CSEC_PUBLIC/WELA
1
0
Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2025-12-06 09:12:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

feat: add currentsetting

Browse Source
This commit is contained in:
fukusuket
2025-05-16 18:18:56 +09:00
parent b4b18408f9
commit f76fe351c4
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
WELA.ps1
View File

@@ -391,7 +391,7 @@ function GuideYamatoSecurity
$enabled = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell\ModuleLogging" -valueName "EnableModuleLogging" -expectedValue 1 $enabled = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell\ModuleLogging" -valueName "EnableModuleLogging" -expectedValue 1
$rules = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid } $rules = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid }
$rules | ForEach-Object { $_.applicable = $enabled } $rules | ForEach-Object { $_.applicable = $enabled }
$current = if ($enabled) { "Enabled" } else { "Disabled"} $current = if ($enabled) { "Enabled" } else { "Disabled" }
$auditResult += [WELA]::New( $auditResult += [WELA]::New(
"PowerShell", "PowerShell",
"Module", "Module",
@@ -410,7 +410,7 @@ function GuideYamatoSecurity
$enabled = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -valueName "EnableScriptBlockLogging" -expectedValue 1 $enabled = CheckRegistryValue -registryPath "HKLM:\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -valueName "EnableScriptBlockLogging" -expectedValue 1
$rules = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid } $rules = $all_rules | Where-Object { RuleFilter $_ $eids $channels $guid }
$rules | ForEach-Object { $_.applicable = $enabled } $rules | ForEach-Object { $_.applicable = $enabled }
$current = if ($enabled) { "Enabled" } else { "Disabled"} $current = if ($enabled) { "Enabled" } else { "Disabled" }
$auditResult += [WELA]::New( $auditResult += [WELA]::New(
"PowerShell", "PowerShell",
"ScriptBlock", "ScriptBlock",
@@ -5082,7 +5082,7 @@ function AuditLogSetting {
if ($enabledCount + $disabledCount -ne 0) { if ($enabledCount + $disabledCount -ne 0) {
$enabledPercentage = "({0:N2}%)" -f (($enabledCount / ($enabledCount + $disabledCount)) * 100) $enabledPercentage = "({0:N2}%)" -f (($enabledCount / ($enabledCount + $disabledCount)) * 100)
} }
if ($_.Name -notmatch "Powershell" -and $_.Name -notmatch "Security Advanced " -and $_.Name -notcontains "PrintService") { if ($_.Name -notmatch "Powershell" -and $_.Name -notcontains "Security Advanced" -and $_.Name -notcontains "PrintService") {
$enabledPercentage = "" $enabledPercentage = ""
} }
Write-Host "$( $_.Name ): $out$($enabledPercentage)" -ForegroundColor $color Write-Host "$( $_.Name ): $out$($enabledPercentage)" -ForegroundColor $color