mirror of
https://github.com/Yamato-Security/WELA.git
synced 2026-10-08 15:25:24 +02:00
田中ザック Isaac Mathis
f1c1f74166
* Add guarded native CA auditing and disposable request evidence * Link AD CS changelog to PR 421 * Retain primary native CA failure before cleanup diagnostics * Normalize native CA certificate hashes and record pending feature removal * Emit bounded disposable CA request matching diagnostics * Match observed version 1 CA request events with exact pending disposition
4 lines
1.1 KiB
XML
4 lines
1.1 KiB
XML
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4889</EventID><Version>1</Version><Level>0</Level><Task>12805</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2026-09-20T09:51:08.1809035Z'/><EventRecordID>1513129</EventRecordID><Correlation ActivityID='{b6803072-f122-0002-facf-2deee448dd01}'/><Execution ProcessID='868' ThreadID='980'/><Channel>Security</Channel><Computer>runnervmibwwn</Computer><Security/></System><EventData><Data Name='RequestId'>2</Data><Data Name='Requester'>runnervmibwwn\runneradmin</Data><Data Name='Attributes'>
|
|
WELAProbe:e5d9f00053f64487bc4890e16c043ae0
|
|
ccm:runnervmibwwn</Data><Data Name='Disposition'>5</Data><Data Name='SubjectKeyIdentifier'>3c 20 68 7b b1 01 c5 00 4a a7 bf 4d fe e6 82 f4 76 8c 45 9c</Data><Data Name='Subject'></Data><Data Name='AuthenticationService'>NTLM</Data><Data Name='AuthenticationLevel'>Privacy</Data><Data Name='DCOMorRPC'>DCOM</Data></EventData></Event>
|