@etcsec-com/etc-collector 1.4.0

package/dist/services/audit/attack-graph.service.js

@@ -0,0 +1,702 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AttackGraphService = void 0;
+exports.computeAttackGraph = computeAttackGraph;
+const attack_graph_types_1 = require("../../types/attack-graph.types");
+const logger_1 = require("../../utils/logger");
+class AttackGraphService {
+    users;
+    groups;
+    computers;
+    aclEntries;
+    nodes = new Map();
+    edges = new Map();
+    reverseEdges = new Map();
+    privilegedTargets = new Map();
+    dnToId = new Map();
+    domainSid = '';
+    domainName = '';
+    constructor(users, groups, computers, aclEntries, _certTemplates = [], _gpos = [], domain) {
+        this.users = users;
+        this.groups = groups;
+        this.computers = computers;
+        this.aclEntries = aclEntries;
+        this.domainName = domain?.name || '';
+        this.domainSid = domain?.sid || this.extractDomainSid();
+        logger_1.logger.debug(`AttackGraphService initialized with domain SID: ${this.domainSid}`);
+    }
+    export(maxPaths = 500) {
+        const startTime = Date.now();
+        this.buildGraph();
+        this.identifyPrivilegedTargets();
+        const paths = this.findAllAttackPaths(maxPaths);
+        const stats = this.computeStats(paths);
+        const uniqueNodes = this.getUniqueNodes(paths);
+        const duration = Date.now() - startTime;
+        logger_1.logger.info(`Attack graph exported: ${paths.length} paths, ${uniqueNodes.length} unique nodes in ${duration}ms`);
+        return {
+            version: '1.0',
+            generatedAt: new Date().toISOString(),
+            domain: this.domainName,
+            targets: Array.from(this.privilegedTargets.values()),
+            paths,
+            stats,
+            uniqueNodes,
+        };
+    }
+    buildGraph() {
+        this.addUserNodes();
+        this.addGroupNodes();
+        this.addComputerNodes();
+        this.addMembershipEdges();
+        this.addAclEdges();
+        this.addDelegationEdges();
+        this.addKerberosEdges();
+        logger_1.logger.debug(`Graph built: ${this.nodes.size} nodes, ${this.countEdges()} edges`);
+    }
+    addUserNodes() {
+        for (const user of this.users) {
+            const sid = this.extractSid(user);
+            const id = sid || this.dnToId.get(user.dn.toLowerCase()) || this.generateId(user.dn);
+            const node = {
+                id,
+                dn: user.dn,
+                name: user.sAMAccountName || user.displayName || user.dn,
+                type: 'user',
+                sid,
+                isEnabled: user.enabled,
+                isPrivileged: user.adminCount === 1,
+                adminCount: user.adminCount,
+                memberOf: user.memberOf || [],
+                servicePrincipalName: this.getSpn(user),
+                userAccountControl: user.userAccountControl,
+                delegateTo: this.getDelegationTargets(user),
+            };
+            this.nodes.set(id, node);
+            this.dnToId.set(user.dn.toLowerCase(), id);
+            this.edges.set(id, []);
+            this.reverseEdges.set(id, []);
+        }
+    }
+    addGroupNodes() {
+        for (const group of this.groups) {
+            const sid = this.extractSid(group);
+            const id = sid || this.generateId(group.dn);
+            const isPrivileged = this.isPrivilegedBySid(sid);
+            const node = {
+                id,
+                dn: group.dn,
+                name: group.sAMAccountName || group.displayName || group.cn || group.dn,
+                type: 'group',
+                sid,
+                isEnabled: true,
+                isPrivileged,
+                memberOf: group.memberOf || [],
+            };
+            this.nodes.set(id, node);
+            this.dnToId.set(group.dn.toLowerCase(), id);
+            this.edges.set(id, []);
+            this.reverseEdges.set(id, []);
+        }
+    }
+    addComputerNodes() {
+        for (const computer of this.computers) {
+            const sid = this.extractSid(computer);
+            const id = sid || this.generateId(computer.dn);
+            const memberOf = computer.memberOf || [];
+            const isDC = memberOf.some((m) => m.toLowerCase().includes('cn=domain controllers') ||
+                m.toLowerCase().includes('cn=contrôleurs de domaine'));
+            const node = {
+                id,
+                dn: computer.dn,
+                name: computer.sAMAccountName || computer.dNSHostName || computer.cn || computer.dn,
+                type: 'computer',
+                sid,
+                isEnabled: computer.enabled,
+                isPrivileged: isDC,
+                memberOf: memberOf,
+                delegateTo: this.getDelegationTargets(computer),
+                rbcdFrom: this.getRbcdPrincipals(computer),
+            };
