Shirofune-Security 0ff81052e6 Merge commit '39e8ce1' into feat/367-reviewed-channel-recovery ...

# Conflicts:
#	.gitattributes
#	.github/workflows/release.yml
#	CHANGELOG-Japanese.md
#	CHANGELOG.md
#	website/docs/resources/changelog.ja.md
#	website/docs/resources/changelog.md

2026-09-22 07:53:01 +09:00

..

AdcsAuditing.ps1

Guard AD CS audit configuration and collect native request evidence (#421)

2026-09-20 19:34:03 +09:00

AdcsRestartResume.ps1

Resume a reviewed pending AD CS auditing restart (#431)

2026-09-21 09:16:39 +09:00

AdObjectSacl.ps1

Isolate unknown dMSA prerequisites from other AD audit classes

2026-09-19 06:20:41 +09:00

AppLockerProbe.ps1

Validate native AppLocker EXE event generation with an opt-in probe (#423)

2026-09-20 22:46:56 +09:00

AppLockerReadiness.ps1

Validate native AppLocker EXE event generation with an opt-in probe (#423)

2026-09-20 22:46:56 +09:00

AppLockerScriptNative.cs

Add fixed native AppLocker Script probe and disposable evidence matrix

2026-09-21 22:22:21 +09:00

AppLockerScriptProbe.ps1

Refuse stopped service dependencies before AppLocker CIM observation

2026-09-21 22:34:09 +09:00

AppLockerScriptWorker.ps1

Read the owned release pipe with encoding-preamble detection

2026-09-21 22:29:03 +09:00

AuditIntegrity.ps1

Add source-specific Windows audit privilege and integrity controls (#412)

2026-09-20 14:03:18 +09:00

AuditIntegrityNative.cs

Add source-specific Windows audit privilege and integrity controls (#412)

2026-09-20 14:03:18 +09:00

AuditNotifications.ps1

Add OneSettings auditing and Security warning controls (#408)

2026-09-20 13:55:24 +09:00

AuditRecovery.ps1

Restore selected audit changes from reviewed recovery evidence (#419)

2026-09-20 19:30:49 +09:00

AuditScoring.ps1

Add transparent configuration and native rule readiness scores (#417)

2026-09-20 18:15:04 +09:00

Capi2Probe.ps1

Integrate final reviewed development base for CAPI2 probe

2026-09-21 18:21:10 +09:00

Capi2ProbeNative.cs

Create an unnamed CNG key through typed native helper

2026-09-21 17:53:39 +09:00

Capi2ProbeWorker.ps1

Sign public certificate without copying its ephemeral private key

2026-09-21 17:56:04 +09:00

ChannelRead.ps1

Verify actual current-token access to built-in event channels (#432)

2026-09-21 09:18:46 +09:00

ChannelReadNative.cs

Verify actual current-token access to built-in event channels (#432)

2026-09-21 09:18:46 +09:00

ChannelRecovery.ps1

Add reviewed recovery of one completed native channel operation

2026-09-22 07:52:16 +09:00

Configuration.ps1

Gate conditional IPsec auditing on native prerequisite evidence (#439)

2026-09-21 17:42:53 +09:00

ControlApplicability.ps1

Gate historical controls and require evidence for Windows defaults (#409)

2026-09-20 14:00:10 +09:00

CustomAuditProfiles.ps1

Support validated custom audit profile files through the shared engine (#416)

2026-09-20 18:09:52 +09:00

DnsAnalytical.ps1

Add guarded DNS analytical logging and stopped-trace archives (#425)

2026-09-20 22:49:52 +09:00

DnsAnalyticalArchive.cs

Add guarded DNS analytical logging and stopped-trace archives (#425)

2026-09-20 22:49:52 +09:00

EventLogConfiguration.ps1

Unify event-log size and retention profiles with verified configuration

2026-09-19 02:30:41 +09:00

EventLogRecovery.ps1

Bind the reviewed native host gate and context dependency

2026-09-21 18:17:23 +09:00

EventMeasurement.ps1

Measure bounded native event delivery and verify exact EVTX samples (#430)

2026-09-21 09:14:48 +09:00

EventMeasurementNative.cs

Measure bounded native event delivery and verify exact EVTX samples (#430)

2026-09-21 09:14:48 +09:00

EvtxRecovery.ps1

Export and verify recovery of native probe events from EVTX (#420)

2026-09-20 19:33:20 +09:00

FailedLogonProbe.ps1

Add a native local failed-logon audit probe (#444)

2026-09-21 22:13:20 +09:00

FailedLogonProbeNative.cs

Add a native local failed-logon audit probe (#444)

2026-09-21 22:13:20 +09:00

FailedLogonProbeWorker.ps1

Add a native local failed-logon audit probe (#444)

