lib/Desktop/AdNoctem.Substrate.Security.xml
|
<?xml version="1.0"?>
<doc> <assembly> <name>AdNoctem.Substrate.Security</name> </assembly> <members> <member name="T:AdNoctem.Substrate.Security.AuthenticodeSigner"> <summary>Explicit Windows Authenticode signing with SHA-256, a borrowed signing certificate and no signing wizard.</summary> </member> <member name="M:AdNoctem.Substrate.Security.AuthenticodeSigner.Sign(AdNoctem.Substrate.IO.FileSystemPath,System.Security.Cryptography.X509Certificates.X509Certificate2,System.Uri,AdNoctem.Substrate.Security.SignatureNetworkAccess,System.Threading.CancellationToken)"> <summary>Signs one file with the supplied private-key certificate and returns verification evidence for the resulting signature.</summary> <remarks>Signs one existing file. Timestamping uses the Authenticode timestamp protocol; no trust stores are modified. The certificate and its private key remain caller-owned. Native signing cannot be interrupted once started.</remarks> </member> <member name="M:AdNoctem.Substrate.Security.AuthenticodeSigner.SignAsync(AdNoctem.Substrate.IO.FileSystemPath,System.Security.Cryptography.X509Certificates.X509Certificate2,System.Uri,AdNoctem.Substrate.Security.SignatureNetworkAccess,System.Threading.CancellationToken)"> <summary>Offloads signing and verification; the borrowed certificate must remain alive until the task completes.</summary> <remarks>Cancellation before signing prevents the operation. Once native signing starts, its result is verified and returned even if cancellation arrives.</remarks> </member> <member name="T:AdNoctem.Substrate.Security.CertificateInfo"> <summary>A detached public certificate, without a private key or native handle.</summary> </member> <member name="M:AdNoctem.Substrate.Security.CertificateInfo.OpenCertificate"> <summary>Creates a certificate owned by the caller, who must dispose it.</summary> </member> <member name="T:AdNoctem.Substrate.Security.AuthenticodeVerification"> <summary>Windows trust status and public signer evidence; an acceptable signer must still match the caller's publisher policy.</summary> </member> <member name="T:AdNoctem.Substrate.Security.AuthenticodeVerifier"> <summary>Windows Authenticode verification of embedded signatures, with no UI. Only an exact native success with signer evidence is trusted.</summary> <remarks>Does not search external catalogs. Revocation checking remains enabled in CacheOnly mode; unavailable evidence is a failure, not permission to bypass trust. Windows applies its Authenticode timestamp and trust policy. Verification does not execute the file. A result describes the file at observation time and is not reusable execution authorization.</remarks> </member> <member name="M:AdNoctem.Substrate.Security.AuthenticodeVerifier.Verify(AdNoctem.Substrate.IO.FileSystemPath,AdNoctem.Substrate.Security.SignatureNetworkAccess,System.Threading.CancellationToken)"> <summary>Evaluates Windows Authenticode trust under the selected network-access policy and retains signature evidence.</summary> </member> <member name="M:AdNoctem.Substrate.Security.AuthenticodeVerifier.VerifyAsync(AdNoctem.Substrate.IO.FileSystemPath,AdNoctem.Substrate.Security.SignatureNetworkAccess,System.Threading.CancellationToken)"> <summary>Offloads native signature verification; cancellation is observed at supported checkpoints.</summary> <remarks>Offloads the native call. Cancellation is checked before and after it; Windows trust-provider calls cannot be interrupted.</remarks> </member> <member name="T:AdNoctem.Substrate.Security.CertificateManager"> <summary>Read-only native certificate-store inventory. Returned certificates contain public data only.</summary> </member> <member name="M:AdNoctem.Substrate.Security.CertificateManager.GetCertificates(System.Security.Cryptography.X509Certificates.StoreLocation,System.String,System.String,System.Net.NetworkCredential,System.String,System.Threading.CancellationToken)"> <summary>Reads public certificate data from an explicitly selected local or remote store.</summary> <remarks>Remote access uses Windows certificate-store RPC/Remote Registry. Remote CurrentUser selects a loaded user hive by SID; it does not log on interactively or load a profile. Credentials are borrowed and used only for outbound authentication.</remarks> </member> <member name="M:AdNoctem.Substrate.Security.CertificateManager.GetCertificatesAsync(System.Security.Cryptography.X509Certificates.StoreLocation,System.String,System.String,System.Net.NetworkCredential,System.String,System.Threading.CancellationToken)"> <summary>Offloads certificate-store enumeration; an in-flight native RPC may outlast a cancellation request.