Skip to content

Commit

Permalink
Add new comparsion "contains"
Browse files Browse the repository at this point in the history 
[+] Add new comparison operator
[*] Update machine finding list

When comparing the audit policy configuration, "Success and Failure" is
classified as an issue if only "Success" is recommended. The new
comparison operator solves this problem.
  • Loading branch information
@0x6d69636b
0x6d69636b committed Jul 27, 2020
1 parent 51d0c4a commit b4cfb35
Show file tree
Hide file tree
Showing 2 changed files with 13 additions and 12 deletions.
1 change: 1 addition & 0 deletions Invoke-HardeningKitty.ps1
View file
Original file line number Diff line number Diff line change
Expand Up @@ -646,6 +646,7 @@
"=" { If ($Result -eq $Finding.RecommendedValue) { $ResultPassed = $true }; Break}
"<=" { try { If ([int]$Result -le [int]$Finding.RecommendedValue) { $ResultPassed = $true }} catch { $ResultPassed = $false }; Break}
">=" { try { If ([int]$Result -ge [int]$Finding.RecommendedValue) { $ResultPassed = $true }} catch { $ResultPassed = $false }; Break}
"contains" { If ($Result.Contains($Finding.RecommendedValue)) { $ResultPassed = $true }; Break}
}

If ($ResultPassed) {
Expand Down
24 changes: 12 additions & 12 deletions lists/finding_list_0x6d69636b_machine.csv
View file
Original file line number Diff line number Diff line change
Expand Up @@ -71,30 +71,30 @@
1417,"Windows Firewall","Log successful connections (Public Profile, Policy)","Registry",,"HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging","LogSuccessfulConnections",,,,0,1,"=","Low"
1435,"Windows Firewall","Log successful connections (Public Profile)","Registry",,"HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging","LogSuccessfulConnections",,,,0,1,"=","Low"
1500,"Advanced Audit Policy Configuration","Credential Validation","auditpol",,,,,,,,"Success and Failure","=","Low"
1501,"Advanced Audit Policy Configuration","Security Group Management","auditpol",,,,,,,"Success","Success","=","Low"
1501,"Advanced Audit Policy Configuration","Security Group Management","auditpol",,,,,,,"Success","Success","contains","Low"
1502,"Advanced Audit Policy Configuration","User Account Management","auditpol",,,,,,,"Success","Success and Failure","=","Low"
1503,"Advanced Audit Policy Configuration","DPAPI Activity","auditpol",,,,,,,,"Success and Failure","=","Low"
1504,"Advanced Audit Policy Configuration","Plug and Play Events","auditpol",,,,,,,,"Success","=","Low"
1505,"Advanced Audit Policy Configuration","Process Creation","auditpol",,,,,,,,"Success","=","Low"
1506,"Advanced Audit Policy Configuration","Account Lockout","auditpol",,,,,,,"Success","Failure","=","Low"
1507,"Advanced Audit Policy Configuration","Group Membership","auditpol",,,,,,,,"Success","=","Low"
1504,"Advanced Audit Policy Configuration","Plug and Play Events","auditpol",,,,,,,,"Success","contains","Low"
1505,"Advanced Audit Policy Configuration","Process Creation","auditpol",,,,,,,,"Success","contains","Low"
1506,"Advanced Audit Policy Configuration","Account Lockout","auditpol",,,,,,,"Success","Failure","contains","Low"
1507,"Advanced Audit Policy Configuration","Group Membership","auditpol",,,,,,,,"Success","contains","Low"
1508,"Advanced Audit Policy Configuration","Logon","auditpol",,,,,,,"Success","Success and Failure","=","Low"
1509,"Advanced Audit Policy Configuration","Other Logon/Logoff Events","auditpol",,,,,,,,"Success and Failure","=","Low"
1510,"Advanced Audit Policy Configuration","Special Logon","auditpol",,,,,,,"Success","Success","=","Low"
1511,"Advanced Audit Policy Configuration","Detailed File Share","auditpol",,,,,,,,"Failure","=","Low"
1510,"Advanced Audit Policy Configuration","Special Logon","auditpol",,,,,,,"Success","Success","contains","Low"
1511,"Advanced Audit Policy Configuration","Detailed File Share","auditpol",,,,,,,,"Failure","contains","Low"
1512,"Advanced Audit Policy Configuration","File Share","auditpol",,,,,,,,"Success and Failure","=","Low"
1513,"Advanced Audit Policy Configuration","Kernel Object","auditpol",,,,,,,,"Success and Failure","=","Low"
1514,"Advanced Audit Policy Configuration","Other Object Access Events","auditpol",,,,,,,,"Success and Failure","=","Low"
1515,"Advanced Audit Policy Configuration","Removable Storage","auditpol",,,,,,,,"Success and Failure","=","Low"
1516,"Advanced Audit Policy Configuration","SAM","auditpol",,,,,,,"Success","Success and Failure","=","Low"
1517,"Advanced Audit Policy Configuration","Audit Policy Change","auditpol",,,,,,,"Success","Success","=","Low"
1518,"Advanced Audit Policy Configuration","Authentication Policy Change","auditpol",,,,,,,"Success","Success","=","Low"
1517,"Advanced Audit Policy Configuration","Audit Policy Change","auditpol",,,,,,,"Success","Success","contains","Low"
1518,"Advanced Audit Policy Configuration","Authentication Policy Change","auditpol",,,,,,,"Success","Success","contains","Low"
1519,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change","auditpol",,,,,,,,"Success and Failure","=","Low"
1520,"Advanced Audit Policy Configuration","Other Policy Change Events","auditpol",,,,,,,,"Failure","=","Low"
1520,"Advanced Audit Policy Configuration","Other Policy Change Events","auditpol",,,,,,,,"Failure","contains","Low"
1521,"Advanced Audit Policy Configuration","Sensitive Privilege Use","auditpol",,,,,,,,"Success and Failure","=","Low"
1522,"Advanced Audit Policy Configuration","Other System Events","auditpol",,,,,,,"Success and Failure","Success and Failure","=","Low"
1523,"Advanced Audit Policy Configuration","Security State Change","auditpol",,,,,,,"Success","Success","=","Low"
1524,"Advanced Audit Policy Configuration","Security System Extension","auditpol",,,,,,,,"Success","=","Low"
1523,"Advanced Audit Policy Configuration","Security State Change","auditpol",,,,,,,"Success","Success","contains","Low"
1524,"Advanced Audit Policy Configuration","Security System Extension","auditpol",,,,,,,,"Success","contains","Low"
1525,"Advanced Audit Policy Configuration","System Integrity","auditpol",,,,,,,"Success and Failure","Success and Failure","=","Low"
1600,"System","Control Panel: Prevent enabling lock screen camera","Registry",,"HKLM:\Software\Policies\Microsoft\Windows\Personalization","NoLockScreenCamera",,,,0,1,"=","Low"
1601,"System","Network: DNS Client: Turn off multicast name resolution (LLMNR)","Registry",,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient","EnableMulticast",,,,1,0,"=","Medium"
Expand Down

0 comments on commit b4cfb35

Please sign in to comment.