CSEC_PUBLIC/WELA
1
0 Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2026-10-01 20:14:43 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
bfa286bf7dca12d7bd44b2e90ad398ec9cec07e3
WELA/scripts
T
History
Shirofune-Security bfa286bf7d Integrate reviewed WMI recovery with combined dev auditing batch
2026-09-22 15:06:51 +09:00
..
AdcsAuditing.ps1
Guard AD CS audit configuration and collect native request evidence (#421)
2026-09-20 19:34:03 +09:00
AdcsRestartResume.ps1
Resume a reviewed pending AD CS auditing restart (#431)
2026-09-21 09:16:39 +09:00
AdObjectSacl.ps1
Isolate unknown dMSA prerequisites from other AD audit classes
2026-09-19 06:20:41 +09:00
AppLockerProbe.ps1
Validate native AppLocker EXE event generation with an opt-in probe (#423)
2026-09-20 22:46:56 +09:00
AppLockerReadiness.ps1
Validate native AppLocker EXE event generation with an opt-in probe (#423)
2026-09-20 22:46:56 +09:00
AppLockerScriptNative.cs
Add fixed native AppLocker Script probe and disposable evidence matrix
2026-09-21 22:22:21 +09:00
AppLockerScriptProbe.ps1
Refuse stopped service dependencies before AppLocker CIM observation
2026-09-21 22:34:09 +09:00
AppLockerScriptWorker.ps1
Read the owned release pipe with encoding-preamble detection
2026-09-21 22:29:03 +09:00
AuditIntegrity.ps1
Add source-specific Windows audit privilege and integrity controls (#412)
2026-09-20 14:03:18 +09:00
AuditIntegrityNative.cs
Add source-specific Windows audit privilege and integrity controls (#412)
2026-09-20 14:03:18 +09:00
AuditNotifications.ps1
Add OneSettings auditing and Security warning controls (#408)
2026-09-20 13:55:24 +09:00
AuditRecovery.ps1
Add guarded value-only recovery for named logging DWORDs
2026-09-21 09:34:13 +09:00
AuditScoring.ps1
Add transparent configuration and native rule readiness scores (#417)
2026-09-20 18:15:04 +09:00
Capi2Probe.ps1
Integrate final reviewed development base for CAPI2 probe
2026-09-21 18:21:10 +09:00
Capi2ProbeNative.cs
Create an unnamed CNG key through typed native helper
2026-09-21 17:53:39 +09:00
Capi2ProbeWorker.ps1
Sign public certificate without copying its ephemeral private key
2026-09-21 17:56:04 +09:00
ChannelRead.ps1
Verify actual current-token access to built-in event channels (#432)
2026-09-21 09:18:46 +09:00
ChannelReadNative.cs
Verify actual current-token access to built-in event channels (#432)
2026-09-21 09:18:46 +09:00
ChannelRecovery.ps1
Accept genuine native channel snapshot size and provider representation
2026-09-22 08:02:36 +09:00
Configuration.ps1
feat: configure selected incoming and domain NTLM audit policies
2026-09-22 12:03:11 +09:00
ControlApplicability.ps1
Gate historical controls and require evidence for Windows defaults (#409)
2026-09-20 14:00:10 +09:00
CustomAuditProfiles.ps1
Support validated custom audit profile files through the shared engine (#416)
2026-09-20 18:09:52 +09:00
DnsAnalytical.ps1
Add guarded DNS analytical logging and stopped-trace archives (#425)
2026-09-20 22:49:52 +09:00
DnsAnalyticalArchive.cs
Add guarded DNS analytical logging and stopped-trace archives (#425)
2026-09-20 22:49:52 +09:00
DnsClientProbe.ps1
Use precise native DNS operation timestamps and nonce-only event reads
2026-09-21 10:47:06 +09:00
DnsClientProbeNative.cs
Use precise native DNS operation timestamps and nonce-only event reads
2026-09-21 10:47:06 +09:00
DnsClientProbeWorker.ps1
Use precise native DNS operation timestamps and nonce-only event reads
2026-09-21 10:47:06 +09:00
EventLogConfiguration.ps1
Unify event-log size and retention profiles with verified configuration
