Active Directory
Active Directory local: Kerberos, ACL y delegación, servicios de certificados, directivas de grupo, confianzas, cuentas privilegiadas, política de contraseñas y protección de Tier 0.
- Comando
Invoke-ADAudit- comprobaciones
- 211
- Familias de comprobaciones
- 15
| Familia | Comprobaciones |
|---|---|
| AD ACL & Delegation | 16 |
| AD Adversary Tradecraft Indicators | 10 |
| AD Certificate Services | 19 |
| AD Domain & Forest Configuration | 20 |
| AD Group Policy | 24 |
| AD Kerberos Security | 11 |
| AD Logging & EDR Posture | 7 |
| AD Logon Scripts & Network Shares | 11 |
| AD Network & Relay Preconditions | 10 |
| AD Password & Lockout Policies | 22 |
| AD Privileged Account Security | 30 |
| AD Stale & Obsolete Objects | 11 |
| AD Trust Relationships | 11 |
| Attack Paths | 2 |
| Tier-0 Hygiene & Hybrid Identity Surface | 7 |
AD ACL & Delegation (16)
- ADACL-001: Critical Object ACL Audit Critical
- ADACL-002: GenericAll Permissions on Critical Objects Critical
- ADACL-003: GenericWrite Permissions on Critical Objects High
- ADACL-004: WriteDACL Permissions on Critical Objects Critical
- ADACL-005: WriteOwner Permissions on Critical Objects Critical
- ADACL-006: ForceChangePassword Rights High
- ADACL-007: Excessive Delegation to Broad Groups Critical
- ADACL-008: OU Delegation Analysis Medium
- ADACL-009: Machine Account Quota High
- ADACL-010: Extended Rights Audit Critical
- ADACL-011: Ownership of Critical Objects High
- ADACL-012: Non-Default Domain Root Permissions High
- ADACL-013: GPO Link Permissions High
- ADACL-014: GPO Edit Permissions High
- ADACL-015: Shadow Admins Detection Critical
- ADACL-016: Attack Path Enumeration Critical
AD Adversary Tradecraft Indicators (10)
- ADTRADE-001: Group Policy Preferences cpassword Leftovers in SYSVOL Critical
- ADTRADE-002: DCShadow Indicator (Rogue Configuration-Partition Servers) High
- ADTRADE-003: Stale BitLocker Recovery Keys Medium
- ADTRADE-004: RODC Password Replication Policy Hygiene High
- ADTRADE-005: Entra Seamless SSO Computer Account (AZUREADSSOACC$) Key Rotation High
- ADTRADE-006: Shadow Credentials (msDS-KeyCredentialLink) on Privileged Principals Critical
- ADTRADE-007: BadSuccessor dMSA Migration Escalation Surface Critical
- ADTRADE-008: Key Admins / Enterprise Key Admins Group Membership High
- ADTRADE-009: Cert Publishers Group Membership High
- ADTRADE-010: group Managed Service Account (gMSA) Posture & Password Exposure High
AD Certificate Services (19)
- ADCS-001: CA Server Inventory Info
- ADCS-002: ESC1 - Enrollee Supplies Subject Alternative Name Critical
- ADCS-003: ESC2 - Any Purpose Extended Key Usage Critical
- ADCS-004: ESC3 - Enrollment Agent Template Abuse Condition 1 High
- ADCS-005: ESC3 - Enrollment Agent Template Abuse Condition 2 High
- ADCS-006: ESC4 - Vulnerable Certificate Template ACLs Critical
- ADCS-007: ESC4 - Vulnerable Certificate Template Ownership Critical
- ADCS-008: ESC5 - Vulnerable PKI Object ACLs High
- ADCS-009: ESC6 - EDITF_ATTRIBUTESUBJECTALTNAME2 Flag Critical
- ADCS-010: ESC7 - Vulnerable CA ACLs Critical
- ADCS-011: ESC8 - NTLM Relay to AD CS HTTP Endpoints Critical
