Skip to content
DigitalForenSeek Tools home

Changelog

EventHawk release history, from the 1.2.0 initial release and 1.3.0 PowerShell extraction to the changes on main since.

Versions follow the tags in the EventHawk repository. Dates are commit dates.

Unreleased

Section titled “Unreleased”

Changes on main after 1.3.0, up to commit 8c5b28a (2026-09-06). The version string on main is still 1.3.0.

Added

Section titled “Added”
  • Standalone Windows build scripts for an installer and a portable build.
  • Logon session browser improvements: linked UAC and split-token session pairs, scoping by time window to handle LogonId reuse across reboots, and a filter to hide service sessions.
  • Client-side (outbound) RDP sessions reconstructed as a separate session type.
  • Selectable timestamp precision: seconds, milliseconds or microseconds.
  • IOC extraction and attack-chain correlation in Juggernaut Mode.
  • Text search in the Juggernaut Mode filter dialog.
  • Every column is sortable; the timestamp column filter groups values by year, month and day.
  • run.sh launcher for Linux and macOS with a project virtual environment.
  • Rotating error log for the GUI (eventhawk_gui.log).
  • Documentation for the logon session view and missing record ID analysis.

Changed

Section titled “Changed”
  • Parsing runs on worker processes, so more cores are used during a parse.
  • Juggernaut Mode sorting and export run off the GUI thread, with progress and cancel for export.
  • When one analysis component fails, the others still deliver partial results.

Fixed

Section titled “Fixed”
  • Silent evidence loss from 64-bit values, daylight-saving handling, hidden warnings and leaked threads.
  • Ordinary field values corrupting HTML and XML exports; HTML export missing event data in Juggernaut Mode; Juggernaut CSV and JSON export.
  • Two correlation rules that paired effects with earlier causes, producing false attack chains.
  • Profile-defined conditions now apply at parse time; previously they were skipped.
  • Juggernaut full-text search returning unfiltered results, and duplicated search results.
  • Single-file input failing silently where folder input worked.
  • WiFi session pairing and durations: incomplete pairs are flagged instead of given made-up durations.
  • Profiles deselecting themselves when clicked, and cleared quick filters reappearing.

1.3.0

Section titled “1.3.0”

Released 2026-04-04.

Added

Section titled “Added”
  • PowerShell history extraction (Analysis → PowerShell History). Reconstructs sessions, commands and script blocks from event IDs 400, 403, 600, 800, 4103 and 4104, reassembles multi-part script blocks, detects ATT&CK techniques and obfuscation patterns, and writes:
    • ps_commands.txt: chronological session and command timeline
    • scriptblock_<GUID>.txt: one reassembled script block per block ID
    • ps_extraction_summary.txt: statistics and ATT&CK summary
    • ps_extraction.json: machine-readable export
    • ps_timeline.xlsx: Excel timeline with clickable links to the script block files

1.2.0

Section titled “1.2.0”

Released 2026-03-30. Initial public release, under the Apache License 2.0.

Highlights

Section titled “Highlights”
  • Juggernaut Mode rebuilt around an in-memory Arrow table and a single DuckDB filter thread. Scrolling reads slices of the Arrow table with no disk I/O, and event details load from Parquet when a row is opened.
  • evtx (pyevtx-rs) pinned to 0.11.0 or newer.
  • install.bat rejects free-threaded Python builds, which the parser does not support.