2026-09-19 02:30:41 +09:00
EventLogRecovery.ps1
Bind the reviewed native host gate and context dependency
2026-09-21 18:17:23 +09:00
EventMeasurement.ps1
Measure bounded native event delivery and verify exact EVTX samples (#430)
2026-09-21 09:14:48 +09:00
EventMeasurementNative.cs
Measure bounded native event delivery and verify exact EVTX samples (#430)
2026-09-21 09:14:48 +09:00
EvtxRecovery.ps1
Verify native EVTX recovery under the actual primary reader token
2026-09-21 09:30:59 +09:00
FailedLogonProbe.ps1
Add a native local failed-logon audit probe (#444)
2026-09-21 22:13:20 +09:00
FailedLogonProbeNative.cs
Add a native local failed-logon audit probe (#444)
2026-09-21 22:13:20 +09:00
FailedLogonProbeWorker.ps1
Add a native local failed-logon audit probe (#444)
2026-09-21 22:13:20 +09:00
FileAccessProbe.ps1
Measure held-readback phase and refuse implementation targets before hashing
2026-09-21 22:51:50 +09:00
FileAccessProbeNative.cs
Measure held-readback phase and refuse implementation targets before hashing
2026-09-21 22:51:50 +09:00
FileAccessProbeWorker.ps1
Checkpoint exact native one-byte file access probe
2026-09-21 22:27:26 +09:00
FileSaclRecovery.ps1
Verify the observed present-null SACL after sole audit ACE removal
2026-09-21 10:26:57 +09:00
FileSaclRecoveryNative.cs
Verify the observed present-null SACL after sole audit ACE removal
2026-09-21 10:26:57 +09:00
FirewallLogging.ps1
Reject firewall log path drift before configuration
2026-09-19 02:33:53 +09:00
FirewallLoggingRecovery.ps1
Require running firewall providers before recovery observations
2026-09-21 18:15:02 +09:00
GpoAuditPackages.ps1
Add reviewable GPO audit-policy deployment packages (#415)
2026-09-20 18:13:34 +09:00
GpoCreation.ps1
Create new disabled, unlinked GPOs from reviewed native audit backups (#427)
2026-09-20 22:53:00 +09:00
IntuneAuditExport.ps1
Export native audit profiles for reviewed Intune client policies (#414)
2026-09-20 18:10:52 +09:00
IpsecPrerequisites.ps1
Gate conditional IPsec auditing on native prerequisite evidence (#439)
2026-09-21 17:42:53 +09:00
LdapDiagnostics.ps1
Make LDAP 1644 diagnostics explicit and preserve existing DC settings
2026-09-19 07:09:07 +09:00
NamedRegistryRecovery.ps1
Add guarded value-only recovery for named logging DWORDs
2026-09-21 09:34:13 +09:00
NamedRegistryRecoveryNative.cs
Add guarded value-only recovery for named logging DWORDs
2026-09-21 09:34:13 +09:00
NativeChannelConfiguration.ps1
Add OneSettings auditing and Security warning controls (#408)
2026-09-20 13:55:24 +09:00
NativeProviderPacks.ps1
Handle native WinRM manifest IDs without Int32 overflow
2026-09-22 10:10:01 +09:00
NativeValidation.ps1
Collect native 4688 validation components with a fixed benign probe (#413)
2026-09-20 18:08:34 +09:00
NtlmAudit.ps1
fix: require running WMI before scoped NTLM observations
2026-09-22 12:06:11 +09:00
OutgoingNtlmAudit.ps1
Add scoped outgoing NTLM audit configuration with native acceptance
2026-09-22 10:09:37 +09:00
PowerShellTranscription.ps1
Add opt-in Windows PowerShell transcription for CIS Level 2
2026-09-19 07:09:33 +09:00
RegistrySaclRecovery.ps1
fix: accept exact native empty catalog representations and document recovery
2026-09-22 11:01:38 +09:00
RegistrySaclRecoveryNative.cs
feat: checkpoint reviewed native registry SACL recovery
2026-09-22 10:11:02 +09:00
RetentionHealth.ps1
Add typed native WEC runtime observations (#424)
2026-09-20 22:48:32 +09:00
Review-AuditCatalog.ps1
Correct legacy token audit GUID and validate catalog mapping uncertainty
2026-09-19 07:01:50 +09:00