- ADCS-012: ESC9 - No Security Extension High
- ADCS-013: ESC11 - RPC Relay Without Encryption High
- ADCS-014: ESC13 - Issuance Policy OID Group Link High
- ADCS-015: ESC15 - Application Policies in Schema v1 Templates Medium
- ADCS-016: ESC16 - UPN SAN Misconfiguration High
- ADCS-017: EKEUwu - Extended Key Usage Abuse High
- ADCS-018: CA Auditing Configuration High
- ADCS-019: Certificate Template Enumeration Info
AD Domain & Forest Configuration (20)
- ADDOM-001: Forest Functional Level High
- ADDOM-002: Domain Functional Level High
- ADDOM-003: Schema Version Identification Medium
- ADDOM-004: Domain Controller Inventory High
- ADDOM-005: Obsolete OS on Domain Controllers Critical
- ADDOM-006: FSMO Role Holder Identification Info
- ADDOM-007: AD Replication Health High
- ADDOM-008: Tombstone Lifetime Configuration Medium
- ADDOM-009: AD Recycle Bin Status Medium
- ADDOM-010: Sites and Subnets Configuration Medium
- ADDOM-011: Site Link Configuration Low
- ADDOM-012: DNS Zone Security High
- ADDOM-013: LDAP Signing Requirements Critical
- ADDOM-014: LDAP Channel Binding High
- ADDOM-015: SMB Signing Requirements Critical
- ADDOM-016: NTLMv1 Usage Detection Critical
- ADDOM-017: NTLMv2 Enforcement High
- ADDOM-018: Null Session Enumeration High
- ADDOM-019: Print Spooler on Domain Controllers High
- ADDOM-020: DSRM Password Configuration Medium
AD Group Policy (24)
- ADGPO-001: GPO Inventory with Link Status Info
- ADGPO-002: Empty GPOs Low
- ADGPO-003: Unlinked GPOs Low
- ADGPO-004: Disabled GPOs with Content Low
- ADGPO-005: Duplicated GPOs Low
- ADGPO-006: GPOs with Broken Links Medium
- ADGPO-007: GPO Permission Inconsistencies High
- ADGPO-008: GPOs Not Applied Due to WMI Filters Medium
- ADGPO-009: GPOs with No Apply Permission Medium
- ADGPO-010: SYSVOL/AD GPO Version Mismatch Medium
- ADGPO-011: GPO Settings Security Analysis High
- ADGPO-012: cPassword/GPP Password Detection Critical
- ADGPO-013: Scripts in GPOs Analysis High
- ADGPO-014: MSI Packages in GPOs Medium
- ADGPO-015: Scheduled Tasks in GPOs High
- ADGPO-016: Registry Settings Security Review Medium
- ADGPO-017: Restricted Groups Analysis High
- ADGPO-018: Audit Policy Configuration via GPO High
- ADGPO-019: Windows Firewall Configuration via GPO Medium
- ADGPO-020: PowerShell Execution Policy via GPO Medium
- ADGPO-021: PowerShell Logging Configuration High
- ADGPO-022: AppLocker/WDAC Policy Assessment Medium
- ADGPO-023: LAPS GPO Configuration High
- ADGPO-024: GPO WMI Filter Review Low
AD Kerberos Security (11)
- ADKERB-001: Kerberoastable Accounts High
- ADKERB-002: Kerberoastable with Weak Encryption Critical
- ADKERB-003: AS-REP Roastable Accounts High
- ADKERB-004: Unconstrained Delegation - Computers Critical
- ADKERB-005: Unconstrained Delegation - Users Critical
- ADKERB-006: Constrained Delegation Analysis High
- ADKERB-007: Resource-Based Constrained Delegation High
- ADKERB-008: Protocol Transition Abuse Paths High
- ADKERB-009: Kerberos Encryption Types High
- ADKERB-010: Kerberos Ticket Lifetime Medium
- ADKERB-011: Computer SPN Audit Info
AD Logging & EDR Posture (7)
- ADLOG-001: Advanced Audit Policy Configured High
