SepAdtPrivilegedServiceAuditAlarm

VOID __stdcall SepAdtPrivilegedServiceAuditAlarm(
        _SECURITY_SUBJECT_CONTEXT *SubjectSecurityContext,
        _UNICODE_STRING *CapturedSubsystemName,
        _UNICODE_STRING *CapturedServiceName,
        _TOKEN *ClientToken,
        _TOKEN *PrimaryToken,
        _PRIVILEGE_SET *CapturedPrivileges,
        UINT8 AccessGranted){
  _EPROCESS *CurrentThreadProcess; 
  NTSTATUS AllocatedFullProcessImageName; 
  _SID_AND_ATTRIBUTES *UserAndGroups; 
  unsigned __int8 *Sid; 
  _UNICODE_STRING *v13; 
  _LUID AuthenticationId; 
  int v15; 
  unsigned int v16; 
  int Length; 
  unsigned int PrivilegeCount; 
  unsigned int v19; 
  UINT16 FlatSubCategoryId[4]; 
  _UNICODE_STRING *ImageName; 
  _UNICODE_STRING *v22; 
  unsigned __int64 UniqueProcessId; 
  _SE_ADT_PARAMETER_ARRAY AuditParameters; 

  v22 = CapturedSubsystemName;
  ImageName = 0i64;
  FlatSubCategoryId[0] = 0;
  if( SepAdtAuditPrivilegeUseWithContext(
         CapturedPrivileges,
         AccessGranted,
         AccessGranted == 0,
         SubjectSecurityContext,
         FlatSubCategoryId) )
  {
    CurrentThreadProcess = (_EPROCESS *)PsGetCurrentThreadProcess();
    UniqueProcessId = (unsigned __int64)CurrentThreadProcess->UniqueProcessId;
    AllocatedFullProcessImageName = PsGetAllocatedFullProcessImageNameEx(CurrentThreadProcess, &ImageName);
    if( AllocatedFullProcessImageName >= 0 )
    {
      if( ClientToken )
        UserAndGroups = ClientToken->UserAndGroups;
      else
        UserAndGroups = PrimaryToken->UserAndGroups;
      Sid = (unsigned __int8 *)UserAndGroups->Sid;
      v13 = (_UNICODE_STRING *)&SeSubsystemName;
      AuthenticationId = PrimaryToken->AuthenticationId;
      if( v22 )
        v13 = v22;
      memset(&AuditParameters, 0i64, sizeof(AuditParameters));
      AuditParameters.CategoryId = 4;
      AuditParameters.FlatSubCategoryId = FlatSubCategoryId[0];
      AuditParameters.AuditId = 4673;
      AuditParameters.Type = 8;
      if( !AccessGranted )
        AuditParameters.Type = 16;
      v15 = Sid[1];
      AuditParameters.Parameters[0].Type = SeAdtParmTypeSid;
      v16 = v13->Length + 16;
      AuditParameters.Parameters[0].Address = Sid;
      AuditParameters.Parameters[1].Type = SeAdtParmTypeString;
      AuditParameters.Parameters[0].Length = 4 * v15 + 8;
      AuditParameters.Parameters[1].Length = v16;
      AuditParameters.Parameters[1].Address = v13;
      AuditParameters.Parameters[2].Type = SeAdtParmTypeLogonId;
      AuditParameters.Parameters[2].Length = 8;
      if( ClientToken )
        AuditParameters.Parameters[2].Data[0] = (unsigned __int64)ClientToken->AuthenticationId;
      else
        AuditParameters.Parameters[2].Data[0] = (unsigned __int64)AuthenticationId;
      AuditParameters.Parameters[3].Type = SeAdtParmTypeString;
      AuditParameters.Parameters[3].Length = v16;
      AuditParameters.Parameters[3].Address = v13;
      if( CapturedServiceName )
      {
        Length = CapturedServiceName->Length;
        AuditParameters.Parameters[4].Type = SeAdtParmTypeString;
        AuditParameters.Parameters[4].Length = Length + 16;
        AuditParameters.Parameters[4].Address = CapturedServiceName;
      }
      if( CapturedPrivileges )
      {
        PrivilegeCount = CapturedPrivileges->PrivilegeCount;
        if( CapturedPrivileges->PrivilegeCount )
        {
          AuditParameters.Parameters[5].Type = SeAdtParmTypePrivs;
          AuditParameters.Parameters[5].Address = CapturedPrivileges;
          AuditParameters.Parameters[5].Length = 12 * PrivilegeCount + 8;
        }
      }
      AuditParameters.Parameters[6].Data[0] = UniqueProcessId;
      AuditParameters.Parameters[7].Address = ImageName;
      v19 = ImageName->Length + 16;
      AuditParameters.Parameters[6].Type = SeAdtParmTypePtr;
      AuditParameters.Parameters[7].Length = v19;
      AuditParameters.Parameters[6].Length = 8;
      AuditParameters.Parameters[7].Type = SeAdtParmTypeFileSpec;
      AuditParameters.ParameterCount = 8;
      SepAdtLogAuditRecord(&AuditParameters);
    }
    if( ImageName )
      ExFreePoolWithTag(ImageName, 0);
    if( AllocatedFullProcessImageName < 0 )
      SepAuditFailed((unsigned int)AllocatedFullProcessImageName);
  }
}

Referenced by: