostsWrite - C23. Installer scripts and MSI custom actions that write to the hosts file.
  • Test-TcpkLoopbackExempt - C35. The package registers an AppContainer loopback exemption (CheckNetIsolation LoopbackExempt / NetworkIsolationSetAppContainerConfig), turning off the isolation that blocks a sandboxed app from reaching 127.0.0.1. Static scan of shipped scripts and binaries. The AppContainer isolation bypasses are Windows bugs; this flags the vendor removing the boundary itself.
  • Test-TcpkInstallerPlanting - C27. Installer / setup-binary DLL planting (T1574.001). Every other DLL check in TCPK inspects an INSTALLED application; this one inspects the installer, which runs from wherever the browser saved it (usually %USERPROFILE%\Downloads) and resolves DLLs from its own directory first. A DLL the installer imports but does not ship beside itself is loaded from the download folder if one is sitting there, and installers are commonly elevated, so the payload lands as Administrator. The attacker never touches the installer, so its signature stays valid. Splits the result: imports resolvable NOWHERE are HIGH/Confirmed (the loader is guaranteed to find nothing), imports that exist in System32 are MEDIUM/Inferred (the app directory still precedes System32, but SafeDllSearchMode and manifest dependencies can change the outcome). api-ms-win-* and ext-ms-* API sets are excluded -- the loader resolves those from a schema, never from disk. Emits a coverage record when nothing was found, so silence means "looked" rather than "never looked".
  • Test-TcpkKernelDrivers - C14. Kernel-mode drivers (.sys) shipped or installed by the app.
  • Test-TcpkMsiCustomActions - C28. MSI custom actions that run with elevated (SYSTEM) privileges.
  • Test-TcpkMsiLaunchConditions - C26. Whether an installer checks the platform it is about to install onto.
  • Test-TcpkPersistenceLoadPoints - C24. Machine-wide Windows persistence load points not covered by the dedicated autostart checks.
  • Test-TcpkProgramDataAcls - C13. World-writable app data dirs under %ProgramData% / %PUBLIC% (EoP / TOCTOU).
  • Test-TcpkProtocolHandlers - C07. HKCR protocol handlers (system-wide URI scheme registrations).
  • Test-TcpkPwshProfileAcl - C20. PowerShell profile.ps1 auto-load points across the six canonical paths (5.1 x64/x86, 7.x, AllUsers + CurrentUser). loadpoint.pwsh-profile.file-writable HIGH when the shipped profile file's DACL grants a non-admin principal a right that permits code injection; loadpoint.pwsh-profile.dir-writable HIGH when the file does not exist yet and the containing directory is writable (attacker creates it); loadpoint.pwsh-profile.hijack-source MEDIUM when the profile dot-sources / Import-Modules a path that lives in a user-writable folder or does not exist. ATT&CK T1546.013.
  • Test-TcpkRegistryAcl - C12. Weak DACL on the app's HKLM registry keys (privilege escalation).
  • Test-TcpkRegistryFootprint - C06. Registry footprint of the app (HKCU and HKLM).
  • Test-TcpkRegistryLoadPoints - C26. Five registry-driven DLL load points not covered by the COM (Test-TcpkComHijack) or SxS paths: Winsock LSP/NSP catalogs, print monitors and processors, LSA extensions/notification packages, netsh helpers, and Winlogon notify. Each entry is resolved to a DLL on disk and its ACL read. Filtered to the audited install tree so it reports the vendor's own registrations rather than the whole machine, with a census record covering what was enumerated.
  • Test-TcpkRegistryValues - C17. Secrets stored in the app's registry VALUES (not just key names).
  • Test-TcpkScheduledTaskAcl - C15. User-modifiable scheduled tasks (privilege escalation).
  • Test-TcpkServiceBinaryAcl - C18. Non-admin-writable service / scheduled-task BINARY (EoP).
  • Test-TcpkServiceDll - C24. svchost ServiceDll hijack (T1574.011 / T1543.003). A shared-service DLL runs as SYSTEM inside svchost, so a non-admin-writable ServiceDll file, a writable directory that reaches it, or a writable service / Parameters key that repoints it is a direct local escalation. Directory grants are graded honestly: DELETE_CHILD / WRITE_DAC / WRITE_OWNER / GENERIC_ALL can replace the existing DLL (HIGH), while ADD_FILE / GENERIC_WRITE alone is only a planting primitive (MEDIUM) and the finding says so. Scope with -Path to the audited install tree; unscoped runs are machine-wide and report services the audited vendor does not own. Refuses to run under a 32-bit host, because WOW64 redirection would resolve System32 paths to SysWOW64 and report the wrong file's ACL. Always emits a coverage record so a clean result is distinguishable from a run that never looked.
  • Test-TcpkServicePermissions - C02. Service binary writable / weak SDDL.
  • Test-TcpkShimCache - C08. AppCompat shim registrations for the target.
  • Test-TcpkSxsManifests - C09. Side-by-side activation context manifests + .local files.
  • Test-TcpkTrustStore - C15. Certificate trust-store pollution by the app/installer.
  • Test-TcpkUninstallStringHijack - C22. Unquoted UninstallString / QuietUninstallString / ModifyPath entries.
  • Test-TcpkUnquotedServicePath - C03. Classic unquoted-service-path LPE primitive.
  • Test-TcpkVendorDriverAcl - C19. Vendor kernel-driver attack surface. Confirms every .sys is a real kernel PE (Subsystem=Native + at least one import from ntoskrnl/hal/wdfldr/storport/netio) and then reports non-admin write on the .sys itself, on its parent folder, and on the HKLM\SYSTEM\CurrentControlSet\Services<Name> key (all HIGH). Also parses shipped INF files (ServiceType+StartType for kernel-driver installs, missing CatalogFile=), greps shipped scripts for bcdedit /set testsigning on, maps the .sys basename to a curated vendor dictionary (Silabs / WCH / FTDI / ST / Segger / Nordic / Microchip / Razer / ASUS / Gigabyte / MSI), and explicitly flags Jungo windrvr6.sys as a known BYOVD staple.
  • Test-TcpkWerExposure - C21. Windows Error Reporting (WER) crash dump data exposure (T1005). Dump files are filtered to the target's own executables, because the dump folder is shared machine-wide. LocalDumps is off by default on Windows, so this normally emits nothing; a global policy is reported only where it governs the target AND there is real exposure. Does NOT cover the default WER ReportArchive/ReportQueue folders. Not applicable to Electron apps, which use Crashpad.
  • Test-TcpkWmiPersistence - C16. WMI permanent event subscriptions (persistence mechanism).
  • Test-TcpkWritablePath - C22. Writable directories in the system PATH (binary planting surface, T1574.007).

D - Credential storage (12)

  • Test-TcpkAppConfigSecrets - D04. .NET Framework .config secrets (connection strings, machine keys).
  • Test-TcpkBrowserTokenStore - D08. Chromium / Electron / NW.js cookie + token store, and whether its os_crypt key is App-Bound-Encrypted or plain DPAPI.
  • Test-TcpkChromiumCleartextStores - D10. Chromium unencrypted data stores (Local Storage, HTTP cache, IndexedDB).
  • Test-TcpkCredentialLiterals - D11. Credentials hardcoded as positional string literals in compiled code, which name-based and entropy scanning both miss.
  • Test-TcpkCredentialManager - D02. Credential Manager entries belonging to the target.
  • Test-TcpkDpapiBlobs - D01. DPAPI blobs in the target path.
  • Test-TcpkKeyMaterial - D07. Private-key and certificate material inventory.
  • Test-TcpkLocalDb - D07. Local databases at rest (SQLite / .db) -- unencrypted + world-readable.
  • Test-TcpkPlaintextConfigs - D03. Token-shaped strings in small config files under the path.
  • Test-TcpkSqliteWalResidue - D10. Secret residue in SQLite -wal / -journal sidecars. A client-side delete or key rotation very often leaves the old plaintext in the sidecar until the next checkpoint. Rules: localdb.sqlite-wal-residue (HIGH), localdb.sqlite-wal-present (LOW, scope).
  • Test-TcpkTokenCaches - D05. MSAL / ADAL / custom OAuth token cache files under the target path. KNOWN GAP: the well-known per-user locations MSAL and ADAL actually write to (%LOCALAPPDATA%.IdentityService, %USERPROFILE%.azure) are not scanned, so this finds nothing for an MSAL-based app.
  • Test-TcpkWebViewCreds - D06. WebView2 Edge user profile -- saved login state.

