mirror of
https://github.com/atomiczsec/Adrenaline
synced 2026-06-21 13:47:29 +00:00
Gavin K
e1e8b82368
- applications_enum.c: Remove RegCloseKey on uninitialized handle when RegOpenKeyExA fails (undefined behavior bug) - window_handles_enum.c: Report errors when GetClipboardData or GlobalLock fail in TestClipboardAccess instead of silently ignoring - powershell_history.c: Add error codes to file open/seek/read failures in read_snippet_ascii_at for diagnosability - notepad_grab.c: Report error when CreateToolhelp32Snapshot fails in FindNotepadProcesses - process_tokens_list.c: Report specific failure reason in EnableSeDebugPrivilege (OpenProcessToken vs LookupPrivilegeValue) - wevt_logon_enum.c: Report which wevtapi function failed to resolve instead of generic failure message Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
wevt_logon_enum BOF
Summary
Enumerates recent Security log (successful/failed) logon events (Event IDs 4624,4625,4672) via the wevtapi API and prints remote workstation name/IP plus the target username.
Notes
- Requires permission to read the Security log (typically admin or SYSTEM).
Expected Output
[i] Querying Security log for logon events (EventID 4624,4625,4672)...
[+] user: alice workstation: DESKTOP-1234
[+] user: bob workstation: 10.0.0.24
[+] user: carol workstation: WORKSTATION-7F2A
[+] user: dave workstation: 192.168.1.77
[i] Processed 4 logon events (max 64).
[i] wevt_logon_enum: done
- Only logon events that have a WorkstationName or IP Address are shown.
- Events with XML larger than 512 wide characters are skipped with a warning message.