Active Directory
Active Directory local: Kerberos, ACL y delegación, servicios de certificados, directivas de grupo, confianzas, cuentas privilegiadas, política de contraseñas y protección de Tier 0.
- Comando
Invoke-ADAudit- comprobaciones
- 211
- Familias de comprobaciones
- 15
| Familia | Comprobaciones |
|---|---|
| AD ACL & Delegation | 16 |
| AD Adversary Tradecraft Indicators | 10 |
| AD Certificate Services | 19 |
| AD Domain & Forest Configuration | 20 |
| AD Group Policy | 24 |
| AD Kerberos Security | 11 |
| AD Logging & EDR Posture | 7 |
| AD Logon Scripts & Network Shares | 11 |
| AD Network & Relay Preconditions | 10 |
| AD Password & Lockout Policies | 22 |
| AD Privileged Account Security | 30 |
| AD Stale & Obsolete Objects | 11 |
| AD Trust Relationships | 11 |
| Attack Paths | 2 |
| Tier-0 Hygiene & Hybrid Identity Surface | 7 |
AD ACL & Delegation (16)
- ADACL-001: Critical Object ACL Audit Critical
- ADACL-002: GenericAll Permissions on Critical Objects Critical
- ADACL-003: GenericWrite Permissions on Critical Objects High
- ADACL-004: WriteDACL Permissions on Critical Objects Critical
- ADACL-005: WriteOwner Permissions on Critical Objects Critical
- ADACL-006: ForceChangePassword Rights High
- ADACL-007: Excessive Delegation to Broad Groups Critical
- ADACL-008: OU Delegation Analysis Medium
- ADACL-009: Machine Account Quota High
- ADACL-010: Extended Rights Audit Critical
- ADACL-011: Ownership of Critical Objects High
- ADACL-012: Non-Default Domain Root Permissions High
- ADACL-013: GPO Link Permissions High
- ADACL-014: GPO Edit Permissions High
- ADACL-015: Shadow Admins Detection Critical
- ADACL-016: Attack Path Enumeration Critical
AD Adversary Tradecraft Indicators (10)
- ADTRADE-001: Group Policy Preferences cpassword Leftovers in SYSVOL Critical
- ADTRADE-002: DCShadow Indicator (Rogue Configuration-Partition Servers) High
- ADTRADE-003: Stale BitLocker Recovery Keys Medium
- ADTRADE-004: RODC Password Replication Policy Hygiene High
- ADTRADE-005: Entra Seamless SSO Computer Account (AZUREADSSOACC$) Key Rotation High
- ADTRADE-006: Shadow Credentials (msDS-KeyCredentialLink) on Privileged Principals Critical
- ADTRADE-007: BadSuccessor dMSA Migration Escalation Surface Critical
- ADTRADE-008: Key Admins / Enterprise Key Admins Group Membership High
- ADTRADE-009: Cert Publishers Group Membership High
- ADTRADE-010: group Managed Service Account (gMSA) Posture & Password Exposure High
AD Certificate Services (19)
- ADCS-001: CA Server Inventory Info
- ADCS-002: ESC1 - Enrollee Supplies Subject Alternative Name Critical
- ADCS-003: ESC2 - Any Purpose Extended Key Usage Critical
- ADCS-004: ESC3 - Enrollment Agent Template Abuse Condition 1 High
- ADCS-005: ESC3 - Enrollment Agent Template Abuse Condition 2 High
- ADCS-006: ESC4 - Vulnerable Certificate Template ACLs Critical
- ADCS-007: ESC4 - Vulnerable Certificate Template Ownership Critical
- ADCS-008: ESC5 - Vulnerable PKI Object ACLs High
- ADCS-009: ESC6 - EDITF_ATTRIBUTESUBJECTALTNAME2 Flag Critical
- ADCS-010: ESC7 - Vulnerable CA ACLs Critical
- ADCS-011: ESC8 - NTLM Relay to AD CS HTTP Endpoints Critical
- ADCS-012: ESC9 - No Security Extension High
- ADCS-013: ESC11 - RPC Relay Without Encryption High
- ADCS-014: ESC13 - Issuance Policy OID Group Link High
- ADCS-015: ESC15 - Application Policies in Schema v1 Templates Medium
- ADCS-016: ESC16 - UPN SAN Misconfiguration High
- ADCS-017: EKEUwu - Extended Key Usage Abuse High
- ADCS-018: CA Auditing Configuration High
- ADCS-019: Certificate Template Enumeration Info
AD Domain & Forest Configuration (20)
- ADDOM-001: Forest Functional Level High
- ADDOM-002: Domain Functional Level High
- ADDOM-003: Schema Version Identification Medium
- ADDOM-004: Domain Controller Inventory High
- ADDOM-005: Obsolete OS on Domain Controllers Critical
- ADDOM-006: FSMO Role Holder Identification Info
- ADDOM-007: AD Replication Health High
- ADDOM-008: Tombstone Lifetime Configuration Medium
- ADDOM-009: AD Recycle Bin Status Medium
- ADDOM-010: Sites and Subnets Configuration Medium
- ADDOM-011: Site Link Configuration Low