E - Runtime / live process (33)

  • Invoke-TcpkActivityTrace - E24. One ETW capture window analysed three ways: DLL probes, file writes, registry writes. Replaces three separate 30s captures, so the app is exercised once and a DLL probe can be correlated with the write that followed it. Supports -Include / -Exclude filters, -IncludeChildren and -KeepEtl.
  • Save-TcpkMemoryRegion - E24. Saves the raw bytes of one live memory region to the work directory, so an address flagged by Test-TcpkMemoryRegions or Test-TcpkThreadStart becomes an artifact that can be hashed, carved or loaded into a disassembler. Read-only; returns a result object rather than findings.
  • Test-TcpkChildProcesses - E14. Direct child processes spawned by the target.
  • Test-TcpkComObjects - E06. COM objects registered in HKCR\CLSID pointing at the target.
  • Test-TcpkDllSearchTrace - E08. ETW capture of NAME NOT FOUND DLL probes during a window.
  • Test-TcpkFileActivity - E12. File creates and writes to sensitive paths during an exercise window (ETW).
  • Test-TcpkGuiInspector - E17. Live GUI object inspection (UI Automation) -- hidden/disabled controls
  • Test-TcpkHandleDacl - E22. DACLs on the kernel objects a running process actually holds open. The RUNTIME half of Test-TcpkNamedObjects, which infers a squatting surface statically from name literals: this reads the real DACL on the real handles. Grades Event / Mutant / Semaphore / Section / Job / Timer / Key. File-type handles are counted but never name-queried, because NtQueryObject(ObjectNameInformation) blocks indefinitely on a synchronous file or pipe handle with pending I/O. Pipes are covered by Test-TcpkNamedPipeDacl. Needs PROCESS_DUP_HANDLE, so generally elevated.
  • Test-TcpkHandleEnumeration - E11. Open handle counts and types for the process (triage summary).
  • Test-TcpkListeningPorts - E03. TCP listeners + UDP endpoints owned by the process.
  • Test-TcpkLoadedModulePaths - E10. Native modules loaded into the process from non-system paths. Checks BOTH the file ACL (module replaceable in place) and the parent directory ACL (a module can be planted). Program Files is intentionally in scope: installers routinely loosen ACLs on their own subdirectories.
  • Test-TcpkLoadedModuleSignatures - E02. Authenticode status of every module loaded into the live process.
  • Test-TcpkMailslotDacl - E23. Mailslot DACL inspection. Existence is surfaced elsewhere; this reads whether a non-admin can read or write. Rules: mailslot.dacl-weak, mailslot.dacl-unreadable.
  • Test-TcpkMailslotsAlpc - E07. Mailslots and ALPC ports.
  • Test-TcpkMemoryDump - E09. Dump the process and scan the dump for secrets.
  • Test-TcpkMemoryRegions - E18. Virtual memory region protection (T1055 / T1620). Walks the process address space with VirtualQueryEx and reports RWX pages (writable and executable at once, so a memory write needs no DEP bypass) and executable memory not backed by a mapped image (the shape a manual-map or reflective loader produces). JIT-calibrated: .NET, V8/Node and the JVM generate code at runtime, so when one of those is loaded the finding is reported as posture rather than a defect. Read-only, opens with PROCESS_QUERY_INFORMATION only.
  • Test-TcpkNamedObjects - E15. Named kernel objects (mutex/event/section) -- squatting / race surface.
  • Test-TcpkNamedPipeDacl - E05. Named pipe DACL inspection. Emits pipe-dacl.null HIGH when the SDDL contains D:NO_ACCESS_CONTROL (pipe created with lpSecurityAttributes=NULL, grants everything to everyone by construction, KB4014981-class), and pipe-dacl.weak HIGH when an ACE grants Everyone / Authenticated Users / Users / INTERACTIVE Write / ChangePermissions / FullControl.
  • Test-TcpkNamedPipes - E04. Named pipes whose name suggests a relationship to the target.
  • Test-TcpkProcessDacl - E15. Running-process DACL: does a low-privilege group hold injection rights (VM_WRITE / CREATE_THREAD / DUP_HANDLE / WRITE_DAC)? Severity follows the MEASURED integrity level of the target, not an assumption: High or System is above the granted principal and rates HIGH, Medium is level with it and rates MEDIUM, Low is below it and rates LOW. An unreadable integrity level stays HIGH.
  • Test-TcpkProcessEnvSecrets - E16. Secrets in a running process's environment block (read-only).
  • Test-TcpkProcessMitigations - E01. Runtime process mitigations (DEP, ASLR, CFG, SEHOP, etc.).
  • Test-TcpkProcessToken - E13. Process token owner / integrity level / impactful privileges.
  • Test-TcpkProcessVirtualization - E21. UAC file and registry virtualization state (T1548.002). Windows applies the shim only to 32-bit processes with no requestedExecutionLevel, so a modern app running virtualized is both unmanifested and writing security-relevant state into a user-writable VirtualStore. Reports enabled (MEDIUM) and allowed-but-not-enabled (LOW) separately.
  • Test-TcpkRegistryWrites - E11. Registry writes by a running process during an exercise window (ETW).
  • Test-TcpkRpcSurface - E16. MS-RPC server interface surface (static).
  • Test-TcpkSharedMemoryDacl - E13. Shared-memory / memory-mapped file DACL inspection.
  • Test-TcpkThreadDacl - E19. Running-thread DACL (T1055.003). Test-TcpkProcessDacl covers the process object; this covers the THREAD objects inside it. THREAD_SET_CONTEXT alone redirects execution by rewriting register state, with no process memory-write right needed, so a sound process DACL does not imply a sound thread one. Deduplicated per (account, rights) so a many-threaded process does not emit one finding per thread.
  • Test-TcpkThreadStart - E23. Unbacked thread start addresses (T1055 / T1620). Reads each thread's Win32 start address with NtQueryInformationThread and compares it against the address ranges of every loaded module. A start address inside a mapped image is normal; one outside every image is the shape CreateRemoteThread against manual-mapped or reflectively-loaded code produces. JIT-calibrated against the same runtime module list as Test-TcpkMemoryRegions (CLR, JVM, Node, CEF), so a legitimately jitted thread drops to INFO instead of MEDIUM. Refuses to report when fewer than two module ranges are readable, or when a 32-bit host is inspecting a 64-bit target, because either would flag every backed thread as unbacked. Deduplicated per 64 KB region, capped, and the exact totals are carried separately from the capped sample.
  • Test-TcpkTokenDacl - E20. Access-token DACL (T1134.001). Test-TcpkProcessToken reports what the token CONTAINS; this reports who may OPERATE ON it. TOKEN_DUPLICATE on an elevated process is a direct escalation with no code injection: clone the token and CreateProcessAsUser. HIGH for DUPLICATE / IMPERSONATE / WRITE_DAC / ALL_ACCESS.
  • Test-TcpkUiDataExposure - E25. Sensitive values surfaced through the UI, and capture hardware the application can be recorded with.
  • Test-TcpkWindowEnumeration - E12. Top-level windows owned by the process (Shatter / UIA surface).
  • Test-TcpkWindowMessages - E12b. Window-message attack surface (WM_COPYDATA injection + drop-files).

