CSEC_PUBLIC/WELA
1
0
Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2025-12-06 09:12:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

chg: separate size recommend

Browse Source
This commit is contained in:
fukusuket
2025-05-08 11:28:28 +09:00
parent 39e17566bb
commit ca17906fe9
1 changed files with 72 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files

144
WELA.ps1
View File

@@ -215,8 +215,8 @@ function AuditLogSetting {
"", "",
$enabled, $enabled,
[array]$rules, [array]$rules,
"Enabled. 20 MB", "Enabled",
"Enabled. 128 MB+", "Enabled",
"", "",
"" ""
) )
@@ -233,10 +233,10 @@ function AuditLogSetting {
"", "",
$enabled, $enabled,
[array]$rules, [array]$rules,
"Enabled if AppLocker is enabled? 1 MB", "Enabled",
"Enabled. 256 MB+", "Enabled",
"", "",
"" "Enabled if AppLocker is enabled?"
) )
# Bits-Client Operational # Bits-Client Operational
@@ -251,8 +251,8 @@ function AuditLogSetting {
"", "",
$enabled, $enabled,
[array]$rules, [array]$rules,
"Enabled. 1 MB", "Enabled",
"Enabled. 256 MB+", "Enabled",
"", "",
"" ""
) )
@@ -269,8 +269,8 @@ function AuditLogSetting {
"", "",
$enabled, $enabled,
[array]$rules, [array]$rules,
"Enabled. 1 MB", "Enabled",
"Enabled. 256 MB+", "Enabled",
"", "",
"" ""
) )
@@ -287,8 +287,8 @@ function AuditLogSetting {
"", "",
$enabled, $enabled,
[array]$rules, [array]$rules,
"Enabled. 1 MB", "Enabled",
"Enabled. 256 MB+", "Enabled",
"", "",
"" ""
) )
@@ -305,8 +305,8 @@ function AuditLogSetting {
"", "",
$enabled, $enabled,
[array]$rules, [array]$rules,
"Enabled. 1 MB", "Enabled",
"Enabled. 256 MB+", "Enabled",
"", "",
"" ""
) )
@@ -323,8 +323,8 @@ function AuditLogSetting {
"", "",
$enabled, $enabled,
[array]$rules, [array]$rules,
"Enabled. 1 MB", "Enabled",
"Enabled. 256 MB+", "Enabled",
"", "",
"" ""
) )
@@ -341,10 +341,10 @@ function AuditLogSetting {
"", "",
$enabled, $enabled,
[array]$rules, [array]$rules,
"Enabled. 1 MB", "Enabled",
"This log is recommended to enable if you want to disable NTLM authentication", "Enabled",
"", "",
"" "This log is recommended to enable if you want to disable NTLM authentication"
) )
# PowerShell # PowerShell
@@ -360,7 +360,7 @@ function AuditLogSetting {
"Classic", "Classic",
$enabled, $enabled,
[array]$rules, [array]$rules,
"Enabled. 15 MB", "Enabled",
"Enabled", "Enabled",
"", "",
"" ""
@@ -396,10 +396,10 @@ function AuditLogSetting {
"ScriptBlock", "ScriptBlock",
$enabled, $enabled,
[array]$rules, [array]$rules,
"On Win 10/2016+, if a PowerShell script is flagged as suspicious by AMSI, it will be logged with a level of Warning", "Patially Enabled",
"Enabled", "Enabled",
"High", "High",
"" "On Win 10/2016+, if a PowerShell script is flagged as suspicious by AMSI, it will be logged with a level of Warning in default setting"
) )
# PrintService Admin # PrintService Admin
@@ -414,8 +414,8 @@ function AuditLogSetting {
"PrintService Admin", "PrintService Admin",
$enabled, $enabled,
[array]$rules, [array]$rules,
"Enabled. 1 MB", "Enabled",
"Enabled. 256 MB+", "Enabled",
"", "",
"" ""
) )
@@ -432,8 +432,8 @@ function AuditLogSetting {
"PrintService Operational", "PrintService Operational",
$enabled, $enabled,
[array]$rules, [array]$rules,
"Enabled. 1 MB", "Enabled",
"Enabled. 256 MB+", "Enabled",
"", "",
"" ""
) )
@@ -591,9 +591,9 @@ function AuditLogSetting {
$enabled, $enabled,
[array]$rules, [array]$rules,
"No Auditing", "No Auditing",
"Success and Failure if sysmon is not configured", "Success and Failure",
"High", "High",
"" "if sysmon is not configured"
) )
#### Process Termination #### Process Termination
@@ -608,9 +608,9 @@ function AuditLogSetting {
$enabled, $enabled,
[array]$rules, [array]$rules,
"No Auditing", "No Auditing",
