CSEC_PUBLIC/WELA
1
0 Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2026-10-23 22:53:00 +02:00
Code Issues Packages Projects Releases Wiki Activity

test: measure fixed already-enabled debug privilege adjustment

Browse Source
This commit is contained in:
Shirofune-Security committed 2026-09-22 11:59:26 +09:00
1 parent cd65133fc4
commit 7136dadeac
2 files changed
+3 -3
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

tests/TokenRightProbe.Feasibility.ps1
+1 -1
View File
@@ -43,7 +43,7 @@ try{
$events=@(Get-WinEvent -LogName Security -FilterXPath $query -MaxEvents 256 -ErrorAction SilentlyContinue)
foreach($event in $events){
$raw=$event.ToXml();[xml]$xml=$raw;$data=@{};foreach($field in $xml.Event.EventData.Data){$data[[string]$field.Name]=[string]$field.'#text'}
if($data.ProcessId -and [Convert]::ToInt64($data.ProcessId,16) -eq $result.ProcessId -and ($data.EnabledPrivilegeList -match 'SeChangeNotifyPrivilege' -or $data.DisabledPrivilegeList -match 'SeChangeNotifyPrivilege')){$matches+=@([pscustomobject]@{RecordId=$event.RecordId;Xml=$raw;Data=$data})}
if($data.ProcessId -and [Convert]::ToInt64($data.ProcessId,16) -eq $result.ProcessId -and ($data.EnabledPrivilegeList -match 'SeDebugPrivilege' -or $data.DisabledPrivilegeList -match 'SeDebugPrivilege')){$matches+=@([pscustomobject]@{RecordId=$event.RecordId;Xml=$raw;Data=$data})}
$event.Dispose()
}
$matches=@($matches|Sort-Object RecordId -Unique)