Skip to content

Add WDAC events and system lock down notification.#89

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Aditya Patwardhan (adityapatwardhan) merged 5 commits into from
Jan 9, 2023
Merged

Add WDAC events and system lock down notification. #89

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
7b60a6c
Add WDAC events
PaulHigin Jan 4, 2023
21660d7
Merge branch 'master' into wdac-events
PaulHigin Jan 5, 2023
f0c91c1
Update src/PowerShell.Core.Instrumentation/PowerShell.Core.Instrument…
adityapatwardhan Jan 6, 2023
e299c8f
Update src/PowerShell.Core.Instrumentation/PowerShell.Core.Instrument…
adityapatwardhan Jan 6, 2023
643df44
Update src/PowerShell.Core.Instrumentation/PowerShell.Core.Instrument…
adityapatwardhan Jan 6, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
77 changes: 66 additions & 11 deletions src/PowerShell.Core.Instrumentation/PowerShell.Core.Instrumentation.man
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -2184,7 +2184,7 @@
value="0x6017"
version="1"
/>
<event
<event
channel="C_ANALYTIC"
keywords="AmsiState"
level="win:Verbose"
Expand All@@ -2196,6 +2196,19 @@
value="0x4001"
version="1"
/>
<event
channel="C_ANALYTIC"
keywords="WDACQuery"
level="win:Verbose"
message="$(string.PS_PROVIDER.event.E_A_WDACQuery.message)"
opcode="Method"
symbol="WDACQuery"
task="WDAC"
template="T_WDACQuery"
value="0x4002"
version="1"
/>
</events>
</events>
<channels>
<!--There are two channels defined for Windows PowerShell instrumentation
Expand DownExpand Up@@ -2419,11 +2432,17 @@
symbol="T_ISEOperation"
value="120"
/>
<task
<task
message="$(string.PS_PROVIDER.task.T_AmsiState.message)"
name="Amsi"
symbol="T_Amsi"
value="130"
/>
<task
message="$(string.PS_PROVIDER.task.T_WDACQuery.message)"
name="WDAC"
symbol="T_WDAC"
value="131"
/>
</tasks>
<opcodes>
Expand DownExpand Up@@ -2585,11 +2604,17 @@
name="PSWorkflow"
symbol="K_PSWORKFLOW"
/>
<keyword
<keyword
mask="0x400"
message="$(string.PS_PROVIDER.keyword.K_AmsiState.message)"
name="AmsiState"
symbol="K_AmsiState"
/>
<keyword
mask="0x800"
message="$(string.PS_PROVIDER.keyword.K_WDACQuery.message)"
name="WDACQuery"
symbol="K_WDACQuery"
/>
</keywords>
<maps>
Expand DownExpand Up@@ -4048,16 +4073,34 @@
name="FileName"
/>
</template>
<template tid="T_AmsiState">
<data
inType="win:UnicodeString"
name="Action"
<template tid="T_AmsiState">
<data
inType="win:UnicodeString"
name="Action"
/>
<data
inType="win:UnicodeString"
name="AmsiContext"
/>
</template>
<template tid="T_WDACQuery">
<data
inType="win:UnicodeString"
name="QueryName"
/>
<data
inType="win:UnicodeString"
name="AmsiContext"
<data
inType="win:UnicodeString"
name="FileName"
/>
<data
inType="win:Int32"
name="QuerySuccess"
/>
</template>
<data
inType="win:Int32"
name="QuerySResult"
/>
</template>
</templates>
</provider>
</events>
Expand DownExpand Up@@ -5675,6 +5718,18 @@
id="PS_PROVIDER.event.E_O_REMOTE_NAMEDPIPE_DISCONNECT.message"
value="Windows PowerShell IPC disconnect on process: %1 in AppDomain: %2 for User: %3."
/>
<string
id="PS_PROVIDER.event.E_A_WDACQuery.message"
value="WDAC Query. %n %t Query: %1 %n %t File: %2 %n %t SuccessCode: %3 %n %t ResultCode: %4"
/>
<string
id="PS_PROVIDER.keyword.K_WDACQuery.message"
value="WDAC Query"
/>
<string
id="PS_PROVIDER.task.T_WDACQuery.message"
value="WDAC Query"
/>
</stringTable>
</resources>
</localization>
Expand Down