"No Auditing unless you want to track the lifespan of processes", "No Auditing",
"High", "High",
"" "unless you want to track the lifespan of processes"
) )
#### RPC Events #### RPC Events
@@ -625,7 +625,7 @@ function AuditLogSetting {
$enabled, $enabled,
[array]$rules, [array]$rules,
"No Auditing", "No Auditing",
"Unknown. Needs testing", "",
"High on RPC servers (According to Microsoft)", "High on RPC servers (According to Microsoft)",
"" ""
) )
@@ -642,8 +642,8 @@ function AuditLogSetting {
$enabled, $enabled,
[array]$rules, [array]$rules,
"No Auditing", "No Auditing",
"Unknown. Needs testing", "",
"Unknown", "",
"" ""
) )
@@ -816,9 +816,9 @@ function AuditLogSetting {
$enabled, $enabled,
[array]$rules, [array]$rules,
"No Auditing", "No Auditing",
"No Auditing due to the high noise level. Enable if you can though", "No Auditing",
"Very high for file servers and DCs, however, may be necessary if you want to track who is accessing what files as well as detect various lateral movement", "Very high for file servers and DCs, however, may be necessary if you want to track who is accessing what files as well as detect various lateral movement",
"" "Due to the high noise level. Enable if you can though"
) )
#### File Share #### File Share
@@ -850,9 +850,9 @@ function AuditLogSetting {
$enabled, $enabled,
[array]$rules, [array]$rules,
"No Auditing", "No Auditing",
"Enable SACLs just for sensitive files", "Enable",
"Depends on SACL rules", "Depends on SACL rules",
"" "Enable SACLs just for sensitive files"
) )
#### Filtering Platform Connection #### Filtering Platform Connection
@@ -867,9 +867,9 @@ function AuditLogSetting {
$enabled, $enabled,
[array]$rules, [array]$rules,
"No Auditing", "No Auditing",
"Success and Failure if you have enough space and are not monitoring network connections with sysmon. This should cause a high amount of events though", "Success and Failure",
"High", "High",
"" "Success and Failure if you have enough space and are not monitoring network connections with sysmon. This should cause a high amount of events though"
) )
#### Filtering Platform Packet Drop #### Filtering Platform Packet Drop
@@ -884,9 +884,9 @@ function AuditLogSetting {
$enabled, $enabled,
[array]$rules, [array]$rules,
"No Auditing", "No Auditing",
"Success and Failure for AD CS role servers", "Success and Failure",
"High", "High",
"" "for AD CS role servers"
) )
#### Kernel Object #### Kernel Object
@@ -901,9 +901,9 @@ function AuditLogSetting {
$enabled, $enabled,
[array]$rules, [array]$rules,
"No Auditing", "No Auditing",
"Success and Failure but do not enable Audit the access of global system objects as you will generate too many 4663: Object Access events", "Success and Failure",
"High if auditing access of global object access is enabled", "High if auditing access of global object access is enabled",
"" "Success and Failure but do not enable Audit the access of global system objects as you will generate too many 4663: Object Access events"
) )
#### Handle Manipulation #### Handle Manipulation
@@ -952,9 +952,9 @@ function AuditLogSetting {
$enabled, $enabled,
[array]$rules, [array]$rules,
"No Auditing", "No Auditing",
"Set SACLs for only the registry keys that you want to monitor", "Success and Failure",
"Depends on SACLs", "Depends on SACLs",
"" "Set SACLs for only the registry keys that you want to monitor"
) )
#### Removable Storage #### Removable Storage
@@ -969,9 +969,9 @@ function AuditLogSetting {
$enabled, $enabled,
[array]$rules, [array]$rules,
"No Auditing", "No Auditing",
"Success and Failure if you want to monitor external device usage", "Success and Failure",
