CSEC_PUBLIC/WELA
1
0 Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2026-10-02 20:44:42 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
559a9d1b8234f11642ba0ca4ea4a93b048bbd15f
WELA/scripts
T
History
Shirofune-Security 559a9d1b82 Merge commit '008a8c80b9820318be8d9f833c6adf31c2dbf9a9' into feat/362-scoped-outgoing-ntlm 
# Conflicts:
#	.github/workflows/release.yml
#	CHANGELOG-Japanese.md
#	CHANGELOG.md
#	website/docs/resources/changelog.ja.md
#	website/docs/resources/changelog.md
2026-09-22 11:42:30 +09:00
..
AdcsAuditing.ps1
Guard AD CS audit configuration and collect native request evidence (#421)
2026-09-20 19:34:03 +09:00
AdcsRestartResume.ps1
Resume a reviewed pending AD CS auditing restart (#431)
2026-09-21 09:16:39 +09:00
AdObjectSacl.ps1
Isolate unknown dMSA prerequisites from other AD audit classes
2026-09-19 06:20:41 +09:00
AppLockerProbe.ps1
Validate native AppLocker EXE event generation with an opt-in probe (#423)
2026-09-20 22:46:56 +09:00
AppLockerReadiness.ps1
Validate native AppLocker EXE event generation with an opt-in probe (#423)
2026-09-20 22:46:56 +09:00
AppLockerScriptNative.cs
Add fixed native AppLocker Script probe and disposable evidence matrix
2026-09-21 22:22:21 +09:00
AppLockerScriptProbe.ps1
Refuse stopped service dependencies before AppLocker CIM observation
2026-09-21 22:34:09 +09:00
AppLockerScriptWorker.ps1
Read the owned release pipe with encoding-preamble detection
2026-09-21 22:29:03 +09:00
AuditIntegrity.ps1
Add source-specific Windows audit privilege and integrity controls (#412)
2026-09-20 14:03:18 +09:00
AuditIntegrityNative.cs
Add source-specific Windows audit privilege and integrity controls (#412)
2026-09-20 14:03:18 +09:00
AuditNotifications.ps1
Add OneSettings auditing and Security warning controls (#408)
2026-09-20 13:55:24 +09:00
AuditRecovery.ps1
Restore selected audit changes from reviewed recovery evidence (#419)
2026-09-20 19:30:49 +09:00
AuditScoring.ps1
Add transparent configuration and native rule readiness scores (#417)
2026-09-20 18:15:04 +09:00
Capi2Probe.ps1
Integrate final reviewed development base for CAPI2 probe
2026-09-21 18:21:10 +09:00
Capi2ProbeNative.cs
Create an unnamed CNG key through typed native helper
2026-09-21 17:53:39 +09:00
Capi2ProbeWorker.ps1
Sign public certificate without copying its ephemeral private key
2026-09-21 17:56:04 +09:00
ChannelRead.ps1
Verify actual current-token access to built-in event channels (#432)
2026-09-21 09:18:46 +09:00
ChannelReadNative.cs
Verify actual current-token access to built-in event channels (#432)
2026-09-21 09:18:46 +09:00
ChannelRecovery.ps1
Accept genuine native channel snapshot size and provider representation
2026-09-22 08:02:36 +09:00
Configuration.ps1
Add scoped outgoing NTLM audit configuration with native acceptance
2026-09-22 10:09:37 +09:00
ControlApplicability.ps1
Gate historical controls and require evidence for Windows defaults (#409)
2026-09-20 14:00:10 +09:00
CustomAuditProfiles.ps1
Support validated custom audit profile files through the shared engine (#416)
2026-09-20 18:09:52 +09:00
DnsAnalytical.ps1
Add guarded DNS analytical logging and stopped-trace archives (#425)
2026-09-20 22:49:52 +09:00
DnsAnalyticalArchive.cs
Add guarded DNS analytical logging and stopped-trace archives (#425)
2026-09-20 22:49:52 +09:00
EventLogConfiguration.ps1
Unify event-log size and retention profiles with verified configuration
2026-09-19 02:30:41 +09:00
EventLogRecovery.ps1
Bind the reviewed native host gate and context dependency
2026-09-21 18:17:23 +09:00
EventMeasurement.ps1
Measure bounded native event delivery and verify exact EVTX samples (#430)
2026-09-21 09:14:48 +09:00
EventMeasurementNative.cs
Measure bounded native event delivery and verify exact EVTX samples (#430)
2026-09-21 09:14:48 +09:00
EvtxRecovery.ps1
Export and verify recovery of native probe events from EVTX (#420)
2026-09-20 19:33:20 +09:00
FailedLogonProbe.ps1
Add a native local failed-logon audit probe (#444)
2026-09-21 22:13:20 +09:00
FailedLogonProbeNative.cs
Add a native local failed-logon audit probe (#444)
2026-09-21 22:13:20 +09:00
FailedLogonProbeWorker.ps1
Add a native local failed-logon audit probe (#444)
2026-09-21 22:13:20 +09:00
FileAccessProbe.ps1
Measure held-readback phase and refuse implementation targets before hashing
2026-09-21 22:51:50 +09:00
FileAccessProbeNative.cs
Measure held-readback phase and refuse implementation targets before hashing
2026-09-21 22:51:50 +09:00
FileAccessProbeWorker.ps1