- ADDOM-012: DNS Zone Security High
- ADDOM-013: LDAP Signing Requirements Critical
- ADDOM-014: LDAP Channel Binding High
- ADDOM-015: SMB Signing Requirements Critical
- ADDOM-016: NTLMv1 Usage Detection Critical
- ADDOM-017: NTLMv2 Enforcement High
- ADDOM-018: Null Session Enumeration High
- ADDOM-019: Print Spooler on Domain Controllers High
- ADDOM-020: DSRM Password Configuration Medium
AD Group Policy (24)
- ADGPO-001: GPO Inventory with Link Status Info
- ADGPO-002: Empty GPOs Low
- ADGPO-003: Unlinked GPOs Low
- ADGPO-004: Disabled GPOs with Content Low
- ADGPO-005: Duplicated GPOs Low
- ADGPO-006: GPOs with Broken Links Medium
- ADGPO-007: GPO Permission Inconsistencies High
- ADGPO-008: GPOs Not Applied Due to WMI Filters Medium
- ADGPO-009: GPOs with No Apply Permission Medium
- ADGPO-010: SYSVOL/AD GPO Version Mismatch Medium
- ADGPO-011: GPO Settings Security Analysis High
- ADGPO-012: cPassword/GPP Password Detection Critical
- ADGPO-013: Scripts in GPOs Analysis High
- ADGPO-014: MSI Packages in GPOs Medium
- ADGPO-015: Scheduled Tasks in GPOs High
- ADGPO-016: Registry Settings Security Review Medium
- ADGPO-017: Restricted Groups Analysis High
- ADGPO-018: Audit Policy Configuration via GPO High
- ADGPO-019: Windows Firewall Configuration via GPO Medium
- ADGPO-020: PowerShell Execution Policy via GPO Medium
- ADGPO-021: PowerShell Logging Configuration High
- ADGPO-022: AppLocker/WDAC Policy Assessment Medium
- ADGPO-023: LAPS GPO Configuration High
- ADGPO-024: GPO WMI Filter Review Low
AD Kerberos Security (11)
- ADKERB-001: Kerberoastable Accounts High
- ADKERB-002: Kerberoastable with Weak Encryption Critical
- ADKERB-003: AS-REP Roastable Accounts High
- ADKERB-004: Unconstrained Delegation - Computers Critical
- ADKERB-005: Unconstrained Delegation - Users Critical
- ADKERB-006: Constrained Delegation Analysis High
- ADKERB-007: Resource-Based Constrained Delegation High
- ADKERB-008: Protocol Transition Abuse Paths High
- ADKERB-009: Kerberos Encryption Types High
- ADKERB-010: Kerberos Ticket Lifetime Medium
- ADKERB-011: Computer SPN Audit Info
AD Logging & EDR Posture (7)
- ADLOG-001: Advanced Audit Policy Configured High
- ADLOG-002: PowerShell Script Block Logging Enabled High
- ADLOG-003: PowerShell Module Logging Enabled Medium
- ADLOG-004: Process Creation Auditing with Command Line High
- ADLOG-005: Microsoft Defender Tamper Protection Policy High
- ADLOG-006: Windows Event Forwarding (WEF) Subscription Manager High
- ADLOG-007: Sysmon Deployment Indicator Medium
AD Logon Scripts & Network Shares (11)
- ADSCRIPT-001: NETLOGON Share Permissions High
- ADSCRIPT-002: SYSVOL Share Permissions High
- ADSCRIPT-003: Logon Script Inventory Info
- ADSCRIPT-004: Hardcoded Credentials in Scripts Critical
- ADSCRIPT-005: LOLBins Usage in Scripts High
- ADSCRIPT-006: Plaintext Passwords in Scripts Critical
- ADSCRIPT-007: World-Writable Script Permissions Critical
- ADSCRIPT-008: External Resource References High
- ADSCRIPT-009: Malformed Scripts Medium
- ADSCRIPT-010: UNC Paths to Non-DC Locations High
- ADSCRIPT-011: Script Content Analysis Medium
AD Network & Relay Preconditions (10)
- ADNET-001: LDAP Signing Required on Domain Controllers Critical
- ADNET-002: LDAP Channel Binding Enforced on Domain Controllers High
- ADNET-003: SMB Server Signing Required (Domain Policy) Critical
- ADNET-004: SMB Client Signing Required (Domain Policy) High
- ADNET-005: LLMNR Disabled by Domain Policy High
- ADNET-006: NetBIOS over TCP/IP Configuration Reviewed Medium
- ADNET-007: IPv6 mitm6 Mitigation Posture High
- ADNET-008: WPAD Auto-Discovery Disabled Medium
- ADNET-009: Print Spooler Service on Domain Controllers Critical
- ADNET-010: WebClient Service Default State on Workstations High
AD Password & Lockout Policies (22)
- ADPWD-001: Default Domain Password Policy High
- ADPWD-002: Fine-Grained Password Policy Enumeration Medium
- ADPWD-003: FGPP Application Analysis Medium
- ADPWD-004: Minimum Password Length High
- ADPWD-005: Password Complexity Requirement High
- ADPWD-006: Account Lockout Policy High
