CSEC_PUBLIC/WELA
1
0 Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2026-10-08 23:35:28 +02:00
Code Issues Packages Projects Releases Wiki Activity

Integrate reviewed WMI recovery with combined dev auditing batch

Browse Source
This commit is contained in:
Shirofune-Security committed 2026-09-22 15:06:51 +09:00
2 parents ab45d03f15 e584345df3
commit bfa286bf7d
46 files changed
+2449 -47
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.gitattributes
+16 -7
View File
@@ -58,25 +58,37 @@ tests/SelectedSaclFixtureProtection.cs text eol=lf
/scripts/WmiNamespaceAuditing.ps1 text eol=lf
/scripts/WefArrival.ps1 text eol=lf
/tests/WmiProbe*.ps1 text eol=lf
# Leaf-file recovery review binds these exact helper bytes.
/scripts/FileSaclRecovery* text eol=lf
/tests/FileSaclRecovery* text eol=lf
# Actual archive-reader evidence binds implementation and native-token source bytes.
/scripts/EvtxRecovery.ps1 text eol=lf
/scripts/NativeValidation.ps1 text eol=lf
/tests/EvtxRecovery*.ps1 text eol=lf
/tests/fixtures/EvtxReader*.ps1 text eol=lf
/scripts/TranscriptProbe* text eol=lf
/scripts/PowerShellTranscription.ps1 text eol=lf
/scripts/WefArrival.ps1 text eol=lf
/tests/TranscriptProbe*.ps1 text eol=lf
# Named registry recovery binds implementation bytes across checkouts.
/scripts/NamedRegistryRecovery* text eol=lf
/scripts/AuditRecovery.ps1 text eol=lf
/tests/NamedRegistryRecovery* text eol=lf
/scripts/Capi2Probe* text eol=lf
/tests/Capi2Probe* text eol=lf
/scripts/CustomAuditProfiles.ps1 text eol=lf
# Reviewed WEC state plans bind native setter and runtime source bytes.
/scripts/WecState* text eol=lf
/scripts/WecRuntime* text eol=lf
/tests/WecState* text eol=lf
/scripts/WecListener* text eol=lf
# Existing-file read receipts bind identical native/worker source bytes.
/scripts/FileAccessProbe* text eol=lf
/tests/FileAccessProbe* text eol=lf
# Disposable native provider configuration fixture
tests/NativeProviderConfigure.Windows.Tests.ps1 text eol=lf
# Disposable public registry lifecycle fixture bytes are retained in evidence.
/tests/RegistrySacl* text eol=lf
/scripts/WecAuthorization* text eol=lf
@@ -84,19 +96,16 @@ tests/NativeProviderConfigure.Windows.Tests.ps1 text eol=lf
# Reviewed channel restoration binds exact installed source bytes.
/scripts/ChannelRecovery.ps1 text eol=lf
/tests/ChannelRecovery*.ps1 text eol=lf
# Registry recovery plans bind identical source bytes across native hosts.
/scripts/RegistrySaclRecovery* text eol=lf
/tests/RegistrySaclRecovery* text eol=lf
/scripts/SelectedSaclDescendants.ps1 text eol=lf
/scripts/AuditRecovery.ps1 text eol=lf
/scripts/EvtxRecovery.ps1 text eol=lf
# Collector inventory reads native UTF16 names and bounded Unicode XML.
/modules/WecSubscriptionInventory.cs text eol=lf
/tests/WecCollectorObservation* text eol=lf
/tests/WecSubscriptionInventory* text eol=lf
/tests/TokenRightAttribution*.ps1 text eol=lf
/tests/TokenRightAttribution*.cs text eol=lf
# Disposable public OneSettings fixture source identity.