CSEC_PUBLIC/WELA
1
0
Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2025-12-06 09:12:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #136 from Yamato-Security/support-crypto-dpapi

Browse Source 
feat: support crypto dpapi log
This commit is contained in:
Zach Mathis (田中ザック)
2025-11-05 14:42:04 +08:00
committed by GitHub
parent afc9966bfe eb81232e7e
commit 4aacbbf5cb
1 changed files with 87 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

92
WELA.ps1
View File

@@ -61,7 +61,7 @@ class WELA {
[void] CountByLevel() {
$this.RulesCount = @{}
foreach ($level in [WELA]::Levels) {
$this.RulesCount[$level] = ($this.Rules | Where-Object { $_.level -eq $level }).Count
$this.RulesCount[$level] = @($this.Rules | Where-Object { $_.level -eq $level }).Count
}
}
@@ -71,7 +71,7 @@ class WELA {
$color = if ($this.CurrentSetting -eq "Enabled" -or $this.CurrentSetting -contains "Success" -or $this.CurrentSetting -contains "Failure") { "Green" } else { "Red" }
$ruleCounts = ""
$logEnabled = $this.CurrentSetting
$allZero = $this.RulesCount.Values | Where-Object { $_ -ne 0 } | Measure-Object | Select-Object -ExpandProperty Count
$allZero = ($this.RulesCount.Values | Where-Object { $_ -ne 0 }).Count
if ($allZero -eq 0) {
$ruleCounts = "(no rules)"
$color = "DarkYellow"
@@ -277,6 +277,26 @@ function GuideYamatoSecurity
""
)
# Crypto-DPAPI Debug
$guid = ""
$eids = @()
$channels = @("Microsoft-Windows-Crypto-DPAPI/Debug")
$enabled = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Crypto-DPAPI/Debug" -valueName "Enabled" -expectedValue 1
$current = if ($enabled) { "Enabled" } else { "Disabled" }
$rules = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid }
$rules | ForEach-Object { $_.applicable = $enabled }
$rules | ForEach-Object { $_.ideal = $true }
$auditResult += [WELA]::New(
"Crypto-DPAPI Debug",
"",
$current,
[array]$rules,
"Disabled",
"Enabled",
"",
""
)
# CodeIntegrity Operational
$guid = ""
$eids = @()
@@ -1513,6 +1533,26 @@ function GuideASD {
""
)
# Crypto-DPAPI Debug
$guid = ""
$eids = @()
$channels = @("Microsoft-Windows-Crypto-DPAPI/Debug")
$enabled = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Crypto-DPAPI/Debug" -valueName "Enabled" -expectedValue 1
$current = if ($enabled) { "Enabled" } else { "Disabled" }
$rules = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid }
$rules | ForEach-Object { $_.applicable = $enabled }
$rules | ForEach-Object { $_.ideal = $false }
$auditResult += [WELA]::New(
"Crypto-DPAPI Debug",
"",
$current,
[array]$rules,
"Disabled",
"",
"",
""
)
# Diagnosis-Scripted Operational
$guid = ""
$eids = @()
@@ -2730,6 +2770,26 @@ function GuideMSC {
""
)
# Crypto-DPAPI Debug
$guid = ""
$eids = @()
$channels = @("Microsoft-Windows-Crypto-DPAPI/Debug")
$enabled = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Crypto-DPAPI/Debug" -valueName "Enabled" -expectedValue 1
$current = if ($enabled) { "Enabled" } else { "Disabled" }
$rules = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid }
$rules | ForEach-Object { $_.applicable = $enabled }
$rules | ForEach-Object { $_.ideal = $false }
$auditResult += [WELA]::New(