2026-09-21 22:13:20 +09:00

FileAccessProbe.ps1

Measure held-readback phase and refuse implementation targets before hashing

2026-09-21 22:51:50 +09:00

FileAccessProbeNative.cs

Measure held-readback phase and refuse implementation targets before hashing

2026-09-21 22:51:50 +09:00

FileAccessProbeWorker.ps1

Checkpoint exact native one-byte file access probe

2026-09-21 22:27:26 +09:00

FirewallLogging.ps1

Reject firewall log path drift before configuration

2026-09-19 02:33:53 +09:00

FirewallLoggingRecovery.ps1

Require running firewall providers before recovery observations

2026-09-21 18:15:02 +09:00

GpoAuditPackages.ps1

Add reviewable GPO audit-policy deployment packages (#415)

2026-09-20 18:13:34 +09:00

GpoCreation.ps1

Create new disabled, unlinked GPOs from reviewed native audit backups (#427)

2026-09-20 22:53:00 +09:00

IntuneAuditExport.ps1

Export native audit profiles for reviewed Intune client policies (#414)

2026-09-20 18:10:52 +09:00

IpsecPrerequisites.ps1

Gate conditional IPsec auditing on native prerequisite evidence (#439)

2026-09-21 17:42:53 +09:00

LdapDiagnostics.ps1

Make LDAP 1644 diagnostics explicit and preserve existing DC settings

2026-09-19 07:09:07 +09:00

NativeChannelConfiguration.ps1

Add OneSettings auditing and Security warning controls (#408)

2026-09-20 13:55:24 +09:00

NativeProviderPacks.ps1

Add opt-in native DNS and provider audit packs (#411)

2026-09-20 13:58:49 +09:00

NativeValidation.ps1

Collect native 4688 validation components with a fixed benign probe (#413)

2026-09-20 18:08:34 +09:00

PowerShellTranscription.ps1

Add opt-in Windows PowerShell transcription for CIS Level 2

2026-09-19 07:09:33 +09:00

RetentionHealth.ps1

Add typed native WEC runtime observations (#424)

2026-09-20 22:48:32 +09:00

Review-AuditCatalog.ps1

Correct legacy token audit GUID and validate catalog mapping uncertainty

2026-09-19 07:01:50 +09:00

SelectedSaclConfiguration.ps1

Verify reviewed descendant SACL propagation and preservation (#429)

2026-09-21 09:12:56 +09:00

SelectedSaclDescendants.ps1

Verify reviewed descendant SACL propagation and preservation (#429)

2026-09-21 09:12:56 +09:00

SelectedSaclNative.cs

Verify reviewed descendant SACL propagation and preservation (#429)

2026-09-21 09:12:56 +09:00

SmbAuditing.ps1

Separate SMB policy verification from runtime activation

2026-09-19 04:39:55 +09:00

SmbRuntimeActivation.ps1

Activate native SMB audit runtime switches explicitly (#441)

2026-09-21 18:09:10 +09:00

TargetedSaclPlanning.ps1

Apply reviewed SACL plans to explicitly selected local targets (#422)

2026-09-20 19:36:05 +09:00

TranscriptionRecovery.ps1

Reject coerced transcription recovery history discriminators

2026-09-21 18:19:57 +09:00

WecIngress.ps1

Add reviewed scoped collector firewall ingress creation (#442)

2026-09-21 18:19:30 +09:00

WecListener.ps1

Verify effective native worker module path and complete fixture exit status

2026-09-21 23:07:16 +09:00

WecListenerPipeNative.cs

Create one reviewed exact-IP collector listener through a bounded native adapter

2026-09-21 22:58:08 +09:00

WecListenerWorker.ps1

Verify effective native worker module path and complete fixture exit status

2026-09-21 23:07:16 +09:00

WecRuntime.ps1

Add typed native WEC runtime observations (#424)

2026-09-20 22:48:32 +09:00

WecRuntimeNative.cs

Add typed native WEC runtime observations (#424)

2026-09-20 22:48:32 +09:00

WecState.ps1

Review and apply existing WEC subscription enable/disable (#440)

2026-09-21 17:54:55 +09:00

WecStateNative.cs

Review and apply existing WEC subscription enable/disable (#440)

2026-09-21 17:54:55 +09:00

WecUpdate.ps1

Review and apply query updates to existing disabled WEC subscriptions (#426)

2026-09-20 22:51:01 +09:00

WecUpdateNative.cs

Review and apply query updates to existing disabled WEC subscriptions (#426)

2026-09-20 22:51:01 +09:00

WefArrival.ps1

Verify native probe arrival in the local WEF collector (#418)

2026-09-20 19:26:57 +09:00

WefDeployment.ps1

Add reviewed scoped collector firewall ingress creation (#442)

2026-09-21 18:19:30 +09:00

WmiNamespaceAuditing.ps1

Collect local WMI namespace audit evidence with a fixed read probe (#428)

2026-09-21 09:08:20 +09:00

WmiProbe.ps1

Use precise native UTC for WMI probe event intervals (#438)

2026-09-21 17:30:16 +09:00

WmiProbeNative.cs

Use precise native UTC for WMI probe event intervals (#438)

2026-09-21 17:30:16 +09:00

WmiProbeWorker.ps1

Use precise native UTC for WMI probe event intervals (#438)

2026-09-21 17:30:16 +09:00