From 2fae082cb733a01a063245a40382d51cd2e6a63a Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Wed, 14 Aug 2024 20:02:06 +0900 Subject: [PATCH 1/2] Skip SID translation for capability SIDs Signed-off-by: Hiroshi Hatake --- ext/winevt/winevt_utils.cpp | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/ext/winevt/winevt_utils.cpp b/ext/winevt/winevt_utils.cpp index 7a11789..ed60000 100644 --- a/ext/winevt/winevt_utils.cpp +++ b/ext/winevt/winevt_utils.cpp @@ -885,14 +885,20 @@ render_system_event(EVT_HANDLE hEvent, BOOL preserve_qualifiers, BOOL preserveSI if (preserveSID_p) { rbstr = rb_utf8_str_new_cstr(pwsSid); rb_hash_aset(hash, rb_str_new2("UserID"), rbstr); - LocalFree(pwsSid); } - if (ExpandSIDWString(pRenderedValues[EvtSystemUserID].SidVal, - &expandSID) == 0) { - rbstr = rb_utf8_str_new_cstr(expandSID); - free(expandSID); - rb_hash_aset(hash, rb_str_new2("User"), rbstr); + /* S-1-15-3- is used for capability SIDs. So, we need to skip + * SID translation. + * See also: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers + */ + if (strnicmp(pwsSid, "S-1-15-3-", 9) != 0) { + if (ExpandSIDWString(pRenderedValues[EvtSystemUserID].SidVal, + &expandSID) == 0) { + rbstr = rb_utf8_str_new_cstr(expandSID); + free(expandSID); + rb_hash_aset(hash, rb_str_new2("User"), rbstr); + } } + LocalFree(pwsSid); } } From f09c8776dc4ad60bb3d04a4b29720d6dbcf87fda Mon Sep 17 00:00:00 2001 From: Hiroshi Hatake Date: Mon, 19 Aug 2024 12:58:04 +0900 Subject: [PATCH 2/2] utils: Add a describing link for not mapping case of capability SIDs Signed-off-by: Hiroshi Hatake --- ext/winevt/winevt_utils.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ext/winevt/winevt_utils.cpp b/ext/winevt/winevt_utils.cpp index ed60000..0e033d6 100644 --- a/ext/winevt/winevt_utils.cpp +++ b/ext/winevt/winevt_utils.cpp @@ -888,7 +888,8 @@ render_system_event(EVT_HANDLE hEvent, BOOL preserve_qualifiers, BOOL preserveSI } /* S-1-15-3- is used for capability SIDs. So, we need to skip * SID translation. - * See also: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers + * ref: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers + * See also: https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/sids-not-resolve-into-friendly-names */ if (strnicmp(pwsSid, "S-1-15-3-", 9) != 0) { if (ExpandSIDWString(pRenderedValues[EvtSystemUserID].SidVal,