"Crypto-DPAPI Debug",
"",
$current,
[array]$rules,
"Disabled",
"",
"",
""
)
# Diagnosis-Scripted Operational
$guid = ""
$eids = @()
@@ -3947,6 +4007,26 @@ function GuideMSS {
""
)
# Crypto-DPAPI Debug
$guid = ""
$eids = @()
$channels = @("Microsoft-Windows-Crypto-DPAPI/Debug")
$enabled = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Crypto-DPAPI/Debug" -valueName "Enabled" -expectedValue 1
$current = if ($enabled) { "Enabled" } else { "Disabled" }
$rules = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid }
$rules | ForEach-Object { $_.applicable = $enabled }
$rules | ForEach-Object { $_.ideal = $false }
$auditResult += [WELA]::New(
"Crypto-DPAPI Debug",
"",
$current,
[array]$rules,
"Disabled",
"",
"",
""
)
# Diagnosis-Scripted Operational
$guid = ""
$eids = @()
@@ -5142,8 +5222,8 @@ function AuditLogSetting {
if ($outType -eq "std") {
$auditResult | Group-Object -Property Category | ForEach-Object {
$enabledCount = ($_.Group | Where-Object { $_.CurrentSetting -ne "No Auditing" } | ForEach-Object { $_.Rules.Count } | Measure-Object -Sum).Sum
$disabledCount = ($_.Group | Where-Object { $_.CurrentSetting -eq "No Auditing" } | ForEach-Object { $_.Rules.Count } | Measure-Object -Sum).Sum
$enabledCount = ($_.Group | Where-Object { $_.CurrentSetting -ne "No Auditing" -and $_.CurrentSetting -ne "Disabled" } | ForEach-Object { $_.Rules.Count } | Measure-Object -Sum).Sum
$disabledCount = ($_.Group | Where-Object { $_.CurrentSetting -eq "No Auditing" -or $_.CurrentSetting -eq "Disabled" } | ForEach-Object { $_.Rules.Count } | Measure-Object -Sum).Sum
$out = ""
$color = ""
if ($disabledCount -eq 0 -and $enabledCount -ne 0){
@@ -5329,6 +5409,7 @@ function AuditFileSize {
"Microsoft-Windows-Bits-Client/Analytic" = @("1 MB", "128 MB+")
"Microsoft-Windows-Bits-Client/Operational" = @("1 MB", "128 MB+")
"Microsoft-Windows-CodeIntegrity/Operational" = @("1 MB", "128 MB+")
"Microsoft-Windows-Crypto-DPAPI/Debug" = @("1 MB", "128 MB+")
"Microsoft-Windows-DriverFrameworks-UserMode/Operational" = @("1 MB", "128 MB+")
"Microsoft-Windows-NTLM/Operational" = @("1 MB", "128 MB+")
"Microsoft-Windows-PowerShell/Operational" = @("20 MB", "256 MB+")
@@ -5506,6 +5587,7 @@ function ConfigureAuditSettings {
"Microsoft-Windows-AppLocker/Packaged app-Deployment",
"Microsoft-Windows-AppLocker/Packaged app-Execution",
"Microsoft-Windows-CodeIntegrity/Operational",
"Microsoft-Windows-Crypto-DPAPI/Debug",
"Microsoft-Windows-Diagnosis-Scripted/Operational",
"Microsoft-Windows-DriverFrameworks-UserMode/Operational",
"Microsoft-Windows-WMI-Activity/Operational",
@@ -5545,7 +5627,7 @@ function ConfigureAuditSettings {
# 特定のログの有効化
Write-Host "Enabling Event Logs..."
Write-Host ""
foreach ($log in @("Microsoft-Windows-TaskScheduler/Operational", "Microsoft-Windows-DriverFrameworks-UserMode/Operational")) {
foreach ($log in @("Microsoft-Windows-TaskScheduler/Operational", "Microsoft-Windows-DriverFrameworks-UserMode/Operational", "Microsoft-Windows-Crypto-DPAPI/Debug")) {
try {
$logInfo = Get-WinEvent -ListLog $log -ErrorAction Stop
$currentState = if ($logInfo.IsEnabled) { "Enabled" } else { "Disabled" }