CSEC_PUBLIC/WELA
1
0 Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2026-10-24 15:08:08 +02:00
Code Issues Packages Projects Releases Wiki Activity

Collect local WMI namespace audit evidence with a fixed read probe (#428)

Browse Source 
* Collect bounded local WMI namespace access evidence

* Reference PR428 and preserve UTC worker query timestamps

* Observe equivalent runtime self tokens without reverting caller context

* Test native token equivalence against restricted caller changes

* Diagnose native token differences and package WMI probe guidance

* Limit WMI connections to the explicitly scoped security privilege

* Document verified native WMI events and privilege preservation

* Require an already-running WMI service before namespace reads
This commit is contained in:
田中ザック Isaac Mathis authored and GitHub committed 2026-09-21 09:08:20 +09:00
1 parent f1ed90d189
commit b84b97b358
17 files changed
+543 -3
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.gitattributes
+7
View File
@@ -38,3 +38,10 @@ modules/WecSubscriptionXml.cs text eol=lf
/modules/WecSubscriptionXml.cs text eol=lf
scripts/AppLockerProbe.ps1 text eol=lf
tests/AppLockerProbe*.ps1 text eol=lf
# Fixed local WMI probe source/worker fingerprints.
/scripts/WmiProbe*.ps1 text eol=lf
/scripts/WmiProbeNative.cs text eol=lf
/scripts/WmiNamespaceAuditing.ps1 text eol=lf
/scripts/WefArrival.ps1 text eol=lf
/tests/WmiProbe*.ps1 text eol=lf