CSEC_PUBLIC/WELA
1
0 Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2026-10-23 22:53:00 +02:00
Code Issues Packages Projects Releases Wiki Activity

Reserve registry probe capacity and isolate exact-value cleanup

Browse Source
This commit is contained in:
Shirofune-Security committed 2026-09-22 14:59:21 +09:00
1 parent 9575c8204d
commit d72bf939a7
4 files changed
+39 -3
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/registry-value-probe.md
+1 -1
View File
@@ -7,7 +7,7 @@
./WELA.ps1 registry-probe -RegistryProbeAction Run -RegistryProbeOutputPath C:\WelaEvidence\registry-001
```
Prepare the diagnostic key and its auditing through a separately reviewed administrative process. Run requires an ordinary elevated current primary token with its existing SeSecurityPrivilege assigned, native 64-bit Windows PowerShell 5.1 or PowerShell7, an enabled/readable Security channel, Registry success auditing, audit precedence DWORD1, and an ordinary success SetValue SACL ACE matching the actual user or enabled group. No target prerequisites are silently repaired. The fixed key must have no children. Component-by-component native opens reject registry symbolic links and verify the held NT path. Full SDK-defined security-descriptor sections and a bounded inventory of raw typed values are retained; excessive or unreadable state fails closed.
Prepare the diagnostic key and its auditing through a separately reviewed administrative process. Run requires an ordinary elevated current primary token with its existing SeSecurityPrivilege assigned, native 64-bit Windows PowerShell 5.1 or PowerShell7, an enabled/readable Security channel, Registry success auditing, audit precedence DWORD1, and an ordinary success SetValue SACL ACE matching the actual user or enabled group. No target prerequisites are silently repaired. The fixed key must have no children. Component-by-component native opens reject registry symbolic links and verify the held NT path. Full SDK-defined security-descriptor sections and a bounded inventory of raw typed values are retained; excessive or unreadable state fails closed. Run reserves room for the temporary value before mutation (at most127 original values and sufficient raw-byte capacity). Cleanup queries the exact owned value independently, so unrelated inventory growth cannot strand its marker.
Microsoft describes [4657 and the Set Value SACL prerequisite](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4657). The probe uses the documented [RegSetValueExW](https://learn.microsoft.com/en-us/windows/win32/api/winreg/nf-winreg-regsetvalueexw) and [RegDeleteValueW](https://learn.microsoft.com/en-us/windows/win32/api/winreg/nf-winreg-regdeletevaluew) APIs through the same held key. Existing values are never selected for modification. A collision refuses before writing; a changed owned value is preserved with failed cleanup rather than blindly deleted. Operations are not transactions with other administrators.