mirror of
https://github.com/Yamato-Security/WELA.git
synced 2026-10-08 07:15:25 +02:00
田中ザック Isaac Mathis
f1c1f74166
* Add guarded native CA auditing and disposable request evidence * Link AD CS changelog to PR 421 * Retain primary native CA failure before cleanup diagnostics * Normalize native CA certificate hashes and record pending feature removal * Emit bounded disposable CA request matching diagnostics * Match observed version 1 CA request events with exact pending disposition
4 lines
1.2 KiB
XML
4 lines
1.2 KiB
XML
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4886</EventID><Version>1</Version><Level>0</Level><Task>12805</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2026-09-20T09:51:08.1689573Z'/><EventRecordID>1513128</EventRecordID><Correlation ActivityID='{b6803072-f122-0002-facf-2deee448dd01}'/><Execution ProcessID='868' ThreadID='980'/><Channel>Security</Channel><Computer>runnervmibwwn</Computer><Security/></System><EventData><Data Name='RequestId'>2</Data><Data Name='Requester'>runnervmibwwn\runneradmin</Data><Data Name='Attributes'>
|
|
WELAProbe:e5d9f00053f64487bc4890e16c043ae0
|
|
ccm:runnervmibwwn</Data><Data Name='Subject'>CN=WELA native pending audit probe</Data><Data Name='SubjectAlternativeName'></Data><Data Name='CertificateTemplate'></Data><Data Name='RequestOSVersion'></Data><Data Name='RequestCSPProvider'></Data><Data Name='RequestClientInfo'></Data><Data Name='AuthenticationService'>NTLM</Data><Data Name='AuthenticationLevel'>Privacy</Data><Data Name='DCOMorRPC'>DCOM</Data></EventData></Event>
|