CSEC_PUBLIC/WELA
1
0 Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2026-10-24 23:18:11 +02:00
Code Issues Packages Projects Releases Wiki Activity
852 Commits 12 Branches 3 Tags
31aeeda768b76c12263b2e0df251af9167f144de
Commit Graph
413 Commits
Author SHA1 Message Date
Shirofune-SecurityandClaude Opus 4.8 31aeeda768 configure-sacl: cover per-user objects across all profiles + Default 
Enumerate every user profile from ProfileList (plus C:\Users\Default so future
users inherit the SACL) and apply per-user SACLs:
- user_files: file SACL under each profile dir (Startup folder, Signal AppData).
- user_registry: registry SACL on each user hive - loaded hives via
  HKEY_USERS\<SID> directly, offline/Default hives by reg-load/unload of
  NTUSER.DAT (HKCU Run/RunOnce, User Shell Folders, StartupApproved, Load/Run,
  Command Processor AutoRun, Control Panel\Desktop screensaver, Environment
  logon script, LangBarAddin, Outlook Addins).
Handles are released ([gc]) before reg unload; objects/hives absent on the host
are skipped. Not covered: folder-redirected AppData on network shares, mandatory
profiles.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MVUmXZBkr5FnZ2hwFkDhx7
 2026-09-17 22:03:24 +09:00
Shirofune-SecurityandClaude Opus 4.8 db9a966a8b Add 'configure-sacl': targeted File System/Registry audit SACLs for detection 
'configure' already enables Object Access subcategories such as File Share, SAM
and Certification Services, but File System (4663), Registry (4657) and Handle
Manipulation (4656) auditing produce no events without SACLs on the audited
objects - and enabling them globally floods the log. This adds targeted SACLs on
only the autostart/persistence registry keys (ASEPs) and sensitive files that the
Hayabusa/Sigma Security-channel rules actually watch, so those rules can fire
without global object auditing.

- config/audit_sacl_targets.json: curated, commented list of 30 registry keys
  (Run/RunOnce, Winlogon, IFEO, AppInit, Explorer shell extensions, Active Setup,
  Command Processor AutoRun, Session Manager, LSA packages, Winsock LSP, protocol
  handlers, logon scripts, Defender exclusions, service create/delete, ...) and 7
  files (NTDS dir, SAM/SECURITY/SYSTEM hives, lsass.exe, ntdsutil, vssadmin),
  each tagged with the ATT&CK technique / rule class it serves.
- WELA.ps1: new 'configure-sacl' command. Enables the File System / Registry /
  Handle Manipulation subcategories (by GUID) and applies the SACLs from the
  config (principal Everyone, Success+Failure, ContainerInherit on registry keys),
  idempotently, honoring -Auto / -WhatIf / -Confirm. Enables SeSecurityPrivilege
  first; skips objects absent on the host.

