mirror of
https://github.com/Yamato-Security/WELA.git
synced 2026-10-08 15:25:24 +02:00
Shirofune-SecurityandClaude Opus 4.8
db9a966a8b
'configure' already enables Object Access subcategories such as File Share, SAM and Certification Services, but File System (4663), Registry (4657) and Handle Manipulation (4656) auditing produce no events without SACLs on the audited objects - and enabling them globally floods the log. This adds targeted SACLs on only the autostart/persistence registry keys (ASEPs) and sensitive files that the Hayabusa/Sigma Security-channel rules actually watch, so those rules can fire without global object auditing. - config/audit_sacl_targets.json: curated, commented list of 30 registry keys (Run/RunOnce, Winlogon, IFEO, AppInit, Explorer shell extensions, Active Setup, Command Processor AutoRun, Session Manager, LSA packages, Winsock LSP, protocol handlers, logon scripts, Defender exclusions, service create/delete, ...) and 7 files (NTDS dir, SAM/SECURITY/SYSTEM hives, lsass.exe, ntdsutil, vssadmin), each tagged with the ATT&CK technique / rule class it serves. - WELA.ps1: new 'configure-sacl' command. Enables the File System / Registry / Handle Manipulation subcategories (by GUID) and applies the SACLs from the config (principal Everyone, Success+Failure, ContainerInherit on registry keys), idempotently, honoring -Auto / -WhatIf / -Confirm. Enables SeSecurityPrivilege first; skips objects absent on the host. Per-user objects (HKCU / profile AppData) and live LSASS memory/handle access are intentionally out of scope (need a per-user mechanism / Sysmon EID 10) and are documented as such. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MVUmXZBkr5FnZ2hwFkDhx7