Checkpoint exact native one-byte file access probe
2026-09-21 22:27:26 +09:00
FirewallLogging.ps1
Reject firewall log path drift before configuration
2026-09-19 02:33:53 +09:00
FirewallLoggingRecovery.ps1
Require running firewall providers before recovery observations
2026-09-21 18:15:02 +09:00
GpoAuditPackages.ps1
Add reviewable GPO audit-policy deployment packages (#415)
2026-09-20 18:13:34 +09:00
GpoCreation.ps1
Create new disabled, unlinked GPOs from reviewed native audit backups (#427)
2026-09-20 22:53:00 +09:00
IntuneAuditExport.ps1
Export native audit profiles for reviewed Intune client policies (#414)
2026-09-20 18:10:52 +09:00
IpsecPrerequisites.ps1
Gate conditional IPsec auditing on native prerequisite evidence (#439)
2026-09-21 17:42:53 +09:00
LdapDiagnostics.ps1
Make LDAP 1644 diagnostics explicit and preserve existing DC settings
2026-09-19 07:09:07 +09:00
NativeChannelConfiguration.ps1
Add OneSettings auditing and Security warning controls (#408)
2026-09-20 13:55:24 +09:00
NativeProviderPacks.ps1
Handle native WinRM manifest IDs without Int32 overflow
2026-09-22 10:10:01 +09:00
NativeValidation.ps1
Collect native 4688 validation components with a fixed benign probe (#413)
2026-09-20 18:08:34 +09:00
OutgoingNtlmAudit.ps1
Add scoped outgoing NTLM audit configuration with native acceptance
2026-09-22 10:09:37 +09:00
PowerShellTranscription.ps1
Add opt-in Windows PowerShell transcription for CIS Level 2
2026-09-19 07:09:33 +09:00
RetentionHealth.ps1
Add typed native WEC runtime observations (#424)
2026-09-20 22:48:32 +09:00
Review-AuditCatalog.ps1
Correct legacy token audit GUID and validate catalog mapping uncertainty
2026-09-19 07:01:50 +09:00
SelectedSaclConfiguration.ps1
Verify reviewed descendant SACL propagation and preservation (#429)
2026-09-21 09:12:56 +09:00
SelectedSaclDescendants.ps1
Verify reviewed descendant SACL propagation and preservation (#429)
2026-09-21 09:12:56 +09:00
SelectedSaclNative.cs
Verify reviewed descendant SACL propagation and preservation (#429)
2026-09-21 09:12:56 +09:00
SmbAuditing.ps1
Separate SMB policy verification from runtime activation
2026-09-19 04:39:55 +09:00
SmbRuntimeActivation.ps1
Activate native SMB audit runtime switches explicitly (#441)
2026-09-21 18:09:10 +09:00
TargetedSaclPlanning.ps1
Apply reviewed SACL plans to explicitly selected local targets (#422)
2026-09-20 19:36:05 +09:00
TranscriptionRecovery.ps1
Reject coerced transcription recovery history discriminators
2026-09-21 18:19:57 +09:00
WecAuthorization.ps1
Review and update only source SID authorization on disabled WEC subscriptions
2026-09-22 07:50:50 +09:00
WecAuthorizationNative.cs
Fix WEC variant decoding and native authorization fixture
2026-09-22 08:08:17 +09:00
WecIngress.ps1
Add reviewed scoped collector firewall ingress creation (#442)
2026-09-21 18:19:30 +09:00
WecListener.ps1
Verify effective native worker module path and complete fixture exit status
2026-09-21 23:07:16 +09:00
WecListenerPipeNative.cs
Create one reviewed exact-IP collector listener through a bounded native adapter
2026-09-21 22:58:08 +09:00
WecListenerWorker.ps1
Verify effective native worker module path and complete fixture exit status
2026-09-21 23:07:16 +09:00
WecRuntime.ps1
Add typed native WEC runtime observations (#424)
2026-09-20 22:48:32 +09:00
WecRuntimeNative.cs
Add typed native WEC runtime observations (#424)
2026-09-20 22:48:32 +09:00
WecState.ps1
Review and apply existing WEC subscription enable/disable (#440)
2026-09-21 17:54:55 +09:00
WecStateNative.cs
Review and apply existing WEC subscription enable/disable (#440)
2026-09-21 17:54:55 +09:00
WecUpdate.ps1
Review and apply query updates to existing disabled WEC subscriptions (#426)
2026-09-20 22:51:01 +09:00
WecUpdateNative.cs
Review and apply query updates to existing disabled WEC subscriptions (#426)
2026-09-20 22:51:01 +09:00
WefArrival.ps1
Verify native probe arrival in the local WEF collector (#418)
2026-09-20 19:26:57 +09:00
WefDeployment.ps1
Fix native collector subscription inventory and Unicode readback
2026-09-22 09:46:28 +09:00
WmiNamespaceAuditing.ps1
Collect local WMI namespace audit evidence with a fixed read probe (#428)
2026-09-21 09:08:20 +09:00
WmiProbe.ps1
Use precise native UTC for WMI probe event intervals (#438)
2026-09-21 17:30:16 +09:00
WmiProbeNative.cs
Use precise native UTC for WMI probe event intervals (#438)
2026-09-21 17:30:16 +09:00
WmiProbeWorker.ps1
Use precise native UTC for WMI probe event intervals (#438)
2026-09-21 17:30:16 +09:00