Per-user objects (HKCU / profile AppData) and live LSASS memory/handle access are
intentionally out of scope (need a per-user mechanism / Sysmon EID 10) and are
documented as such.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MVUmXZBkr5FnZ2hwFkDhx7
 2026-09-17 21:50:25 +09:00
github-actions[bot]andYamatoSecurity faa7988b87 Sigma Rule Update (2026-09-01 22:29:49) (#359) 
Co-authored-by: YamatoSecurity <71482215+YamatoSecurity@users.noreply.github.com>
 2026-09-01 22:29:56 +00:00
fukusuket eee2c58f5a feat: update baselines.json to change currentSetting type to channel and specify DFSN-Server Admin 2026-09-01 23:39:47 +09:00
fukusuket a9ceec469a feat: add DFSN-Server Admin channel to baselines and update changelog 2026-09-01 23:32:53 +09:00
fukusuket dcb183871d fix: remove extraneous closing parenthesis in baselines.json note 2026-08-30 21:20:23 +09:00
fukusuket 8d8e401fdb fix: correct spelling errors in baselines.json settings 2026-08-30 21:19:11 +09:00
fukusuket dcf29e4a59 fix: update .gitignore and release workflows for new output files and README changes 2026-08-30 21:08:16 +09:00
github-actions[bot]andYamatoSecurity ff2664b419 Sigma Rule Update (2026-08-01 20:59:49) (#357) 
Co-authored-by: YamatoSecurity <71482215+YamatoSecurity@users.noreply.github.com>
 2026-08-01 20:59:57 +00:00
github-actions[bot]andYamatoSecurity f312fc5fc9 Sigma Rule Update (2026-07-01 21:40:59) (#356) 
Co-authored-by: YamatoSecurity <71482215+YamatoSecurity@users.noreply.github.com>
 2026-07-01 21:41:06 +00:00
github-actions[bot]andYamatoSecurity afe91eea3b Sigma Rule Update (2026-06-01 22:34:27) (#353) 
Co-authored-by: YamatoSecurity <71482215+YamatoSecurity@users.noreply.github.com>
 2026-06-01 22:34:35 +00:00
github-actions[bot]andYamatoSecurity 5566538242 Sigma Rule Update (2026-05-22 21:04:11) (#351) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-05-22 21:04:19 +00:00
github-actions[bot]andYamatoSecurity 820d0c1283 Sigma Rule Update (2026-05-21 21:22:31) (#350) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-05-21 21:22:40 +00:00
github-actions[bot]andYamatoSecurity 499255fe32 Sigma Rule Update (2026-05-20 21:46:10) (#349) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-05-20 21:46:17 +00:00
github-actions[bot]andYamatoSecurity f7333c5358 Sigma Rule Update (2026-05-19 21:13:17) (#348) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-05-19 21:13:26 +00:00
github-actions[bot]andYamatoSecurity 887de1d5c9 Sigma Rule Update (2026-05-18 21:04:23) (#347) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-05-18 21:04:31 +00:00
github-actions[bot]andYamatoSecurity 404d781e88 Sigma Rule Update (2026-05-17 20:41:12) (#346) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-05-17 20:41:20 +00:00
github-actions[bot]andYamatoSecurity f75a0ebc00 Sigma Rule Update (2026-05-16 20:39:47) (#345) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-05-16 20:39:55 +00:00
github-actions[bot]andYamatoSecurity c1fa19a5f0 Sigma Rule Update (2026-05-15 20:54:25) (#344) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-05-15 20:54:32 +00:00
github-actions[bot]andYamatoSecurity 028b7f9ab6 Sigma Rule Update (2026-05-14 21:04:35) (#343) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-05-14 21:04:44 +00:00
github-actions[bot]andYamatoSecurity 1a13a15b44 Sigma Rule Update (2026-05-13 21:20:14) (#342) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-05-13 21:20:23 +00:00
github-actions[bot]andYamatoSecurity 77194e48f0 Sigma Rule Update (2026-05-12 21:12:57) (#341) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-05-12 21:13:05 +00:00
github-actions[bot]andYamatoSecurity d2c31c1d22 Sigma Rule Update (2026-05-11 21:12:00) (#340) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-05-11 21:12:08 +00:00
github-actions[bot]andYamatoSecurity 08e6fddb82 Sigma Rule Update (2026-05-10 20:40:41) (#339) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-05-10 20:40:48 +00:00
github-actions[bot]andYamatoSecurity f0bdac1f79 Sigma Rule Update (2026-05-09 20:37:40) (#338) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-05-09 20:37:48 +00:00
