CSEC_PUBLIC/WELA
1
0 Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2026-11-01 18:58:16 +01:00
Code Issues Packages Projects Releases Wiki Activity

Document bounded WMI tree guarantees and record native protection behavior

Browse Source
This commit is contained in:
Shirofune-Security committed 2026-09-22 14:40:25 +09:00
1 parent 036f51886a
commit ddcdd8e2b8
11 files changed
+71 -8
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

scripts/WmiNamespaceDescendants.ps1
+1 -1
View File
@@ -4,7 +4,7 @@ function Get-WelaWmiDescendantContext {
Initialize-WelaWmiProbeNative
if((Get-Service Winmgmt -ErrorAction Stop).Status -ne 'Running'){throw 'Winmgmt must already be running before descendant observation.'}
$sources=[ordered]@{}
foreach($name in @('WmiNamespaceAuditing.ps1','WmiNamespaceDescendants.ps1','WmiProbeNative.cs')){$sources[$name]=(Get-FileHash -LiteralPath (Join-Path $PSScriptRoot $name) -Algorithm SHA256 -ErrorAction Stop).Hash}
foreach($name in @('WmiNamespaceAuditing.ps1','WmiNamespaceDescendants.ps1','WmiProbeNative.cs','WmiProbe.ps1','Configuration.ps1')){$sources[$name]=(Get-FileHash -LiteralPath (Join-Path $PSScriptRoot $name) -Algorithm SHA256 -ErrorAction Stop).Hash}
[ordered]@{Computer=[Environment]::MachineName;Version=[Environment]::OSVersion.VersionString;Token=(Get-WelaWmiProbeTokenKey ([Wela.WmiProbe.Native]::Snapshot()));Sources=$sources}|ConvertTo-Json -Compress -Depth 5
}
function Get-WelaWmiChildNames {