mirror of
https://github.com/Yamato-Security/WELA.git
synced 2026-10-03 04:54:42 +02:00
63 lines
4.8 KiB
PowerShell
63 lines
4.8 KiB
PowerShell
$ErrorActionPreference = 'Stop'
|
|
Import-Module (Join-Path $PSScriptRoot '../modules/AuditProfiles.psm1') -Force
|
|
Import-Module (Join-Path $PSScriptRoot '../modules/AuditCatalog.psm1') -Force
|
|
$script:count = 0
|
|
function Assert($Condition, $Message) { if (-not $Condition) { throw $Message }; $script:count++ }
|
|
function Reject([scriptblock]$Action) {
|
|
try { & $Action; throw 'Expected rejection did not occur.' }
|
|
catch { Assert ($_.Exception.Message -match 'mismatch|Duplicate|duplicate') "Unexpected failure: $_" }
|
|
}
|
|
$root = Split-Path $PSScriptRoot -Parent
|
|
$canonical = (Import-WelaAuditProfiles).catalog
|
|
$legacyPath = Join-Path $root 'config/baselines.json'
|
|
$legacy = Get-Content $legacyPath -Raw | ConvertFrom-Json
|
|
Assert-WelaAuditCatalog $legacy.catalog $canonical
|
|
foreach ($case in @('wrong-guid','duplicate-guid','unknown-name','duplicate-id')) {
|
|
$copy = Get-Content $legacyPath -Raw | ConvertFrom-Json
|
|
$row = $copy.catalog | Where-Object subCategory -eq 'Token Right Adjusted Events'
|
|
switch ($case) {
|
|
'wrong-guid' { $row.select.guid='0CCE922E-69AE-11D9-BED3-505054503030' }
|
|
'duplicate-guid' { $copy.catalog += $row }
|
|
'unknown-name' { $row.subCategory='Token Right Adjusted Typo' }
|
|
'duplicate-id' { ($copy.catalog | Where-Object subCategory -eq 'RPC Events').id=$row.id }
|
|
}
|
|
Reject { Assert-WelaAuditCatalog $copy.catalog $canonical }
|
|
}
|
|
$mappings = @(Import-Csv (Join-Path $root 'config/eid_subcategory_mapping.csv'))
|
|
$ambiguous = Get-WelaEventMappingReview $mappings $canonical 4703
|
|
Assert ($ambiguous.State -eq 'Conditional' -and $ambiguous.Candidates.Count -eq 2 -and $ambiguous.Reasons -contains 'MultipleSubcategories' -and -not $ambiguous.DetectionReady) '4703 conflicting source mappings must remain conditional.'
|
|
$object = Get-WelaEventMappingReview $mappings $canonical 4663
|
|
Assert ($object.State -eq 'Conditional' -and -not $object.DetectionReady) 'Object EventID alone never establishes matching object/SACL/outcome.'
|
|
$unknown = Get-WelaEventMappingReview $mappings $canonical 65535
|
|
Assert ($unknown.State -eq 'Unknown' -and $unknown.Candidates.Count -eq 0) 'Unknown events cannot acquire a policy or readiness.'
|
|
$zero = Get-WelaEventMappingReview $mappings $canonical 0
|
|
Assert ($zero.MappingCount -eq 0 -and $zero.State -eq 'Unknown') 'Blank category rows must not turn into EventID zero.'
|
|
$category = Get-WelaEventMappingReview $mappings $canonical 4608
|
|
Assert ($category.Reasons -contains 'CategoryOnlyOrUnknownGuid' -and -not $category.DetectionReady) 'Category GUIDs cannot establish advanced subcategory readiness.'
|
|
$rpc = Get-WelaEventMappingReview $mappings $canonical 5712
|
|
Assert ($rpc.Candidates.Count -eq 1 -and $rpc.Candidates[0].Name -eq 'RPC Events' -and $rpc.State -eq 'Conditional') 'A unique mapping still retains outcome/context uncertainty.'
|
|
$bad = [pscustomobject]@{'Event ID'='5712';Subcategory='Token Right Adjusted Events';GUID='0CCE922E-69AE-11D9-BED3-505054503030'}
|
|
$mismatch = Get-WelaEventMappingReview @($bad) $canonical 5712
|
|
Assert ($mismatch.State -eq 'Unknown' -and $mismatch.Reasons -contains 'NameGuidMismatch') 'Mismatched candidate metadata must not be accepted.'
|
|
|
|
# Exercise the actual legacy renderer for every named baseline with distinct RPC/token state.
|
|
. (Join-Path $root 'WELA.ps1') help -Role Client -Build 26100 6>$null | Out-Null
|
|
function GetAuditpol { @{ '0CCE922E-69AE-11D9-BED3-505054503030'='Failure'; '0CCE924A-69AE-11D9-BED3-505054503030'='Success' } }
|
|
function CheckRegistryValue { $false }
|
|
function Get-WelaNativeSources { @() }
|
|
function Get-WelaNativeSourceState { 'Unknown' }
|
|
function Get-WelaOutgoingNtlmState { [pscustomobject]@{Description='Unknown';PolicySource='Unknown'} }
|
|
function Get-WelaDomainNtlmState { [pscustomobject]@{Description='Unknown'} }
|
|
foreach ($baselineName in $legacy.baselines.PSObject.Properties.Name) {
|
|
$rows = BuildAuditResult -all_rules @() -Baseline $baselineName -enabledguid @('0CCE924A-69AE-11D9-BED3-505054503030')
|
|
Assert (($rows | Where-Object SubCategory -eq 'RPC Events').CurrentSetting -eq 'Failure') "$baselineName must read RPC independently."
|
|
Assert (($rows | Where-Object SubCategory -eq 'Token Right Adjusted Events').CurrentSetting -eq 'Success') "$baselineName must read Token independently."
|
|
}
|
|
$tmp = Join-Path ([IO.Path]::GetTempPath()) ('wela-mapping-review-'+[guid]::NewGuid().ToString('N')+'.json')
|
|
try {
|
|
& (Join-Path $root 'scripts/Review-AuditCatalog.ps1') -ResultsPath $tmp | Out-Null
|
|
$export = Get-Content $tmp -Raw | ConvertFrom-Json
|
|
Assert ($export.DetectionReadyCount -eq 0 -and $export.MappingSha256.Length -eq 64 -and $export.Events.Count -gt 100) 'Review export retains corpus fingerprint and explicit no-readiness semantics.'
|
|
} finally { Remove-Item $tmp -ErrorAction SilentlyContinue }
|
|
Write-Host "PASS: $script:count catalog/mapping assertions; all legacy baselines preserve distinct RPC/token state."
|