SelectedSaclConfiguration.ps1
Verify reviewed descendant SACL propagation and preservation (#429)
2026-09-21 09:12:56 +09:00
SelectedSaclDescendants.ps1
Verify reviewed descendant SACL propagation and preservation (#429)
2026-09-21 09:12:56 +09:00
SelectedSaclNative.cs
Verify reviewed descendant SACL propagation and preservation (#429)
2026-09-21 09:12:56 +09:00
SmbAuditing.ps1
Separate SMB policy verification from runtime activation
2026-09-19 04:39:55 +09:00
SmbRuntimeActivation.ps1
Activate native SMB audit runtime switches explicitly (#441)
2026-09-21 18:09:10 +09:00
TargetedSaclPlanning.ps1
Apply reviewed SACL plans to explicitly selected local targets (#422)
2026-09-20 19:36:05 +09:00
TranscriptionRecovery.ps1
Reject coerced transcription recovery history discriminators
2026-09-21 18:19:57 +09:00
TranscriptProbe.ps1
Use native module paths and transcript header command formatting
2026-09-21 09:53:50 +09:00
TranscriptProbeNative.cs
Add current-account automatic transcription probe
2026-09-21 09:43:39 +09:00
TranscriptProbeWorker.ps1
Use native module paths and transcript header command formatting
2026-09-21 09:53:50 +09:00
WecAuthorization.ps1
Review and update only source SID authorization on disabled WEC subscriptions
2026-09-22 07:50:50 +09:00
WecAuthorizationNative.cs
Fix WEC variant decoding and native authorization fixture
2026-09-22 08:08:17 +09:00
WecIngress.ps1
Add reviewed scoped collector firewall ingress creation (#442)
2026-09-21 18:19:30 +09:00
WecListener.ps1
Verify effective native worker module path and complete fixture exit status
2026-09-21 23:07:16 +09:00
WecListenerPipeNative.cs
Create one reviewed exact-IP collector listener through a bounded native adapter
2026-09-21 22:58:08 +09:00
WecListenerWorker.ps1
Verify effective native worker module path and complete fixture exit status
2026-09-21 23:07:16 +09:00
WecRuntime.ps1
Add typed native WEC runtime observations (#424)
2026-09-20 22:48:32 +09:00
WecRuntimeNative.cs
Add typed native WEC runtime observations (#424)
2026-09-20 22:48:32 +09:00
WecState.ps1
Review and apply existing WEC subscription enable/disable (#440)
2026-09-21 17:54:55 +09:00
WecStateNative.cs
Review and apply existing WEC subscription enable/disable (#440)
2026-09-21 17:54:55 +09:00
WecUpdate.ps1
Review and apply query updates to existing disabled WEC subscriptions (#426)
2026-09-20 22:51:01 +09:00
WecUpdateNative.cs
Review and apply query updates to existing disabled WEC subscriptions (#426)
2026-09-20 22:51:01 +09:00
WefArrival.ps1
Verify native probe arrival in the local WEF collector (#418)
2026-09-20 19:26:57 +09:00
WefDeployment.ps1
Fix native collector subscription inventory and Unicode readback
2026-09-22 09:46:28 +09:00
WefQuery.ps1
fix: decode native WEF XML independently of property count
2026-09-22 12:37:37 +09:00
WefQueryNative.cs
fix: decode native WEF XML independently of property count
2026-09-22 12:37:37 +09:00
WefQueryWorker.ps1
Add bounded native preflight for one selected WEF QueryList
2026-09-22 12:00:26 +09:00
WmiNamespaceAuditing.ps1
Collect local WMI namespace audit evidence with a fixed read probe (#428)
2026-09-21 09:08:20 +09:00
WmiProbe.ps1
Use precise native UTC for WMI probe event intervals (#438)
2026-09-21 17:30:16 +09:00
WmiProbeNative.cs
Use precise native UTC for WMI probe event intervals (#438)
2026-09-21 17:30:16 +09:00
WmiProbeWorker.ps1
Use precise native UTC for WMI probe event intervals (#438)
2026-09-21 17:30:16 +09:00
WmiSaclRecovery.ps1
Add reviewed removal of one proven parent-only WMI audit ACE
2026-09-22 14:43:33 +09:00