</summary> <remarks>Native store RPC cannot be interrupted in flight; cancellation is checked between certificates.</remarks> </member> <member name="T:AdNoctem.Substrate.Security.StoredCredential"> <summary>Caller-owned credential. Dispose it after use; GetPassword returns a separate caller-owned secure copy.</summary> </member> <member name="M:AdNoctem.Substrate.Security.StoredCredential.GetPassword"> <summary>Returns an independent secure-string copy that the caller must dispose.</summary> <summary>Returns a caller-owned copy of the password; dispose it independently of this credential.</summary> </member> <member name="T:AdNoctem.Substrate.Security.CredentialFileManager"> <summary>Reads and writes the v1 AES credential/key format without a PowerShell runtime.</summary> <remarks>The legacy format is not authenticated encryption. Possession of both files permits decryption. Parents must be caller-controlled. Publishing two files is not transactional: a failure after key replacement requires recreating the pair.</remarks> </member> <member name="M:AdNoctem.Substrate.Security.CredentialFileManager.Write(AdNoctem.Substrate.IO.FileSystemPath,AdNoctem.Substrate.IO.FileSystemPath,System.String,System.Security.SecureString,System.Boolean)"> <summary>Writes a protected credential and key pair in the legacy format; replacing the pair is not atomic.</summary> </member> <member name="M:AdNoctem.Substrate.Security.CredentialFileManager.Read(AdNoctem.Substrate.IO.FileSystemPath,AdNoctem.Substrate.IO.FileSystemPath)"> <summary>Reads the credential pair and returns a caller-owned credential that must be disposed.</summary> </member> <member name="M:AdNoctem.Substrate.Security.CredentialFileManager.Encrypt(System.Security.SecureString,System.Byte[])"> <summary>Encodes a password using the supplied AES key and a fresh IV in the legacy unauthenticated envelope.</summary> </member> <member name="M:AdNoctem.Substrate.Security.CredentialFileManager.Decrypt(System.String,System.Byte[])"> <summary>Returns a caller-owned secure string. Rejects malformed or unsupported envelopes.</summary> </member> <member name="T:AdNoctem.Substrate.Security.DefenderThreat"> <summary>A detached Defender threat observation with its native identifier and current state.</summary> </member> <member name="T:AdNoctem.Substrate.Security.DefenderDetection"> <summary>A detached Defender detection record, distinct from proof that remediation succeeded.</summary> </member> <member name="T:AdNoctem.Substrate.Security.DefenderExclusions"> <summary>Observed Defender exclusion lists grouped by their native exclusion kind.</summary> </member> <member name="T:AdNoctem.Substrate.Security.DefenderManager"> <summary>Microsoft Defender inventory and explicit exclusion changes through its native provider. Does not elevate or change protection modes.</summary> </member> <member name="M:AdNoctem.Substrate.Security.DefenderManager.GetThreats(System.TimeSpan,System.Threading.CancellationToken)"> <summary>Reads Defender threat observations through its CIM provider.</summary> </member> <member name="M:AdNoctem.Substrate.Security.DefenderManager.GetThreatsAsync(System.TimeSpan,System.Threading.CancellationToken)"> <summary>Offloads threat inventory with a per-operation timeout.</summary> </member> <member name="M:AdNoctem.Substrate.Security.DefenderManager.GetDetections(System.TimeSpan,System.Nullable{System.DateTime},System.Threading.CancellationToken)"> <summary>Reads detection records, optionally filtering by initial detection time.</summary> </member> <member name="M:AdNoctem.Substrate.Security.DefenderManager.GetDetectionsAsync(System.TimeSpan,System.Nullable{System.DateTime},System.Threading.CancellationToken)"> <summary>Offloads detection inventory without changing Defender configuration.</summary> </member> <member name="M:AdNoctem.Substrate.Security.DefenderManager.GetStatus(System.TimeSpan,System.Threading.CancellationToken)"> <summary>Returns a detached record of Defender computer status.</summary> </member> <member name="M:AdNoctem.Substrate.Security.DefenderManager.GetStatusAsync(System.TimeSpan,System.Threading.CancellationToken)"> <summary>Offloads the Defender status query.</summary> </member> <member name="M:AdNoctem.Substrate.Security.DefenderManager.GetExclusions(System.TimeSpan,System.Threading.CancellationToken)"> <summary>Reads configured exclusion paths, processes, extensions, and IP addresses.