Execution
Every program that ran
Exact timestamps and run counts — even after the file was deleted.
- Prefetch
- Amcache
- Shimcache
- BAM / DAM
- UserAssist
- SRUM
- Autoruns
- Scheduled tasks
- Services & drivers
- WMI subscriptions
- USN journal
- Alternate data streams
- Event log
- Defender
- PowerShell
- Shellbags
- LNK & jump lists
- Recent docs & MRU
- Processes
- USB history
Improve your checks.
File journal
Deleted files leave a trail
Every create, rename, move and delete the system recorded.
Persistence
Everything that autostarts
Run keys, scheduled tasks, services, drivers and WMI.
Signatures
Signed or tampered
Certificate chain validation against Microsoft’s trusted root list.
Hardware
Devices that don’t belong
USB implants, DMA boards and PCIe attack hardware exposed.
Local scan
Files never leave the PC
Every scan runs on the player’s PC. The screensharer’s panel gets its results, never the files.
Your own YARA rules
Write them in the dashboard. Every check runs them on every file it finds.
import "math"
rule packed_executable
{
meta:
description = "Packed or protected EXE"
strings:
$upx = "UPX!"
$vmp = ".vmp0"
$tmd = ".themida"
condition:
uint16(0) == 0x5A4D and
(any of them or
math.entropy(0, filesize) > 7.4)
}From PIN to results.
PIN for the playerResearcher
Hand this PIN to the player
Waiting for the player…
xsec.exeAdministrator
Sign in to startEnter the 5-digit PIN from your screensharer.
Waiting for PIN0%
127.0.0.1Session connected
Modules23 read
Records196,412
Took2:41
- CHROME.EXEPrefetch · 412 runs, last Oct 8, 14:49Execution
- DownloadsShellbags · folder opened Oct 8, 13:05User
- setup_v2.zipUSN-Journal · created in Downloads, Oct 8, 13:02File system
Simple pricing.
Free tool
Run it yourself, no account needed.
€0always free
Offline scan, no server connection.
- Execution artifacts
- Persistence artifacts
- NTFS logs
- Digital signature check
Researcher
For individual screensharers.
€7.99per month
One license for one person.
- 2 checks at the same time
- All Windows artifacts
- Hardware and boot info
- Digital signature check
- Automatic YARA scanning
- Advanced tamper detection
- File recovery mode
Network
For teams that check together.
€20per month
3 seats included, extra seats €5.99 each.
- Own Discord login per member
- One shared balance
- 2 checks at once per seat
Questions
Log in with DiscordWhich Windows versions are supported?
Windows 10 and Windows 11. We test on Windows 10 22H2 and Windows 11 25H2.
Does the player need administrator rights?
Yes. Reading the disk directly needs them. If xsec.exe starts without them, it offers to restart as administrator.
What does the player have to do?
Start xsec.exe and enter the PIN you give them. If you send a download instead, the file already carries the check. They never create an account.
How many checks can run at once?
Two per license. A license can hold up to five unused PINs, and each PIN expires after 15 minutes.
How do I pay?
With crypto, in the panel. You buy one month at a time and nothing renews automatically. License keys can be redeemed in the panel too.
Can my team share one plan?
Yes, with Network. 3 seats are included and each extra seat is €5.99 a month. Every member signs in with their own Discord account, and the owner manages seats and renewals from a shared balance.
Why do I log in with Discord?
It’s the only way in. XSEC keeps your Discord user id and, from your latest login, your username, display name and picture. It never stores your email or your Discord token.