From 2fae082cb733a01a063245a40382d51cd2e6a63a Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Wed, 14 Aug 2024 20:02:06 +0900 Subject: [PATCH] Skip SID translation for capability SIDs Signed-off-by: Hiroshi Hatake --- ext/winevt/winevt_utils.cpp | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/ext/winevt/winevt_utils.cpp b/ext/winevt/winevt_utils.cpp index 7a11789..ed60000 100644 --- a/ext/winevt/winevt_utils.cpp +++ b/ext/winevt/winevt_utils.cpp @@ -885,14 +885,20 @@ render_system_event(EVT_HANDLE hEvent, BOOL preserve_qualifiers, BOOL preserveSI if (preserveSID_p) { rbstr = rb_utf8_str_new_cstr(pwsSid); rb_hash_aset(hash, rb_str_new2("UserID"), rbstr); - LocalFree(pwsSid); } - if (ExpandSIDWString(pRenderedValues[EvtSystemUserID].SidVal, - &expandSID) == 0) { - rbstr = rb_utf8_str_new_cstr(expandSID); - free(expandSID); - rb_hash_aset(hash, rb_str_new2("User"), rbstr); + /* S-1-15-3- is used for capability SIDs. So, we need to skip + * SID translation. + * See also: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers + */ + if (strnicmp(pwsSid, "S-1-15-3-", 9) != 0) { + if (ExpandSIDWString(pRenderedValues[EvtSystemUserID].SidVal, + &expandSID) == 0) { + rbstr = rb_utf8_str_new_cstr(expandSID); + free(expandSID); + rb_hash_aset(hash, rb_str_new2("User"), rbstr); + } } + LocalFree(pwsSid); } }