</summary> </member> <member name="M:AdNoctem.Substrate.Security.DefenderManager.GetExclusionsAsync(System.TimeSpan,System.Threading.CancellationToken)"> <summary>Offloads exclusion inventory without modifying it.</summary> </member> <member name="M:AdNoctem.Substrate.Security.DefenderManager.AddExclusions(AdNoctem.Substrate.Security.DefenderExclusionKind,System.Collections.Generic.IEnumerable{System.String},System.TimeSpan,System.Threading.CancellationToken)"> <summary>Adds explicitly supplied exclusions of one kind and returns the native provider status.</summary> </member> <member name="M:AdNoctem.Substrate.Security.DefenderManager.RemoveExclusions(AdNoctem.Substrate.Security.DefenderExclusionKind,System.Collections.Generic.IEnumerable{System.String},System.TimeSpan,System.Threading.CancellationToken)"> <summary>Removes explicitly supplied exclusions of one kind and returns the native provider status.</summary> </member> <member name="M:AdNoctem.Substrate.Security.DefenderManager.AddExclusionsAsync(AdNoctem.Substrate.Security.DefenderExclusionKind,System.Collections.Generic.IEnumerable{System.String},System.TimeSpan,System.Threading.CancellationToken)"> <summary>Offloads the explicit exclusion addition; this can reduce protection for matching content.</summary> </member> <member name="M:AdNoctem.Substrate.Security.DefenderManager.RemoveExclusionsAsync(AdNoctem.Substrate.Security.DefenderExclusionKind,System.Collections.Generic.IEnumerable{System.String},System.TimeSpan,System.Threading.CancellationToken)"> <summary>Offloads removal of the selected exclusions.</summary> </member> <member name="M:AdNoctem.Substrate.Security.DefenderManager.GetThreatDescriptionUrl(System.String)"> <summary>Builds an escaped Microsoft threat-information URL without opening a browser or contacting the site.</summary> </member> <member name="M:AdNoctem.Substrate.Security.DefenderManager.ChangeExclusions(System.String,AdNoctem.Substrate.Security.DefenderExclusionKind,System.Collections.Generic.IEnumerable{System.String},System.TimeSpan,System.Threading.CancellationToken)"> <remarks>Returns the native provider code; zero reports success. Provider policies/tamper protection remain authoritative. Cancellation cannot undo changes already accepted by the provider.</remarks> </member> <member name="T:AdNoctem.Substrate.Security.DirectoryRoleHolders"> <summary>Observed domain and forest FSMO role holders.</summary> </member> <member name="T:AdNoctem.Substrate.Security.AccountLockout"> <summary>A directory account-lockout event with the observed caller and event timestamp.</summary> </member> <member name="T:AdNoctem.Substrate.Security.DirectoryManager"> <summary>Windows directory operations using the caller's identity unless a credential is explicitly supplied.</summary> <remarks>Directory bind calls are synchronous. Cancellation is checked between calls; async methods offload them. Caller credentials are borrowed for the duration of an operation.</remarks> </member> <member name="T:AdNoctem.Substrate.Security.WindowsEventSnapshot"> <summary>Detached event data and optional formatted message; message-formatting failures do not discard the raw event XML.</summary> </member> <member name="T:AdNoctem.Substrate.Security.EventLogReadSession"> <summary>Owns one native event reader. Use sequentially; concurrent reads or disposal are not supported.</summary> </member> <member name="M:AdNoctem.Substrate.Security.EventLogReadSession.ReadNextRecord(System.Threading.CancellationToken)"> <summary>Returns a caller-owned native record, or null at the end/limit. Dispose each returned record; keep a borrowed remote session alive while using it.</summary> </member> <member name="T:AdNoctem.Substrate.Security.EventLogManager"> <summary>Native Windows Event Log operations. A supplied session is borrowed; otherwise the caller's local identity is used.</summary> </member> <member name="M:AdNoctem.Substrate.Security.EventLogManager.ChannelExists(System.String)"> <summary>Only a missing channel returns false. Access and transport failures remain failures.</summary> </member> <member name="M:AdNoctem.Substrate.Security.EventLogManager.Read(AdNoctem.Substrate.Security.WindowsEventQuery,System.Boolean,System.Threading.CancellationToken)"> <summary>Reads at most the query's limit into detached snapshots and closes all native records/readers before returning.