Stack intended-reader EVTX recovery on the approved native auditing batch

This commit is contained in:
Shirofune-Security committed 2026-09-22 14:56:09 +09:00
commit 1dfd3a92b9
37 files changed
+1933 -8

No files matched your search

+10
View File
@@ -102,6 +102,16 @@ tests/NativeProviderConfigure.Windows.Tests.ps1 text eol=lf
/tests/WecCollectorObservation* text eol=lf
/tests/WecSubscriptionInventory* text eol=lf
/tests/TokenRightAttribution*.ps1 text eol=lf
/tests/TokenRightAttribution*.cs text eol=lf
# Disposable public OneSettings fixture source identity.
/tests/OneSettingsConfigure*.ps1 text eol=lf
# Scoped NTLM source and native evidence retain stable bytes.
/scripts/NtlmAudit.ps1 text eol=lf
/tests/NtlmAudit* text eol=lf
# Native query receipts bind the same source bytes on every supported engine.
/scripts/WefQuery* text eol=lf
/tests/WefQuery* text eol=lf
# Public filesystem-SACL disposable lifecycle evidence.
tests/FileSaclProfileFixture.cs text eol=lf
tests/FileSaclLifecycle.Windows.Tests.ps1 text eol=lf