+            this.nodes.set(id, node);
+            this.dnToId.set(computer.dn.toLowerCase(), id);
+            this.edges.set(id, []);
+            this.reverseEdges.set(id, []);
+        }
+    }
+    addMembershipEdges() {
+        for (const [nodeId, node] of this.nodes) {
+            for (const groupDn of node.memberOf) {
+                const targetId = this.dnToId.get(groupDn.toLowerCase());
+                if (targetId) {
+                    this.addEdge({
+                        source: nodeId,
+                        target: targetId,
+                        relation: 'MemberOf',
+                        isAbusable: false,
+                    });
+                }
+            }
+        }
+    }
+    addAclEdges() {
+        for (const acl of this.aclEntries) {
+            if (acl.aceType !== '0' && acl.aceType !== 'ACCESS_ALLOWED_ACE_TYPE') {
+                continue;
+            }
+            const sourceId = this.resolveAclTrustee(acl.trustee);
+            const targetId = this.dnToId.get(acl.objectDn.toLowerCase());
+            if (!sourceId || !targetId)
+                continue;
+            const relations = this.classifyAclRelation(acl);
+            for (const relation of relations) {
+                this.addEdge({
+                    source: sourceId,
+                    target: targetId,
+                    relation: relation.type,
+                    accessMask: acl.accessMask,
+                    objectType: acl.objectType,
+                    isAbusable: relation.isAbusable,
+                });
+            }
+        }
+    }
+    addDelegationEdges() {
+        for (const [nodeId, node] of this.nodes) {
+            if (node.delegateTo && node.delegateTo.length > 0) {
+                for (const spn of node.delegateTo) {
+                    const targetId = this.resolveSPNTarget(spn);
+                    if (targetId) {
+                        this.addEdge({
+                            source: nodeId,
+                            target: targetId,
+                            relation: 'AllowedToDelegate',
+                            isAbusable: true,
+                        });
+                    }
+                }
+            }
+            if (node.rbcdFrom && node.rbcdFrom.length > 0) {
+                for (const principalSid of node.rbcdFrom) {
+                    const sourceId = this.nodes.has(principalSid)
+                        ? principalSid
+                        : this.findNodeBySid(principalSid);
+                    if (sourceId) {
+                        this.addEdge({
+                            source: sourceId,
+                            target: nodeId,
+                            relation: 'AllowedToAct',
+                            isAbusable: true,
+                        });
+                    }
+                }
+            }
+        }
+    }
+    addKerberosEdges() {
+    }
+    identifyPrivilegedTargets() {
+        for (const [nodeId, node] of this.nodes) {
+            let reason = null;
+            if (node.sid) {
+                if (node.sid.endsWith(attack_graph_types_1.PRIVILEGED_SID_SUFFIXES.DOMAIN_ADMINS)) {
+                    reason = 'Domain Admins';
+                }
+                else if (node.sid.endsWith(attack_graph_types_1.PRIVILEGED_SID_SUFFIXES.ENTERPRISE_ADMINS)) {
+                    reason = 'Enterprise Admins';
+                }
+                else if (node.sid.endsWith(attack_graph_types_1.PRIVILEGED_SID_SUFFIXES.SCHEMA_ADMINS)) {
+                    reason = 'Schema Admins';
+                }
+                else if (node.sid.endsWith(attack_graph_types_1.PRIVILEGED_SID_SUFFIXES.ADMINISTRATORS)) {
+                    reason = 'Administrators';
+                }
+                else if (node.sid.endsWith(attack_graph_types_1.PRIVILEGED_SID_SUFFIXES.DOMAIN_CONTROLLERS)) {
+                    reason = 'Domain Controllers';
+                }
+                else if (node.sid.endsWith(attack_graph_types_1.PRIVILEGED_SID_SUFFIXES.ACCOUNT_OPERATORS)) {
+                    reason = 'Account Operators';
+                }
+                else if (node.sid.endsWith(attack_graph_types_1.PRIVILEGED_SID_SUFFIXES.BACKUP_OPERATORS)) {
+                    reason = 'Backup Operators';
+                }
+            }
+            if (!reason && node.adminCount === 1) {
+                reason = 'adminCount=1';
+            }
+            if (!reason && node.type === 'group') {
+                const nameLower = node.name.toLowerCase();
+                if (nameLower === 'domain admins' ||
+                    nameLower === 'admins du domaine' ||
+                    nameLower === 'administrateurs du domaine') {
+                    reason = 'Domain Admins';
+                }
+                else if (nameLower === 'enterprise admins' ||
+                    nameLower === 'administrateurs de l\'entreprise') {
