CSEC_PUBLIC/WELA
1
0
Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2025-12-07 17:52:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: add registry check

Browse Source
This commit is contained in:
fukusuket
2025-04-14 00:05:50 +09:00
parent 745e2524a9
commit 438af15776
1 changed files with 21 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
WELA.ps1
View File

@@ -158,6 +158,25 @@ function RuleFilter {
return $result
}
function CheckRegistryValue {
param (
[string]$registryPath,
[string]$valueName,
[int]$expectedValue
)
try {
$value = Get-ItemProperty -Path $registryPath -Name $valueName -ErrorAction Stop
if ($value.$valueName -eq $expectedValue) {
return $true
} else {
return $false
}
} catch {
return $false
}
}
function AuditLogSetting {
param (
[string] $outType
@@ -195,7 +214,7 @@ function AuditLogSetting {
$guid = ""
$eids = @("4103")
$channels = @("pwsh")
$enabled = $false
$enabled = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell\ModuleLogging" -valueName "EnableModuleLogging" -expectedValue 1
$rules = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid }
$rules | ForEach-Object { $_.applicable = $enabled }
$auditResult += [WELA]::New(
@@ -209,7 +228,7 @@ function AuditLogSetting {
$guid = ""
$eids = @("4104")
$channels = @("pwsh")
$enabled = $false
$enabled = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -valueName "EnableScriptBlockLogging" -expectedValue 1
$rules = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid }
$rules | ForEach-Object { $_.applicable = $enabled }
$auditResult += [WELA]::New(