- ADLOG-002: PowerShell Script Block Logging Enabled High
- ADLOG-003: PowerShell Module Logging Enabled Medium
- ADLOG-004: Process Creation Auditing with Command Line High
- ADLOG-005: Microsoft Defender Tamper Protection Policy High
- ADLOG-006: Windows Event Forwarding (WEF) Subscription Manager High
- ADLOG-007: Sysmon Deployment Indicator Medium
AD Logon Scripts & Network Shares (11)
- ADSCRIPT-001: NETLOGON Share Permissions High
- ADSCRIPT-002: SYSVOL Share Permissions High
- ADSCRIPT-003: Logon Script Inventory Info
- ADSCRIPT-004: Hardcoded Credentials in Scripts Critical
- ADSCRIPT-005: LOLBins Usage in Scripts High
- ADSCRIPT-006: Plaintext Passwords in Scripts Critical
- ADSCRIPT-007: World-Writable Script Permissions Critical
- ADSCRIPT-008: External Resource References High
- ADSCRIPT-009: Malformed Scripts Medium
- ADSCRIPT-010: UNC Paths to Non-DC Locations High
- ADSCRIPT-011: Script Content Analysis Medium
AD Network & Relay Preconditions (10)
- ADNET-001: LDAP Signing Required on Domain Controllers Critical
- ADNET-002: LDAP Channel Binding Enforced on Domain Controllers High
- ADNET-003: SMB Server Signing Required (Domain Policy) Critical
- ADNET-004: SMB Client Signing Required (Domain Policy) High
- ADNET-005: LLMNR Disabled by Domain Policy High
- ADNET-006: NetBIOS over TCP/IP Configuration Reviewed Medium
- ADNET-007: IPv6 mitm6 Mitigation Posture High
- ADNET-008: WPAD Auto-Discovery Disabled Medium
- ADNET-009: Print Spooler Service on Domain Controllers Critical
- ADNET-010: WebClient Service Default State on Workstations High
AD Password & Lockout Policies (22)
- ADPWD-001: Default Domain Password Policy High
- ADPWD-002: Fine-Grained Password Policy Enumeration Medium
- ADPWD-003: FGPP Application Analysis Medium
- ADPWD-004: Minimum Password Length High
- ADPWD-005: Password Complexity Requirement High
- ADPWD-006: Account Lockout Policy High
- ADPWD-007: Password History Enforcement Medium
- ADPWD-008: Maximum Password Age Medium
- ADPWD-009: Users with Password Never Expires High
- ADPWD-010: Users with Blank Passwords Critical
- ADPWD-011: Duplicate Password Hashes High
- ADPWD-012: Passwords in HaveIBeenPwned Database High
- ADPWD-013: Custom Dictionary Password Check Medium
- ADPWD-014: Default/Common Passwords High
- ADPWD-015: Password Last Set Age Distribution Medium
- ADPWD-016: LAPS Deployment Status High
- ADPWD-017: LAPS Password Expiration Medium
- ADPWD-018: Windows LAPS vs Legacy LAPS Low
- ADPWD-019: Azure AD Password Protection Medium
- ADPWD-020: BitLocker Recovery Keys in AD Info
- ADPWD-021: Account Lockout Threshold High
- ADPWD-022: Lockout Observation Window Medium
AD Privileged Account Security (30)
- ADPRIV-001: Domain Admins Enumeration Critical
- ADPRIV-002: Enterprise Admins Enumeration Critical
- ADPRIV-003: Schema Admins Enumeration High
- ADPRIV-004: Account Operators Enumeration High
- ADPRIV-005: Server Operators Enumeration High
- ADPRIV-006: Backup Operators Enumeration High
- ADPRIV-007: Print Operators Enumeration Medium
- ADPRIV-008: DnsAdmins Group Membership High
- ADPRIV-009: Nested Group Membership Analysis High