"Depends on how much removable storage is used", "Depends on how much removable storage is used",
"" "if you want to monitor external device usage"
) )
#### SAM #### SAM
@@ -986,9 +986,9 @@ function AuditLogSetting {
$enabled, $enabled,
[array]$rules, [array]$rules,
"No Auditing", "No Auditing",
"Success and Failure for AD CS role servers", "Success and Failure",
"Success and Failure if you can but may cause too high volume of noise so should be tested beforehand", "Success and Failure if you can but may cause too high volume of noise so should be tested beforehand",
"" "for AD CS role servers"
) )
### Policy Change ### Policy Change
@@ -1038,7 +1038,7 @@ function AuditLogSetting {
$enabled, $enabled,
[array]$rules, [array]$rules,
"No Auditing", "No Auditing",
"Unknown. Needs testing", "",
"Medium to High", "Medium to High",
"" ""
) )
@@ -1055,7 +1055,7 @@ function AuditLogSetting {
$enabled, $enabled,
[array]$rules, [array]$rules,
"No Auditing", "No Auditing",
"Unknown, Needs testing", "",
"Low", "Low",
"" ""
) )
@@ -1072,7 +1072,7 @@ function AuditLogSetting {
$enabled, $enabled,
[array]$rules, [array]$rules,
"No Auditing", "No Auditing",
"Unknown, Needs testing", "",
"Low", "Low",
"" ""
) )
@@ -1089,9 +1089,9 @@ function AuditLogSetting {
$enabled, $enabled,
[array]$rules, [array]$rules,
"No Auditing", "No Auditing",
"No Auditing (Note: ACSC recommends Success and Failure, however, this results in a lot of noise of 5447 (A Windows Filtering Platform filter has been changed) events being generated.)", "No Auditing ",
"Low", "Low",
"" "ACSC recommends Success and Failure, however, this results in a lot of noise of 5447 (A Windows Filtering Platform filter has been changed) events being generated"
) )
### Privilege Use ### Privilege Use
@@ -1124,9 +1124,9 @@ function AuditLogSetting {
$enabled, $enabled,
[array]$rules, [array]$rules,
"No Auditing", "No Auditing",
"Success and Failure However, this may be too noisy", "Success and Failure",
"High", "High",
"" "However, this may be too noisy"
) )
### System ### System
@@ -1142,7 +1142,7 @@ function AuditLogSetting {
$enabled, $enabled,
[array]$rules, [array]$rules,
"Success and Failure", "Success and Failure",
"Unknown. Needs testing", "",
"Low", "Low",
"" ""
) )
@@ -1210,8 +1210,8 @@ function AuditLogSetting {
"", "",
$enabled, $enabled,
[array]$rules, [array]$rules,
"Enabled. 1 MB", "Enabled",
"Enabled. 256 MB+", "Enabled",
"", "",
"" ""
) )
@@ -1228,8 +1228,8 @@ function AuditLogSetting {
"", "",
$enabled, $enabled,
[array]$rules, [array]$rules,
"Enabled. 1 MB", "Enabled",
"Enabled. 256 MB+", "Enabled",
"", "",
"" ""
) )
@@ -1246,8 +1246,8 @@ function AuditLogSetting {
"", "",
$enabled, $enabled,
[array]$rules, [array]$rules,
"Enabled. 8 MB", "Enabled",
"Enabled. 128 MB+", "Enabled",
"", "",
"" ""
) )
@@ -1264,8 +1264,8 @@ function AuditLogSetting {
"", "",
$enabled, $enabled,
[array]$rules, [array]$rules,
"Enabled. 20 MB", "Enabled",
"Enabled. 128 MB+", "Enabled",
"", "",
"" ""
) )
@@ -1282,8 +1282,8 @@ function AuditLogSetting {
"", "",
$enabled, $enabled,
[array]$rules, [array]$rules,
"Enabled. 1 MB", "Enabled",
"Enabled. 128 MB+", "Enabled",
"", "",
"" ""
) )
@@ -1300,8 +1300,8 @@ function AuditLogSetting {
"", "",
$enabled, $enabled,
[array]$rules, [array]$rules,
"Enabled. 1 MB", "Enabled",
"Enabled. 128 MB+", "Enabled",
"", "",
"" ""
) )
@@ -1318,8 +1318,8 @@ function AuditLogSetting {
"", "",
$enabled, $enabled,
[array]$rules, [array]$rules,
"Enabled. 1 MB", "Enabled",
"Enabled. 128 MB+", "Enabled",
"", "",
"" ""
) )
@@ -1336,8 +1336,8 @@ function AuditLogSetting {
"", "",
$enabled, $enabled,
[array]$rules, [array]$rules,
"Enabled. 1 MB", "Enabled",
"Enabled. 128 MB+", "Enabled",
"", "",
"" ""
) )