From d0fefd97197b022675795ff1710d7ccdc576b2e9 Mon Sep 17 00:00:00 2001
From: PaulHigin <paulhi@microsoft.com>
Date: Mon, 20 Mar 2023 16:33:31 -0700
Subject: [PATCH 1/2] Add WDAC Audit event

---
 .../PowerShell.Core.Instrumentation.man       | 88 +++++++++++++++----
 1 file changed, 69 insertions(+), 19 deletions(-)

diff --git a/src/PowerShell.Core.Instrumentation/PowerShell.Core.Instrumentation.man b/src/PowerShell.Core.Instrumentation/PowerShell.Core.Instrumentation.man
index 025af63..8019539 100644
--- a/src/PowerShell.Core.Instrumentation/PowerShell.Core.Instrumentation.man
+++ b/src/PowerShell.Core.Instrumentation/PowerShell.Core.Instrumentation.man
@@ -2208,6 +2208,18 @@
                 value="0x4002"
                 version="1"
               />
+          <event
+                channel="C_ANALYTIC"
+                keywords="WDACAudit"
+                level="win:Verbose"
+                message = "$(string.PS_PROVIDER.event.E_A_WDACAudit.message)"
+                opcode="Method"
+                symbol="WDACAudit"
+                task="WDACAudit"
+                template="T_WDACAudit"
+                value="0x4003"
+                version="1"
+              />
           </events>
         <channels>
           <!--There are two channels defined for Windows PowerShell instrumentation
@@ -2432,17 +2444,23 @@
               value="120"
               />
           <task
-                message="$(string.PS_PROVIDER.task.T_AmsiState.message)"
-                name="Amsi"
-                symbol="T_Amsi"
-                value="130"
-                />
+              message="$(string.PS_PROVIDER.task.T_AmsiState.message)"
+              name="Amsi"
+              symbol="T_Amsi"
+              value="130"
+              />
           <task
               message="$(string.PS_PROVIDER.task.T_WDACQuery.message)"
               name="WDAC"
               symbol="T_WDAC"
               value="131"
               />
+          <task
+              message="$(string.PS_PROVIDER.task.T_WDACAudit.message)"
+              name="WDACAudit"
+              symbol="T_WDACAudit"
+              value="132"
+              />
         </tasks>
         <opcodes>
           <opcode
@@ -2604,17 +2622,23 @@
               symbol="K_PSWORKFLOW"
               />
           <keyword
-                mask="0x400"
-                message="$(string.PS_PROVIDER.keyword.K_AmsiState.message)"
-                name="AmsiState"
-                symbol="K_AmsiState"
-                />
+              mask="0x400"
+              message="$(string.PS_PROVIDER.keyword.K_AmsiState.message)"
+              name="AmsiState"
+              symbol="K_AmsiState"
+              />
           <keyword
               mask="0x800"
               message="$(string.PS_PROVIDER.keyword.K_WDACQuery.message)"
               name="WDACQuery"
               symbol="K_WDACQuery"
               />
+          <keyword
+              mask="0x1000"
+              message="$(string.PS_PROVIDER.keyword.K_WDACAudit.message)"
+              name="WDACAudit"
+              symbol="K_WDACAudit"
+              />
         </keywords>
         <maps>
           <!-- please keep in sync with SerializationMethod from
@@ -4073,14 +4097,14 @@
                 />
           </template>
           <template tid="T_AmsiState">
-              <data
-                  inType="win:UnicodeString"
-                  name="Action"
-                  />
-              <data
-                  inType="win:UnicodeString"
-                  name="AmsiContext"
-                  />
+            <data
+                inType="win:UnicodeString"
+                name="Action"
+                />
+            <data
+                inType="win:UnicodeString"
+                name="AmsiContext"
+                />
           </template>
           <template tid="T_WDACQuery">
             <data
@@ -4099,7 +4123,21 @@
                 inType="win:Int32"
                 name="QuerySResult"
                 />
-           </template>
+          </template>
+          <template tid="T_WDACAudit">
+            <data
+                inType="win:UnicodeString"
+                name="Title"
+                />
+            <data
+                inType="win:UnicodeString"
+                name="Message"
+                />
+            <data
+                inType="win:UnicodeString"
+                name="FullyQualifiedId"
+                />
+          </template>
         </templates>
       </provider>
     </events>
@@ -5729,6 +5767,18 @@
             id="PS_PROVIDER.task.T_WDACQuery.message"
             value="WDAC Query"
             />
+        <string
+            id="PS_PROVIDER.event.E_A_WDACAudit.message"
+            value="WDAC Audit. %n %t Title: %1 %n %t Message: %2 %n %t FullyQualifiedId: %3"
+            />
+        <string
+            id="PS_PROVIDER.keyword.K_WDACAudit.message"
+            value="WDAC Audit"
+            />
+        <string
+            id="PS_PROVIDER.task.T_WDACAudit.message"
+            value="WDAC Audit"
+            />
       </stringTable>
     </resources>
   </localization>

From a6696e908838981523946dd9028d74fa378cd176 Mon Sep 17 00:00:00 2001
From: PaulHigin <paulhi@microsoft.com>
Date: Tue, 21 Mar 2023 11:31:42 -0700
Subject: [PATCH 2/2] Change to operational channel

---
 .../PowerShell.Core.Instrumentation.man                         | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/PowerShell.Core.Instrumentation/PowerShell.Core.Instrumentation.man b/src/PowerShell.Core.Instrumentation/PowerShell.Core.Instrumentation.man
index 8019539..86de837 100644
--- a/src/PowerShell.Core.Instrumentation/PowerShell.Core.Instrumentation.man
+++ b/src/PowerShell.Core.Instrumentation/PowerShell.Core.Instrumentation.man
@@ -2209,7 +2209,7 @@
                 version="1"
               />
           <event
-                channel="C_ANALYTIC"
+                channel="C_OPERATIONAL"
                 keywords="WDACAudit"
                 level="win:Verbose"
                 message = "$(string.PS_PROVIDER.event.E_A_WDACAudit.message)"