- ADPWD-007: Password History Enforcement Medium
- ADPWD-008: Maximum Password Age Medium
- ADPWD-009: Users with Password Never Expires High
- ADPWD-010: Users with Blank Passwords Critical
- ADPWD-011: Duplicate Password Hashes High
- ADPWD-012: Passwords in HaveIBeenPwned Database High
- ADPWD-013: Custom Dictionary Password Check Medium
- ADPWD-014: Default/Common Passwords High
- ADPWD-015: Password Last Set Age Distribution Medium
- ADPWD-016: LAPS Deployment Status High
- ADPWD-017: LAPS Password Expiration Medium
- ADPWD-018: Windows LAPS vs Legacy LAPS Low
- ADPWD-019: Azure AD Password Protection Medium
- ADPWD-020: BitLocker Recovery Keys in AD Info
- ADPWD-021: Account Lockout Threshold High
- ADPWD-022: Lockout Observation Window Medium
AD Privileged Account Security (30)
- ADPRIV-001: Domain Admins Enumeration Critical
- ADPRIV-002: Enterprise Admins Enumeration Critical
- ADPRIV-003: Schema Admins Enumeration High
- ADPRIV-004: Account Operators Enumeration High
- ADPRIV-005: Server Operators Enumeration High
- ADPRIV-006: Backup Operators Enumeration High
- ADPRIV-007: Print Operators Enumeration Medium
- ADPRIV-008: DnsAdmins Group Membership High
- ADPRIV-009: Nested Group Membership Analysis High
- ADPRIV-010: Privileged Users Password Never Expires Critical
- ADPRIV-011: Privileged Users Password Not Required Critical
- ADPRIV-012: Privileged Users No Kerberos Pre-Auth Critical
- ADPRIV-013: Privileged Users Reversible Encryption Critical
- ADPRIV-014: Privileged Users DES-Only Kerberos High
- ADPRIV-015: Privileged Accounts No MFA Indicator High
- ADPRIV-016: Privileged Accounts Weak Passwords Critical
- ADPRIV-017: Privileged Accounts Old Passwords High
- ADPRIV-018: Privileged Accounts Never Logged In Medium
- ADPRIV-019: Disabled Accounts in Privileged Groups High
- ADPRIV-020: AdminSDHolder Protected Object Audit Critical
- ADPRIV-021: AdminCount Orphans Medium
- ADPRIV-022: krbtgt Password Age Critical
- ADPRIV-023: krbtgt Account Exposure Assessment Critical
- ADPRIV-024: Service Accounts in Privileged Groups High
- ADPRIV-025: Computer Accounts in Privileged Groups High
- ADPRIV-026: Privileged Users Local Logon on DCs High
- ADPRIV-027: Privileged Users RDP on DCs High
- ADPRIV-028: Users with DCSync Rights Critical
- ADPRIV-029: Protected Users Group Audit High
- ADPRIV-030: Privileged Users Not in Protected Users High
AD Stale & Obsolete Objects (11)
- ADSTALE-001: Inactive User Accounts Medium
- ADSTALE-002: Inactive Computer Accounts Medium
- ADSTALE-003: Disabled Accounts with Group Memberships Medium
- ADSTALE-004: Expired Passwords Not Disabled Medium
- ADSTALE-005: Obsolete OS Computers High
- ADSTALE-006: Unsupported OS Versions High
- ADSTALE-007: Orphaned Foreign Security Principals Medium
- ADSTALE-008: Orphaned SID History Medium
- ADSTALE-009: Abandoned OUs Low
- ADSTALE-010: Printer Objects Low
- ADSTALE-011: DNS Record Staleness Medium
AD Trust Relationships (11)
- ADTRUST-001: Trust Relationships Enumeration Info
- ADTRUST-002: Trust Direction Analysis Medium
- ADTRUST-003: Trust Transitivity Analysis Medium
- ADTRUST-004: SID Filtering Status Critical
- ADTRUST-005: SID History Abuse Detection Critical
- ADTRUST-006: Selective Authentication Status High
- ADTRUST-007: Azure AD Hybrid Trust Security Medium
- ADTRUST-008: Foreign Domain Trust Enumeration Medium
- ADTRUST-009: Orphaned Trust Detection Medium
- ADTRUST-010: Trust Key Age and Rotation High
- ADTRUST-011: Trust Hierarchy Visualization Info
Attack Paths (2)
Tier-0 Hygiene & Hybrid Identity Surface (7)
- ADTIER-001: Azure AD Connect Sync Account (MSOL_) Audit Critical
- ADTIER-002: Backup Software Service Accounts in Privileged Groups Critical
- ADTIER-003: Hypervisor / Virtualization Service Accounts in Privileged Groups High
- ADTIER-004: Configuration Management Service Accounts in Privileged Groups Critical
- ADTIER-005: SQL / Database Service Accounts in Privileged Groups High
- ADTIER-006: Tier-0 Admin Accounts Outside a Dedicated Tier-0 OU High
- ADTIER-007: Service Accounts with Interactive Logon Rights via Privileged Group High