F - Network (12)

  • Test-TcpkBackendEndpoints - F03. Inventory backend API endpoints + inferred auth model.
  • Test-TcpkCrlOcsp - F06. CRL / OCSP revocation-checking behavior.
  • Test-TcpkDnsLeakage - F05. DNS pre-resolution / hostname leakage indicators.
  • Test-TcpkGrpcSurface - F11. gRPC / Protobuf service surface enumeration (proto files, services, reflection).
  • Test-TcpkInsecureSchemes - F07. Cleartext network scheme references (http:// and ws://).
  • Test-TcpkNativeCertFlags - F12. Certificate-validation suppression through the native HTTP stacks and scripting-runtime flags.
  • Test-TcpkRpcChannels - F10. gRPC / SignalR channel security: insecure (no-TLS) credentials in first-party code + cleartext ws:// / http:// hubs and gRPC targets in shipped config / JS.
  • Test-TcpkSelfHostedServer - F07. Self-hosted HTTP/web-server surface detection.
  • Test-TcpkTlsHandshake - F09. ACTIVE (gated) per-version TLS handshake probe to backends + cert-validity result; flags negotiable SSL3/TLS1.0/1.1.
  • Test-TcpkTlsPinning - F01. TLS certificate pinning detection.
  • Test-TcpkTlsProtocols - F04. TLS protocol version markers (1.0 / 1.1 fallback?).
  • Test-TcpkUpdateFlow - F02. Update mechanism: signed manifest? signed payload? downgrade defense?

