Shirofune-Security
a08f3d52f5
Fit disposable account description within Windows limit
2026-09-21 09:33:49 +09:00
Shirofune-Security
2631331406
Verify native EVTX recovery under the actual primary reader token
2026-09-21 09:30:59 +09:00
田中ザック Isaac Mathis
5ba53fbcfb
Validate native AppLocker EXE event generation with an opt-in probe ( #423 )
...
* Add native AppLocker EXE event validation probe
* Reference PR 423 in changelogs
* Isolate AppLocker native fixture and preserve prerequisite diagnostics
* Report an integer zero for an empty AppLocker policy
* Prepare disposable AppLocker probe policy without bypassing production importer guards
* Retain bounded native AppLocker channel diagnostics on probe failure
* Require native policy application before the disposable AppLocker probe
* Preserve exact timestamp strings in native evidence fixtures
* Record actual runner session and AppLocker publication diagnostics
* Activate and restore the native policy converter on disposable AppLocker hosts
* Compare native task freshness without guessing its timestamp timezone
* Verify effective policy and borrowed converter inactivity during fixture cleanup
* Track the actual native policy-converter task instance instead of cached timestamps
2026-09-20 22:46:56 +09:00
田中ザック Isaac Mathis
f1c1f74166
Guard AD CS audit configuration and collect native request evidence ( #421 )
...
* Add guarded native CA auditing and disposable request evidence
* Link AD CS changelog to PR 421
* Retain primary native CA failure before cleanup diagnostics
* Normalize native CA certificate hashes and record pending feature removal
* Emit bounded disposable CA request matching diagnostics
* Match observed version 1 CA request events with exact pending disposition
2026-09-20 19:34:03 +09:00
田中ザック Isaac Mathis
38a392f3d6
Export and verify recovery of native probe events from EVTX ( #420 )
...
* Export and recover exact native probe events from EVTX
* Link changelog to PR 420
* Make EVTX duplicate JSON fixture portable to PowerShell 5.1
2026-09-20 19:33:20 +09:00
田中ザック Isaac Mathis
e5557df038
Verify native probe arrival in the local WEF collector ( #418 )
...
* Verify native probe presence in the local WEF collector
* Link WEF arrival changelog to PR 418
* Make duplicate JSON fixture independent of PowerShell formatting
2026-09-20 19:26:57 +09:00
田中ザック Isaac Mathis
ec6a6df68a
Export native audit profiles for reviewed Intune client policies ( #414 )
...
* Add offline Intune Audit CSP exports from shared client profiles
* Link Intune audit export changelog to PR 414
2026-09-20 18:10:52 +09:00
Shirofune-Security
80db17891d
Add opt-in WMI namespace audit SACL workflow
2026-09-19 05:30:12 +09:00
Shirofune-Security