CSEC_PUBLIC/WELA
1
0 Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2026-10-24 15:08:08 +02:00
Code Issues Packages Projects Releases Wiki Activity

Document bounded WMI tree guarantees and record native protection behavior

Browse Source
This commit is contained in:
Shirofune-Security committed 2026-09-22 14:40:25 +09:00
1 parent 036f51886a
commit ddcdd8e2b8
11 files changed
+71 -8
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

scripts/WmiNamespaceAuditing.ps1
+7 -1
View File
@@ -264,7 +264,12 @@ function Get-WelaWmiAuditPlan {
} else {$snapshot = Get-WelaWmiNamespaceSnapshot $name}
$descriptor = $snapshot.DescriptorJson | ConvertFrom-Json
$missing = @(Get-WelaWmiMissingAces $descriptor $selected)
[pscustomobject]@{ Namespace = $name; Status = $(if ($missing.Count) { 'ChangeRequired' } else { 'AlreadyCompliant' }); Before = $snapshot; Definitions = $selected; Missing = $missing; Descendants=$tree; Diagnostic = '' }
$status=if($missing.Count){'ChangeRequired'}else{'AlreadyCompliant'};$diagnostic=''
if($tree -and -not $missing.Count){
$outcomes=Test-WelaWmiDescendantOutcomes $tree $tree $selected
if($outcomes.Status -cne 'Observed'){$status='Unknown';$diagnostic='Parent entry exists but descendants are unverified: '+($outcomes.Diagnostics -join '; ')}
}
[pscustomobject]@{ Namespace = $name; Status = $status; Before = $snapshot; Definitions = $selected; Missing = $missing; Descendants=$tree; Diagnostic = $diagnostic }
} catch { [pscustomobject]@{ Namespace = $name; Status = 'Unknown'; Before = $null; Definitions = $selected; Missing = @(); Diagnostic = $_.Exception.Message } }
}
}
@@ -282,6 +287,7 @@ function Set-WelaWmiAuditControls {
if((Get-WelaWmiDescendantKey $tree) -cne (Get-WelaWmiDescendantKey $state.PlannedTree)){throw 'WMI descendant tree changed after planning; no SACL was written.'}
$state.OriginalTree=$tree
}
if($tree.Context -cne $state.OriginalTree.Context){throw 'Caller token, host, source or service context changed since descendant planning.'}
$snapshot=$tree.Root|Select-Object *
$snapshot|Add-Member NoteProperty Descendants $tree -Force
} else {$snapshot = Get-WelaWmiNamespaceSnapshot $state.Namespace}