G - WebView2 (7)

  • Test-TcpkWv2DevTools - G05. WebView2 DevTools enabled in shipped build.
  • Test-TcpkWv2HostObjects - G01. AddHostObjectToScript -- .NET object exposure to JS.
  • Test-TcpkWv2ResourcePolicy - G07. WebResourceRequested / external-resource fetch policy.
  • Test-TcpkWv2ScriptInjection - G06. AddScriptToExecuteOnDocumentCreated -- script auto-injection.
  • Test-TcpkWv2VirtualHost - G04. SetVirtualHostNameToFolderMapping (local content as a web origin).
  • Test-TcpkWv2Sideload - G08. WebView2 DLL sideloading opportunities (T1574.002).
  • Test-TcpkWv2WebMessage - G02. WebMessageReceived handler presence (one-way JS-to-host bridge).

H - Logging / telemetry (7)

  • Test-TcpkEtwProviders - H04. Custom ETW / EventSource providers (cross-process telemetry leak).
  • Test-TcpkLogConfigPosture - L07. Operational soundness of the shipped NLog / log4net / Serilog configuration, for file targets only. Rules: log.no-rotation (unbounded growth is both a self-inflicted DoS and a way to push earlier entries out of retention), log.timestamp-not-utc (local time breaks cross-host correlation and duplicates an hour at the DST transition), log.unstructured-format (INFO). Silent when no logging config ships.
  • Test-TcpkLogFiles - H01. Log files under the target path. Inventory, sensitive-keyword and stack-trace content scan, plus the log-TAMPERING question, which is separate from what a log leaks: can a non-admin principal rewrite or delete the record. Checks the ACL of each log file (log.tamperable-file) and of its containing directory (log.tamperable-directory) for Write / Modify / FullControl / Delete granted to Everyone, Authenticated Users, Users or INTERACTIVE. The directory is reported separately and matters more: on Windows, Delete on the parent removes a file whose own ACL denies it, so a hardened log inside a loose directory is still deletable. Append-only (AppendData without WriteData) is deliberately not flagged, since that is the correct posture.
  • Test-TcpkLogInjection - C30. Log injection and CRLF log-forging attack surface in logging configuration.
  • Test-TcpkPiiInLogs - H03. PII patterns in shipped logs / templates / data files.
  • Test-TcpkSecurityEventLogging - C36. Missing security event logging: absence of audit-trail APIs in first-party code.
  • Test-TcpkTelemetrySdks - H02. Third-party telemetry SDK enumeration.

I - Memory hygiene (5)

  • Test-TcpkClipboardSecrets - I05. Clipboard secret monitoring during a test session (polls for passwords, API keys, tokens).
  • Test-TcpkMemorySecrets - I04. Live-memory secret scan (read-only) of a running process.
  • Test-TcpkPageFile - I02. Page file / hibernation file secrecy hygiene.
  • Test-TcpkSecureStringUsage - I03. SecureString / ProtectedData usage in first-party code. Also scans shipped .ps1/.psm1 for reversible-SecureString shapes and emits creds.securestring-reversible HIGH on: ConvertTo-SecureString "<literal>" -AsPlainText -Force (hardcoded plaintext credential), ConvertFrom-SecureString -Key @(<literal bytes>) (serialised ciphertext + its exact key in one file), and ConvertTo-SecureString "<b64>" -Key @(<literal bytes>) (encrypted blob and its literal key together). Fires only on literal args; variable-arg forms are skipped to hold false positives at zero.
  • Test-TcpkWerPolicy - I01. Windows Error Reporting LocalDumps per-app policy for the target executable. LocalDumps is not enabled by default and requires admin, so an absent key emits nothing by design: that is machine posture the vendor cannot fix. Not applicable to Electron apps, which use Crashpad.

