No remediation path
There is no fix mode and no -Remediate switch. The tool has no code that applies a setting.
See every control. Prove every result.
A portable, read-only assessment tool for Windows 11 and Windows Server 2022. It reads the system, decides each STIG rule, and shows you the expected value, the observed value, and the logic that connects them — for all 535 rules, whether the answer was Pass or Fail.
Most scanners hand you a verdict. This is one rule as Eye of Horus reports it — the same structure appears in the HTML report, the CKL finding details, and the JSON. Open it.
Win32_DeviceGuard.SecurityServicesRunning contains 1 (Credential Guard active)
SecurityServicesRunning = {0}
VirtualizationBasedSecurityStatus = 2
Credential Guard running = False
The collected evidence did not satisfy the automated conditions for this rule.
Method: Supplemental PowerShell Collector status: Completed Evidence items: 1
No human answer was applied.
Evidence SHA-256 9f2c1e… Catalog SHA-256 05ecc0… Engine SHA-256 4fa649… Proof SHA-256 b71a08…
{ "TraceType": "SupplementalEvaluation",
"Check": "Verify Credential Guard is running…",
"Observation": "Credential Guard running=False",
"Outcome": "Fail" }
[{ "SecurityServicesConfigured": [1],
"SecurityServicesRunning": [0] }]
Rule catalogs are generated from official DISA Cyber Exchange STIG packages and embedded in the engines. Nothing is fetched at runtime.
| Target | DISA manual baseline | Rules | SCAP / OVAL | Supplemental PowerShell |
|---|---|---|---|---|
| Windows 11 | V2R8 | 256 | 219 | 37 |
| Windows Server 2022 | V2R9 | 279 | 217 | 62 |
The Server 2022 engine resolves standalone, member-server, domain-controller, Desktop Experience, and Server Core applicability before it evaluates anything. It also inventories installed features and names the additional product STIGs that apply — Active Directory, DNS, IIS, SQL Server, AD FS — rather than implying an OS baseline covers them.
Eye of Horus is a detective control. It never remediates, and it never writes a registry value, policy setting, or ACL that a STIG rule evaluates.
There is no fix mode and no -Remediate switch. The tool has no code that applies a setting.
Reports under STIG-Results, and short-lived collection files under %TEMP% that it removes.
It can mount an offline NTUSER.DAT read-only to collect per-user evidence. Every mount is tracked, and the unload is retried and verified. -SkipUserHiveLoading turns it off.
Rule content is embedded. The assessment runs with no outbound connection, no agent, and no service left behind.
A failed collection is recorded as an error, never as evidence of absence. A rule that could not be measured never becomes a Pass.
Compare-EyeOfHorus.ps1 diffs two JSON reports and reports status, evidence, and decision changes between runs.
Every target produces all of these, plus a SHA-256 manifest.
No installer, no dependencies, no configuration file.
Do not launch it from inside Explorer's ZIP view. The launcher checks for both engine folders and stops if they are missing.
Double-click it. It requests elevation on its own, so right-click is optional. From a prompt you can call the orchestrator directly instead:
.\Invoke-EyeOfHorus.ps1
The console states the outcome in plain language before it closes.
Everything lands in STIG-Results. Open the HTML report and expand any rule to see how the answer was reached.
Windows 11, or Windows Server 2022 as standalone, member server, or domain controller. Server Core is supported.
Windows PowerShell 5.1, which ships in the box. Nothing to install.
Local administrator, because STIG evidence includes policy, audit, and registry state that is not readable otherwise.
None for a local assessment. Remote targets use PowerShell remoting if you choose to scan a fleet.
The full validator, both engines, and all 535 rules. Try it against a test system and compare a sample of results to the corresponding DISA manual checks.
SHA-256 of the archive:
c38cf84326f86dec437fa626a9996fc118c8763bad027f9b12d301a15ed7cc6b
Get-FileHash .\Eye-of-Horus-STIG-Validator-1_0_9.zip -Algorithm SHA256
After extracting, RELEASE-MANIFEST.json carries a
SHA-256 for every file in the package, so you can confirm the engines were not
modified even if the archive was repacked in transit.
Eye of Horus is not an official DoD product and is not affiliated with or endorsed by DISA. Embedded rule content is generated from public DISA Cyber Exchange STIG packages and remains subject to its original notices.
A generated result is not an authorization decision. Validators remain responsible for reviewing collected evidence, organizational policy, applicability, and approved exceptions.
Run it in a test OU first. Compare a sample of Pass, Fail, Review, Error, and Not Applicable results against the corresponding DISA manual checks, and validate CKL import and repeat-run drift behavior, before relying on it for an assessment of record.