Anvil

Anvil is a runtime-first tool designed for privilege escalation and attack surface assessment specifically targeting Windows thick client applications. It effectively reduces false positives by combining Procmon capture with Windows AccessCheck to validate writable paths in real-time while enforcing multiple verification gates. Notable features include its comprehensive approach to assessing various attack classes, detailed filtered analysis of candidate paths, and the ability to produce actionable reporting outputs in multiple formats.