J - Anti-debug (4)

  • Test-TcpkAntiDebugRefs - J01. Anti-debug API references (IsDebuggerPresent etc.).
  • Test-TcpkAntiInjection - J03. Anti-injection / process-hollowing detection markers.
  • Test-TcpkSelfIntegrityCheck - J02. Self-integrity verification markers.
  • Test-TcpkTimingAntiDebug - J04. Timing-based anti-debug markers (RDTSC, QueryPerformanceCounter).

K - Exploitation (GATED, off by default) (31)

  • Invoke-TcpkCrashMinimize - K25. GATED. Distils a crashing input to a minimal deterministic trigger by delta debugging, holding the exit code constant so the reduced input drives the same fault. Checks reproducibility first: a crash that does not replay is reported as fuzz.crash-not-reproducible and the run stops, because a crash nobody can reproduce is not a finding. Rules: fuzz.crash-minimized, fuzz.crash-not-reproducible. Invoke-TcpkInputFuzz calls it by default.

  • Invoke-TcpkFirmwarePlantProbe - K25. Backs up a shipped firmware image, optionally appends a 4-byte marker so any signature check fails, launches the vendor updater, and observes via ETW whether the updater's process tree reads the file at flash time. Restores from backup in the finally block. Three gates: Enable-TcpkExploit, -ConfirmActive, -AllowDevicePresent for AppendMarker mode. Confirmed (dynamic) when the read is observed.

  • Invoke-TcpkParamTamper - K24. Mutates one parameter of a captured request (price, quantity, boolean flag, role, limit) and sends three requests per parameter: baseline, tampered, and a bogus control. An endpoint that accepts the bogus value too reports NOT CONCLUSIVE rather than a false positive.

  • New-TcpkProxyDll - K01. Generate a proxy-DLL source scaffold for a flagged phantom-import.

  • New-TcpkFridaTlsBypass - K02. Generate a Frida JS script template that bypasses a flagged TLS validation callback.

  • New-TcpkPoisonedUpdateManifest - K03. Generate a TEMPLATE update-manifest that demonstrates an unsigned-update supply-chain finding.

  • Invoke-TcpkDpapiCrossUser - K04. Attempt to decrypt a DPAPI blob under each available DPAPI scope.

  • New-TcpkComHijackTemplate - K05. Generate a proxy-COM scaffold for a flagged COM-server CLSID.

  • Start-TcpkPipeMitm - K06. Local-loopback named-pipe MITM listener.

  • Invoke-TcpkMemoryFlagFlip - K07. Locate and optionally patch an in-memory flag to prove client-side gating (e.g. IsLicensed/IsTrial false->true).

  • Invoke-TcpkPipeProbe - K08. Connect to a named pipe and send a benign probe.

  • Invoke-TcpkInputFuzz - K09. Dumb file/argument fuzzer with crash capture.

  • Invoke-TcpkGuiUnlock - K10. Enable disabled controls / unmask password / unlock read-only fields (Win32).

  • Invoke-TcpkComProbe - K11. Actively probe a discovered COM server: try to instantiate it, test whether it AUTO-ELEVATES via the Elevation moniker, and enumerate its callable member surface. Logic-PoC: it instantiates and reads the type info; it never invokes a method.

  • Invoke-TcpkRpcProbe - K12. Enumerate the live local RPC endpoint mapper -- the runtime counterpart to the static rpc.server-interface marker. Read-only: it lists the registered interfaces (UUID / binding / annotation); it never binds or calls a method.

  • Invoke-TcpkJwtCrack - K13. Prove a JWT's forgeability OFFLINE: decode + analyze it, and recover a weak HMAC signing secret by dictionary attack. Makes NO network call.

  • Invoke-TcpkJwtAttack - K14. Forge JWT attack tokens and test which ones a live backend ACCEPTS. Proves auth-bypass by BODY comparison against baselines, never by HTTP status alone.

  • Invoke-TcpkReplay - K15. Replay a captured request with its credential REMOVED to prove missing function-level authorization (CWE-862). Confirmed by protected-body comparison.

  • Invoke-TcpkIdorProbe - K16. Prove horizontal IDOR / broken object-level authorization (CWE-639): identity A, using A's credential, reads identity B's object. Four baselines kill the public-object and soft-404 false positives.