</summary> </member> <member name="M:AdNoctem.Substrate.Security.EventLogManager.ReadAsync(AdNoctem.Substrate.Security.WindowsEventQuery,System.Boolean,System.Threading.CancellationToken)"> <remarks>Offloads native reads and forwards cancellation to CancelReading. The caller must retain a borrowed session until completion.</remarks> </member> <member name="M:AdNoctem.Substrate.Security.EventLogManager.Export(AdNoctem.Substrate.Security.WindowsEventQuery,AdNoctem.Substrate.IO.FileSystemPath,System.Boolean,System.Threading.CancellationToken)"> <summary>Exports matching events to a sibling temporary EVTX, then publishes it. Does not clear or modify the source log.</summary> <remarks>Export includes all matching events; MaximumEvents and NewestFirst apply to reading, not export. Cancellation is checked before and after the synchronous export, not during it. The destination's parent must exist.</remarks> </member> <member name="T:AdNoctem.Substrate.Security.FileSecurityDescriptor"> <summary>A copied Windows security descriptor; returned binary or mutable forms do not mutate this instance.</summary> </member> <member name="T:AdNoctem.Substrate.Security.FileSecurityManager"> <summary>Native Windows file/directory security operations. Authority, privileges and link policy remain explicit caller responsibilities.</summary> </member> <member name="M:AdNoctem.Substrate.Security.FileSecurityManager.CreateFile(AdNoctem.Substrate.IO.FileSystemPath,AdNoctem.Substrate.Security.FileSecurityDescriptor)"> <summary>Creates a new file with its security applied before any bytes are written. The caller owns the stream; existing paths are refused.</summary> </member> <member name="M:AdNoctem.Substrate.Security.FileSecurityManager.Write(AdNoctem.Substrate.IO.FileSystemPath,AdNoctem.Substrate.Security.FileSecurityDescriptor,AdNoctem.Substrate.Security.FileSecurityParts,System.Nullable{System.Boolean})"> <summary>Writes only selected sections. Access-rule inheritance protection changes only when explicitly supplied.</summary> </member> <member name="M:AdNoctem.Substrate.Security.FileSecurityManager.CreateDirectory(AdNoctem.Substrate.IO.FileSystemPath,AdNoctem.Substrate.Security.FileSecurityDescriptor)"> <summary>Creates one new directory with its security descriptor applied at creation. The parent must exist; an existing destination is never changed.</summary> </member> <member name="T:AdNoctem.Substrate.Security.FirewallRuleInfo"> <summary>A detached observation of a Windows firewall rule and its selected profiles.</summary> </member> <member name="T:AdNoctem.Substrate.Security.FirewallManager"> <summary>Windows Firewall automation with explicit rule/profile selection. Does not elevate or enable a firewall profile.</summary> </member> <member name="M:AdNoctem.Substrate.Security.FirewallManager.SetEnabled(System.String,System.Boolean,AdNoctem.Substrate.Security.FirewallProfile,System.Threading.CancellationToken)"> <summary>Changes exact-name matches in the selected profiles, returning the number changed. Duplicate display names are all considered.</summary> </member> <member name="T:AdNoctem.Substrate.Security.OwnershipManager"> <summary>Explicit administrative ownership changes. Uses a temporary thread token and restores the caller's identity.</summary> <remarks>Changes are not transactional. Cancellation or failure preserves prior successful changes. Never deletes contents or follows filesystem reparse points.</remarks> </member> <member name="M:AdNoctem.Substrate.Security.OwnershipManager.SetFileOwner(AdNoctem.Substrate.IO.FileSystemPath,System.Security.Principal.SecurityIdentifier,System.Security.Principal.SecurityIdentifier,System.Boolean,System.IProgress{System.String},System.Threading.CancellationToken)"> <summary>Changes filesystem ownership and optionally grants full control to a selected SID, skipping reparse points.</summary> </member> <member name="M:AdNoctem.Substrate.Security.OwnershipManager.SetFileOwnerAsync(AdNoctem.Substrate.IO.FileSystemPath,System.Security.Principal.SecurityIdentifier,System.Security.Principal.SecurityIdentifier,System.Boolean,System.IProgress{System.String},System.Threading.CancellationToken)"> <summary>Offloads filesystem ownership changes; cancellation retains changes already made.</summary> </member> <member name="M:AdNoctem.Substrate.Security.OwnershipManager.SetRegistryOwner(AdNoctem.Substrate.Registry.RegistryPath,System.Security.Principal.SecurityIdentifier,System.Boolean,System.Boolean,AdNoctem.Substrate.Registry.RegistryManager,System.IProgress{AdNoctem.Substrate.Registry.RegistryPath},System.Threading.CancellationToken)"> <summary>Changes registry ownership, optionally recursively and with a full-control grant to the owner.