CSEC_PUBLIC/WELA
1
0 Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2026-11-01 18:58:16 +01:00
Code Issues Packages Projects Releases Wiki Activity

Reject coerced transcription recovery history discriminators

Browse Source
This commit is contained in:
Shirofune-Security committed 2026-09-21 18:19:57 +09:00
1 parent 2e329c7f2f
commit 22d3a13180
3 files changed
+72 -14
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/transcription-recovery.md
+1 -1
View File
@@ -1,6 +1,6 @@
# Recover Windows PowerShell transcription policy
`transcription-recovery` reviews and restores the two machine values changed by one completed `powershell-transcription -TranscriptionAction Configure` run. It requires that run's original `before.jsonl` and final JSON result, exactly one `Applied` control named `PowerShellTranscription/CisV4L2`, and current policy/directory observations that still match its final `After` evidence. Failed, partial, skipped and already-compliant configuration records require manual review.
`transcription-recovery` reviews and restores the two machine values changed by one completed `powershell-transcription -TranscriptionAction Configure` run. It requires that run's original `before.jsonl` and final JSON result, exactly one `Applied` control named `PowerShellTranscription/CisV4L2`, and current policy/directory observations that still match its final `After` evidence. Status, control, target and registry-type discriminators require actual strings; schema and outcome counters require integers. Boolean values cannot stand in for those fields. Failed, partial, skipped and already-compliant configuration records require manual review.
```powershell
./WELA.ps1 transcription-recovery -TranscriptRecoveryAction Plan `