  • New-TcpkChainPoc - K17. Emit a concrete, lab-safe proof-of-concept PROCEDURE for each correlated exploit chain (Get-TcpkExploitChains). Turns a HIGH/CRITICAL correlation into the exact steps an operator runs to demonstrate it -- benign marker only, stop at proof-of-control.

  • Invoke-TcpkApiTrace - K18. Trace security-relevant Windows API calls in a RUNNING target with Frida and report what it did: weak crypto, process/command launch, secrets written to disk/registry, DPAPI use. READ-ONLY: it observes calls, it never modifies them.

  • Invoke-TcpkAuthMatrix - K19. Vertical authorization matrix: replay one role's request under another role's credential and report where a lower-privilege identity is accepted.

  • New-TcpkIlPatch - K20. IL binary patching via Mono.Cecil (gated exploit).

  • New-TcpkRegistryHijackTemplate - K21. Generate registry-based persistence / hijack PoC artifacts.

  • Invoke-TcpkExpiryProbe - K22. Prove a backend accepts a token AFTER the expiry the backend itself issued, judged against the server's own clock.

  • Invoke-TcpkLogoutProbe - K23. Replay an authenticated request AFTER logging out, using the same credential, to show whether logout actually revoked anything server-side.

  • Get-TcpkCveMatches - Match the target's shipped components against LIVE online CVE sources.

  • Get-TcpkExploitPlan - Build a unified, actionable exploit plan from CVE matches + exploitable findings.

  • Get-TcpkStoredCredentials - Enumerate and decrypt the current user's Windows Credential Manager entries -- the stored-credential extraction primitive.

  • Invoke-TcpkHookBypass - Force the return value of a named native export at runtime via Frida -- flip a client-side auth / license / integrity check the thick client trusts.

  • Test-TcpkCredentialLiveness - Prove a recovered/observed credential actually AUTHENTICATES to a live service -- turning an exposed secret into demonstrated impact (Confirmed exploit).

Recon / target profiling (4)

  • Get-TcpkAttackSurface - R11. Synthesize a ranked attack-surface map from audit findings.
  • Get-TcpkExploitChains - R12. Correlate individual findings into multi-step exploit CHAINS (emits CRITICAL/HIGH chain.* findings when co-occurring conditions form an attack path: unsigned-update+writable-dir, web-content+host-bridge, writable-privileged-binary, SYSTEM+IPC impersonation, URI-handler+dangerous-sink).
  • Get-TcpkReconStrings - R11. Extract + categorize interesting literal strings from first-party binaries.
  • Get-TcpkTargetProfile - R00. Recon / fingerprint pass. Builds a target-application profile for the

Verify / triage (22)

  • Invoke-TcpkManagedCarve - V22. Carves managed assemblies out of a live process's private memory and proves each one by parsing it with Cecil. Covers the fileless Assembly.Load(byte[]) case that disk-based decompilers cannot see. Rules: memory.fileless-managed-assembly (MEDIUM, identity matches no module on disk), memory.in-memory-managed-assembly (INFO, packer or resource-embedded dependency), memory.managed-header-unparsed, memory.carve-coverage-capped.

  • Confirm-TcpkCallsiteUsage - Deterministic IL verification of callsites.* and deser.* findings: is the flagged API actually invoked, reachable, and fed by external input -- or a false positive?.

  • Confirm-TcpkCallsites - Phase-2 confirmation for dangerous-API callsite findings.

  • Confirm-TcpkDeserialization - Phase-2 confirmation for unsafe-deserialization findings.

  • Confirm-TcpkTlsBypass - Phase-2 confirmation for TLS certificate-validation bypass findings.

  • Disable-TcpkExploit - Turn off the Exploit bucket for this PowerShell session.

  • Enable-TcpkExploit - Toggle on the Exploit bucket (K01-K06) for this PowerShell session.

  • Expand-TcpkAsar - Parse an Electron app.asar header file-table, extract each bundled module, and scan the extracted JS/config for secrets and insecure Electron flags.

  • Expand-TcpkPyInstaller - Carve the CArchive out of a PyInstaller-frozen .exe (and extract a cx_Freeze / py2exe library.zip) so the rest of TCPK can actually read the app's code surface.