github-actions[bot]andYamatoSecurity 50d1217ca9 Sigma Rule Update (2026-05-08 20:52:30) (#337) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-05-08 20:52:37 +00:00
github-actions[bot]andYamatoSecurity e52bfe34ff Sigma Rule Update (2026-05-07 20:59:31) (#336) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-05-07 20:59:39 +00:00
github-actions[bot]andYamatoSecurity cc10302d3d Sigma Rule Update (2026-05-06 21:05:07) (#335) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-05-06 21:05:14 +00:00
github-actions[bot]andYamatoSecurity 91925c627a Sigma Rule Update (2026-05-05 20:56:08) (#334) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-05-05 20:56:16 +00:00
github-actions[bot]andYamatoSecurity 5f8e227593 Sigma Rule Update (2026-05-04 21:01:37) (#333) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-05-04 21:01:45 +00:00
github-actions[bot]andYamatoSecurity 12eca2bfd5 Sigma Rule Update (2026-05-03 20:35:33) (#332) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-05-03 20:35:40 +00:00
github-actions[bot]andYamatoSecurity 6286de49cc Sigma Rule Update (2026-05-02 20:34:41) (#330) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-05-02 20:34:48 +00:00
github-actions[bot]andYamatoSecurity 520a9a175d Sigma Rule Update (2026-05-01 20:43:09) (#329) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-05-01 20:43:16 +00:00
github-actions[bot]andYamatoSecurity 9e732779dd Sigma Rule Update (2026-04-30 20:53:14) (#328) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-04-30 20:53:21 +00:00
github-actions[bot]andYamatoSecurity f6eaa21408 Sigma Rule Update (2026-04-29 20:56:29) (#327) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-04-29 20:56:37 +00:00
github-actions[bot]andYamatoSecurity d2d85d7d81 Sigma Rule Update (2026-04-28 21:01:56) (#326) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-04-28 21:02:08 +00:00
github-actions[bot]andYamatoSecurity 0028fce0a9 Sigma Rule Update (2026-04-27 20:55:14) (#325) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-04-27 20:55:22 +00:00
github-actions[bot]andYamatoSecurity 4d5fc13a21 Sigma Rule Update (2026-04-26 20:32:06) (#324) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-04-26 20:32:14 +00:00
github-actions[bot]andYamatoSecurity e81097b8fe Sigma Rule Update (2026-04-25 20:31:47) (#323) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-04-25 20:31:54 +00:00
github-actions[bot]andYamatoSecurity 59feb924cf Sigma Rule Update (2026-04-24 20:39:19) (#322) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-04-24 20:39:26 +00:00
github-actions[bot]andYamatoSecurity e28644c57b Sigma Rule Update (2026-04-23 20:44:21) (#321) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-04-23 20:44:29 +00:00
github-actions[bot]andYamatoSecurity 9b95781c35 Sigma Rule Update (2026-04-22 20:45:55) (#320) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-04-22 20:46:04 +00:00
github-actions[bot]andYamatoSecurity f62e55fce0 Sigma Rule Update (2026-04-21 20:42:41) (#319) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-04-21 20:42:49 +00:00
github-actions[bot]andYamatoSecurity 7f63a22511 Sigma Rule Update (2026-04-20 20:38:53) (#318) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-04-20 20:39:00 +00:00
github-actions[bot]andYamatoSecurity 1df62e50b7 Sigma Rule Update (2026-04-19 20:29:56) (#317) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-04-19 20:30:02 +00:00
github-actions[bot]andYamatoSecurity f067e603c9 Sigma Rule Update (2026-04-18 20:29:03) (#316) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-04-18 20:29:10 +00:00
github-actions[bot]andYamatoSecurity 042d9ed451 Sigma Rule Update (2026-04-17 20:38:10) (#315) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-04-17 20:38:17 +00:00
github-actions[bot]andYamatoSecurity 077c5ede4d Sigma Rule Update (2026-04-16 20:41:36) (#314) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-04-16 20:41:45 +00:00
github-actions[bot]andYamatoSecurity 14eef9f3b2 Sigma Rule Update (2026-04-15 20:41:01) (#313) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-04-15 20:41:09 +00:00
github-actions[bot]andYamatoSecurity 332703d392 Sigma Rule Update (2026-04-14 20:45:03) (#312) 
Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>
 2026-04-14 20:45:11 +00:00