</summary> </member> <member name="M:AdNoctem.Substrate.Security.OwnershipManager.SetRegistryOwnerAsync(AdNoctem.Substrate.Registry.RegistryPath,System.Security.Principal.SecurityIdentifier,System.Boolean,System.Boolean,AdNoctem.Substrate.Registry.RegistryManager,System.IProgress{AdNoctem.Substrate.Registry.RegistryPath},System.Threading.CancellationToken)"> <summary>Offloads registry ownership changes while preserving the caller's identity after temporary privilege use.</summary> </member> <member name="T:AdNoctem.Substrate.Security.SecurityEventDefinition"> <summary>A known event identifier with its log, provider, and optional classification.</summary> </member> <member name="T:AdNoctem.Substrate.Security.SecurityEventCatalog"> <summary>Immutable semantic event definitions. Configuration formats and PowerShell field bags remain outside the library.</summary> </member> <member name="M:AdNoctem.Substrate.Security.SecurityEventCatalog.Load(System.IO.Stream)"> <summary>Reads event definitions from a JSON array. The caller retains ownership of the stream.</summary> </member> <member name="M:AdNoctem.Substrate.Security.SecurityEventCatalog.CreateQueries(System.Collections.Generic.IEnumerable{AdNoctem.Substrate.Security.SecurityEventDefinition},System.Nullable{System.DateTimeOffset},System.Nullable{System.DateTimeOffset},System.Int32)"> <summary>Creates separate channel/provider queries so IDs from one provider cannot accidentally match another provider.</summary> </member> <member name="T:AdNoctem.Substrate.Security.WindowsEventFieldFilter"> <summary>Matches any supplied field against any supplied value. Negation excludes that match; regex work has a finite per-match timeout.</summary> </member> <member name="T:AdNoctem.Substrate.Security.WindowsEventFilter"> <summary>Combines event identity and named-field predicates against detached event data.</summary> </member> <member name="T:AdNoctem.Substrate.Security.WindowsEventField"> <summary>One named value observed in an event payload; duplicate field names can be retained.</summary> </member> <member name="T:AdNoctem.Substrate.Security.WindowsEventPayload"> <summary>Parsed EventData and UserData fields with their names and values preserved.</summary> </member> <member name="M:AdNoctem.Substrate.Security.WindowsEventPayload.Parse(System.String)"> <summary>Parses bounded event XML without DTDs or external entities. Keeps unnamed and repeated fields in source order.</summary> </member> <member name="M:AdNoctem.Substrate.Security.WindowsEventPayload.GetValue(System.String,System.StringComparison)"> <summary>Returns the first matching named event value using the specified string comparison.</summary> </member> <member name="T:AdNoctem.Substrate.Security.WindowsEventQuery"> <summary>A bounded event query for a live channel or saved file, with explicit ordering and time filters.</summary> </member> <member name="M:AdNoctem.Substrate.Security.WindowsEventQuery.ToQueryXml"> <summary>Builds a structured query, splitting large ID lists to stay within Windows Event Log's per-selector expression limit.</summary> </member> <member name="T:AdNoctem.Substrate.Security.WmiPersistenceReadError"> <summary>A WMI subscription class whose inventory failed, together with the underlying error.</summary> </member> <member name="T:AdNoctem.Substrate.Security.WmiPersistenceInventory"> <summary>Permanent subscription filters, consumers, and bindings; retained errors indicate incomplete evidence.</summary> </member> <member name="T:AdNoctem.Substrate.Security.WmiPersistenceManager"> <summary>Read-only inventory of permanent WMI subscriptions. Presence is evidence of a subscription, not proof of malicious activity.</summary> </member> <member name="M:AdNoctem.Substrate.Security.WmiPersistenceManager.Read(System.TimeSpan,System.Boolean,System.Threading.CancellationToken)"> <summary>Reads permanent event filters, consumers, and bindings; optional continuation retains class-specific CIM failures.</summary> </member> <member name="M:AdNoctem.Substrate.Security.WmiPersistenceManager.ReadAsync(System.TimeSpan,System.Boolean,System.Threading.CancellationToken)"> <summary>Offloads subscription inventory without modifying or deleting persistence entries.</summary> </member> </members> </doc> |