CSEC_PUBLIC/WELA
1
0 Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2026-10-08 23:35:28 +02:00
Code Issues Packages Projects Releases Wiki Activity

Verify native EVTX recovery under the actual primary reader token

Browse Source
This commit is contained in:
Shirofune-Security committed 2026-09-21 09:30:59 +09:00
1 parent fd7a7924aa
commit 2631331406
11 files changed
+224 -31
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.github/workflows/evtx-recovery.yml
+6 -3
View File
@@ -5,11 +5,14 @@ on:
paths:
- 'WELA.ps1'
- 'scripts/EvtxRecovery.ps1'
- 'scripts/ChannelRead.ps1'
- 'scripts/ChannelReadNative.cs'
- 'scripts/WefArrival.ps1'
- 'scripts/ControlApplicability.ps1'
- 'scripts/Configuration.ps1'
- 'modules/AuditProfiles.psm1'
- 'tests/EvtxRecovery*'
- 'tests/fixtures/EvtxRecovery*'
- 'tests/fixtures/Evtx*'
- 'scripts/NativeValidation.ps1'
- 'scripts/CustomAuditProfiles.ps1'
- '.github/workflows/evtx-recovery.yml'
@@ -31,10 +34,10 @@ jobs:
run: ./tests/EvtxRecovery.Tests.ps1
- name: Native EVTX export and recovery with policy restoration
shell: powershell
run: ./tests/EvtxRecovery.Windows.Tests.ps1 -AllowDisposablePolicyWrite
run: ./tests/EvtxRecovery.Windows.Tests.ps1 -AllowDisposablePolicyWrite -AllowDisposableAccount
- name: Synthetic rejection regressions in PowerShell 7
shell: pwsh
run: ./tests/EvtxRecovery.Tests.ps1
- name: Native EVTX recovery from PowerShell 7 with restoration
shell: pwsh
run: ./tests/EvtxRecovery.Windows.Tests.ps1 -AllowDisposablePolicyWrite
run: ./tests/EvtxRecovery.Windows.Tests.ps1 -AllowDisposablePolicyWrite -AllowDisposableAccount