  • Expand-TcpkSingleFile - Extract the managed assemblies bundled inside a .NET single-file (PublishSingleFile) apphost so the rest of TCPK can actually scan them.

  • Get-TcpkCaptureInterface - List the network capture interfaces available via the operator's installed Wireshark (tshark -D). For picking an interface for Invoke-TcpkPcapCapture.

  • Get-TcpkFileStructure - Apply a byte pattern to a file and return its header as named, decoded fields.

  • Get-TcpkPcapBtFindings - Analyse a Bluetooth / BLE packet capture for security findings.

  • Get-TcpkPcapZigbeeFindings - Analyse a Zigbee / IEEE 802.15.4 packet capture for security findings.

  • Invoke-TcpkDecompile - Drive ILSpy CLI to decompile and return source context for a method.

  • Invoke-TcpkDynamicConfirm - GATED, observation-only dynamic confirmation: does the target app TRUST a command-line / deep-link session override at runtime? (Dynamic harness, slice 1.).

  • Invoke-TcpkIntercept - Traffic interception for a thick client, via mitmproxy. Two modes: parse an existing mitmproxy capture into findings (-FlowFile, cross-platform, ungated), or actively launch the target through a local mitmdump and observe its traffic (-Target, GATED).

  • Invoke-TcpkJavaDecompile - Drive CFR to decompile a .jar / .war / .class and return source context for a symbol.

  • Invoke-TcpkPcapCapture - Capture live traffic on an interface (via the operator's dumpcap), then analyse it for security issues. LIVE capture needs a capture driver (npcap on Windows) and elevation -- it is the operator's dumpcap doing the privileged work; TCPK ships no driver.

  • Invoke-TcpkPcapReview - Analyse a packet capture (.pcap / .pcapng) for security issues, via the operator's installed Wireshark (tshark). Read-only: it dissects a capture you already made; it does not capture live and needs no admin.

  • Invoke-TcpkSecretRecovery - Turn shipped crypto material into a DEMONSTRATED secret. When an app ships a symmetric key + IV + ciphertext together, decrypt it and recover the plaintext - upgrading three 'Inferred' findings to one 'Confirmed (exploit)'.

  • Resolve-TcpkFindings - Triage pipeline: dedupe + false-positive killers + confidence refinement.

Reporting (8)

  • Compare-TcpkAudit - Diff two audits (baseline vs current) into NEW / FIXED / REGRESSED / unchanged at rule+location granularity; optional Markdown delta report.
  • Export-TcpkReportExcel - Export a multi-sheet .xlsx report: Summary, Findings, DLL Hardening (+ CVEs).
  • Export-TcpkReportHtml - Export TCPK findings as a self-contained, interactive HTML report (leads with an executive summary + attack-path callout).
  • Export-TcpkReportIntel - Export a self-contained offline intel.html dashboard (severity/confidence + evidence ladder, recon endpoint map, filterable cards).
  • Export-TcpkReportJson - Export TCPK findings as JSON for CI / re-processing.
  • Export-TcpkReportMarkdown - Export findings as a plain-text Markdown report (exec summary + severity-grouped findings with full CVSS / CWE / ATT&CK / security-category mapping).
  • Export-TcpkReportSarif - Export SARIF 2.1.0 for GitHub / Azure DevOps code-scanning ingest.
  • Export-TcpkSbom - Export a CycloneDX 1.5 SBOM (software bill of materials) of bundled components.

LLM (optional, local-first) (6)

  • Disable-TcpkLlmCloud - Turn off cloud LLM use for this session (reverts to local-only).
  • Enable-TcpkLlmCloud - Allow TCPK to send findings to a CLOUD LLM backend for this session.
  • Get-TcpkLlmModels - List the model IDs the configured provider + key can actually use (live).
  • Get-TcpkLlmProvider - List the built-in LLM providers (for the GUI dropdown) or the current selection.
  • Invoke-TcpkLlmCodeJudgment - L1 -- LLM-assisted verification of code-construct findings.
  • Test-TcpkLlm - Connectivity + sanity check for the configured LLM provider.

Not every cmdlet is documented here. The remainder are reachable via Get-Command -Module TCPK. Run Get-TcpkInfo for the authoritative live count, which is computed from the module folder rather than from this page (335 cmdlets across 19 categories, 227 of them Test-* detection checks).