- ADPRIV-010: Privileged Users Password Never Expires Critical
- ADPRIV-011: Privileged Users Password Not Required Critical
- ADPRIV-012: Privileged Users No Kerberos Pre-Auth Critical
- ADPRIV-013: Privileged Users Reversible Encryption Critical
- ADPRIV-014: Privileged Users DES-Only Kerberos High
- ADPRIV-015: Privileged Accounts No MFA Indicator High
- ADPRIV-016: Privileged Accounts Weak Passwords Critical
- ADPRIV-017: Privileged Accounts Old Passwords High
- ADPRIV-018: Privileged Accounts Never Logged In Medium
- ADPRIV-019: Disabled Accounts in Privileged Groups High
- ADPRIV-020: AdminSDHolder Protected Object Audit Critical
- ADPRIV-021: AdminCount Orphans Medium
- ADPRIV-022: krbtgt Password Age Critical
- ADPRIV-023: krbtgt Account Exposure Assessment Critical
- ADPRIV-024: Service Accounts in Privileged Groups High
- ADPRIV-025: Computer Accounts in Privileged Groups High
- ADPRIV-026: Privileged Users Local Logon on DCs High
- ADPRIV-027: Privileged Users RDP on DCs High
- ADPRIV-028: Users with DCSync Rights Critical
- ADPRIV-029: Protected Users Group Audit High
- ADPRIV-030: Privileged Users Not in Protected Users High
AD Stale & Obsolete Objects (11)
- ADSTALE-001: Inactive User Accounts Medium
- ADSTALE-002: Inactive Computer Accounts Medium
- ADSTALE-003: Disabled Accounts with Group Memberships Medium
- ADSTALE-004: Expired Passwords Not Disabled Medium
- ADSTALE-005: Obsolete OS Computers High
- ADSTALE-006: Unsupported OS Versions High
- ADSTALE-007: Orphaned Foreign Security Principals Medium
- ADSTALE-008: Orphaned SID History Medium
- ADSTALE-009: Abandoned OUs Low
- ADSTALE-010: Printer Objects Low
- ADSTALE-011: DNS Record Staleness Medium
AD Trust Relationships (11)
- ADTRUST-001: Trust Relationships Enumeration Info
- ADTRUST-002: Trust Direction Analysis Medium
- ADTRUST-003: Trust Transitivity Analysis Medium
- ADTRUST-004: SID Filtering Status Critical
- ADTRUST-005: SID History Abuse Detection Critical
- ADTRUST-006: Selective Authentication Status High
- ADTRUST-007: Azure AD Hybrid Trust Security Medium
- ADTRUST-008: Foreign Domain Trust Enumeration Medium
- ADTRUST-009: Orphaned Trust Detection Medium
- ADTRUST-010: Trust Key Age and Rotation High
- ADTRUST-011: Trust Hierarchy Visualization Info
Attack Paths (2)
Tier-0 Hygiene & Hybrid Identity Surface (7)
- ADTIER-001: Azure AD Connect Sync Account (MSOL_) Audit Critical
- ADTIER-002: Backup Software Service Accounts in Privileged Groups Critical
- ADTIER-003: Hypervisor / Virtualization Service Accounts in Privileged Groups High
- ADTIER-004: Configuration Management Service Accounts in Privileged Groups Critical
- ADTIER-005: SQL / Database Service Accounts in Privileged Groups High
- ADTIER-006: Tier-0 Admin Accounts Outside a Dedicated Tier-0 OU High
- ADTIER-007: Service Accounts with Interactive Logon Rights via Privileged Group High
Cero analítica. Cero rastreo. Cero cookies. Este sitio no hace ninguna petición externa, así que no hay nada que consentir.
Guerrilla es gratuito y de código abierto. · Validación
Guerrilla is written and maintained by Jim Tyler. This copy lives on jimtyler.org; the project also publishes at guerrilla.army.