CSEC_PUBLIC/WELA
1
0 Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2026-11-01 18:58:16 +01:00
Code Issues Packages Projects Releases Wiki Activity

Retain partial WMI tree observations after a parent write

Browse Source
This commit is contained in:
Shirofune-Security committed 2026-09-22 14:58:07 +09:00
1 parent 488d179f09
commit d5de556f74
3 files changed
+18 -5
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

scripts/WmiNamespaceAuditing.ps1
+6 -3
View File
@@ -278,11 +278,11 @@ function Set-WelaWmiAuditControls {
param($Context, [array]$Plan)
foreach ($entry in $Plan) {
$inherit=@($entry.Definitions|Where-Object {($_.AceFlags -band 2) -ne 0}).Count -gt 0
$callback = @{ Namespace = $entry.Namespace; Definitions = $entry.Definitions; Original = $null; ExpectedJson = $null; Applied = $false; VerifiedJson = $null; Inherit=$inherit; PlannedTree=$entry.Descendants; OriginalTree=$null; VerifiedTree=$null; DescendantVerification=[pscustomobject]@{Observation=$null} }
$callback = @{ Namespace = $entry.Namespace; Definitions = $entry.Definitions; Original = $null; ExpectedJson = $null; Applied = $false; VerifiedJson = $null; Inherit=$inherit; PlannedTree=$entry.Descendants; OriginalTree=$null; VerifiedTree=$null; DescendantVerification=[pscustomobject]@{ParentSetterAttempted=$false;ParentSetterAccepted=$false;Observation=$null;LastTree=$null} }
$read = {
param($state)
if($state.Inherit){
$tree=Get-WelaWmiStableDescendants $state.Namespace
$tree=Get-WelaWmiStableDescendants $state.Namespace $state.DescendantVerification
if($null -eq $state.OriginalTree){
if((Get-WelaWmiDescendantKey $tree) -cne (Get-WelaWmiDescendantKey $state.PlannedTree)){throw 'WMI descendant tree changed after planning; no SACL was written.'}
$state.OriginalTree=$tree
@@ -318,10 +318,13 @@ function Set-WelaWmiAuditControls {
$apply = {
param($state)
if($state.Inherit){
$fresh=Get-WelaWmiStableDescendants $state.Namespace
$fresh=Get-WelaWmiStableDescendants $state.Namespace $state.DescendantVerification
if((Get-WelaWmiDescendantKey $fresh) -cne (Get-WelaWmiDescendantKey $state.OriginalTree)){throw 'WMI descendant topology or descriptor changed before the parent setter; no SACL was written.'}
$state.DescendantVerification.ParentSetterAttempted=$true
$state.DescendantVerification.Observation=$null
}
Set-WelaWmiNamespaceDescriptor -Namespace $state.Namespace -ExpectedJson $state.ExpectedJson -Definitions $state.Definitions
if($state.Inherit){$state.DescendantVerification.ParentSetterAccepted=$true}
$state.Applied = $true
}
Invoke-WelaConfigurationControl -Context $Context -Id "WmiNamespace/$($entry.Namespace)/SACL" -Kind WmiNamespaceSacl `