SePrivilegeObjectAuditAlarm
VOID __stdcall SePrivilegeObjectAuditAlarm(
PVOID Handle,
_SECURITY_SUBJECT_CONTEXT *SubjectSecurityContext,
UINT64 DesiredAccess,
_PRIVILEGE_SET *Privileges,
UINT8 AccessGranted,
CHAR AccessMode){
UINT64 v6;
if( AccessMode )
{
LODWORD(v6) = DesiredAccess;
SepAdtPrivilegeObjectAuditAlarm(
(_UNICODE_STRING *)&SeSubsystemName,
0i64,
0i64,
Handle,
(_TOKEN *)SubjectSecurityContext->ClientToken,
(_TOKEN *)SubjectSecurityContext->PrimaryToken,
SubjectSecurityContext->ProcessAuditId,
v6,
Privileges,
AccessGranted);
}
}Referenced by:
ObpCreateHandle
PspCreateObjectHandle
SeCheckPrivilegedObject