From 35e5329f74225e1012217e34c88591af27184553 Mon Sep 17 00:00:00 2001 From: Shirofune-Security <43838376+Shirofune-Security@users.noreply.github.com> Date: Thu, 17 Sep 2026 22:31:54 +0900 Subject: [PATCH] configure: add Process Termination, Detailed File Share, and DC LDAP 1644 logging Fills the remaining gaps so 'configure' + 'configure-sacl' cover a full detection baseline out of the box (no manual auditpol/registry needed downstream): - Detailed Tracking > Process Termination (4689) - Object Access > Detailed File Share (5145) - Directory Service LDAP query logging (1644) via NTDS "15 Field Engineering"=5, applied only on domain controllers (BloodHound/LDAP recon). Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01MVUmXZBkr5FnZ2hwFkDhx7 --- WELA.ps1 | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/WELA.ps1 b/WELA.ps1 index c65e626b..cd9234a4 100644 --- a/WELA.ps1 +++ b/WELA.ps1 @@ -1132,6 +1132,17 @@ function ConfigureAuditSettings { ) Set-RegistryConfig -RegPaths $regPaths -Auto:$Auto + # LDAP query logging (Directory Service EventID 1644) - domain controllers only. + # "15 Field Engineering" = 5 makes expensive / inefficient LDAP searches log as 1644, which surfaces + # BloodHound / SharpHound-style directory reconnaissance. Only applied where the NTDS role is present. + if (Test-Path "HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters") { + Write-Host "Configuring LDAP query logging (1644) on this domain controller..." + Write-Host "" + Set-RegistryConfig -RegPaths @( + @{Path = "HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics"; Name = "15 Field Engineering"; Value = 5} + ) -Auto:$Auto + } + # 監査ポリシーの設定 Write-Host "Configuring Audit Policies..." Write-Host "" @@ -1146,6 +1157,7 @@ function ConfigureAuditSettings { @{Category = "Account Management"; Name = "User Account Management"; GUID = "0CCE9235-69AE-11D9-BED3-505054503030"}, @{Category = "Detailed Tracking"; Name = "Plug and Play"; GUID = "0cce9248-69ae-11d9-bed3-505054503030"}, @{Category = "Detailed Tracking"; Name = "Process Creation"; GUID = "0CCE922B-69AE-11D9-BED3-505054503030"}, + @{Category = "Detailed Tracking"; Name = "Process Termination"; GUID = "0CCE922C-69AE-11D9-BED3-505054503030"}, @{Category = "Detailed Tracking"; Name = "RPC Events"; GUID = "0CCE922E-69AE-11D9-BED3-505054503030"}, @{Category = "DS Access"; Name = "Directory Service Access"; GUID = "0CCE923B-69AE-11D9-BED3-505054503030"}, @{Category = "DS Access"; Name = "Directory Service Changes"; GUID = "0CCE923C-69AE-11D9-BED3-505054503030"}, @@ -1156,6 +1168,7 @@ function ConfigureAuditSettings { @{Category = "Logon/Logoff"; Name = "Special Logon"; GUID = "0CCE921B-69AE-11D9-BED3-505054503030"}, @{Category = "Object Access"; Name = "Certification Services"; GUID = "0CCE9221-69AE-11D9-BED3-505054503030"}, @{Category = "Object Access"; Name = "File Share"; GUID = "0CCE9224-69AE-11D9-BED3-505054503030"}, + @{Category = "Object Access"; Name = "Detailed File Share"; GUID = "0CCE9244-69AE-11D9-BED3-505054503030"}, @{Category = "Object Access"; Name = "Filtering Platform Connection"; GUID = "0CCE9226-69AE-11D9-BED3-505054503030"}, @{Category = "Object Access"; Name = "Other Object Access Events"; GUID = "0CCE9227-69AE-11D9-BED3-505054503030"}, @{Category = "Object Access"; Name = "Removable Storage"; GUID = "0CCE9245-69AE-11D9-BED3-505054503030"},