+                    reason = 'Enterprise Admins';
+                }
+                else if (nameLower === 'administrators' || nameLower === 'administrateurs') {
+                    reason = 'Administrators';
+                }
+            }
+            if (!reason && node.type === 'computer' && node.isPrivileged) {
+                reason = 'Domain Controller';
+            }
+            if (reason) {
+                node.isPrivileged = true;
+                this.privilegedTargets.set(nodeId, {
+                    id: nodeId,
+                    name: node.name,
+                    type: node.type,
+                    sid: node.sid,
+                    dn: node.dn,
+                    reason,
+                });
+            }
+        }
+        logger_1.logger.debug(`Identified ${this.privilegedTargets.size} privileged targets`);
+    }
+    findAllAttackPaths(maxPaths) {
+        const paths = [];
+        const targetIds = Array.from(this.privilegedTargets.keys());
+        for (const [sourceId, sourceNode] of this.nodes) {
+            if (sourceNode.isPrivileged)
+                continue;
+            if (sourceNode.type === 'user' && !sourceNode.isEnabled)
+                continue;
+            const path = this.bfsShortestPath(sourceId, targetIds);
+            if (path && path.nodes.length > 1) {
+                const attackPath = this.buildAttackPath(path, sourceNode, paths.length + 1);
+                if (attackPath) {
+                    paths.push(attackPath);
+                    if (paths.length >= maxPaths) {
+                        logger_1.logger.debug(`Reached max paths limit: ${maxPaths}`);
+                        break;
+                    }
+                }
+            }
+        }
+        paths.sort((a, b) => {
+            const riskOrder = {
+                critical: 0,
+                high: 1,
+                medium: 2,
+                low: 3,
+            };
+            if (riskOrder[a.risk] !== riskOrder[b.risk]) {
+                return riskOrder[a.risk] - riskOrder[b.risk];
+            }
+            return a.hops - b.hops;
+        });
+        return paths;
+    }
+    bfsShortestPath(sourceId, targetIds) {
+        const targetSet = new Set(targetIds);
+        const visited = new Set([sourceId]);
+        const queue = [
+            { nodeId: sourceId, path: { nodes: [sourceId], edges: [] } },
+        ];
+        while (queue.length > 0) {
+            const current = queue.shift();
+            if (targetSet.has(current.nodeId) && current.path.nodes.length > 1) {
+                return current.path;
+            }
+            if (current.path.nodes.length > 6)
+                continue;
+            const outEdges = this.edges.get(current.nodeId) || [];
+            for (const edge of outEdges) {
+                if (visited.has(edge.target))
+                    continue;
+                visited.add(edge.target);
+                const newPath = {
+                    nodes: [...current.path.nodes, edge.target],
+                    edges: [...current.path.edges, edge],
+                };
+                if (targetSet.has(edge.target)) {
+                    return newPath;
+                }
+                queue.push({ nodeId: edge.target, path: newPath });
+            }
+        }
+        return null;
+    }
+    buildAttackPath(bfsPath, sourceNode, pathIndex) {
+        const chain = [];
+        for (let i = 0; i < bfsPath.nodes.length; i++) {
+            const nodeId = bfsPath.nodes[i];
+            if (!nodeId)
+                continue;
+            const node = this.nodes.get(nodeId);
+            if (!node)
+                continue;
+            chain.push(this.toAttackGraphNode(node));
+            if (i < bfsPath.edges.length) {
+                const edge = bfsPath.edges[i];
+                if (edge) {
+                    chain.push(this.toAttackGraphRelation(edge));
+                }
+            }
+        }
+        const targetId = bfsPath.nodes[bfsPath.nodes.length - 1];
+        if (!targetId)
+            return null;
+        const targetNode = this.nodes.get(targetId);
+        if (!targetNode)
+            return null;
+        const pathType = this.classifyPathType(bfsPath);
+        const risk = this.calculatePathRisk(bfsPath, pathType);
+        const description = this.generateDescription(bfsPath, pathType, sourceNode, targetNode);
+        const mitigation = this.generateMitigation(bfsPath, pathType);
+        return {
+            id: `path-${String(pathIndex).padStart(3, '0')}`,
+            risk,
+            type: pathType,
+            hops: bfsPath.edges.length,
+            description,
+            chain,
+            entryPoint: this.toEntryPoint(sourceNode),
+            target: this.toAttackGraphNode(targetNode),
+            mitigation,
+        };
+    }
+    classifyPathType(path) {
+        const relations = path.edges.map((e) => e.relation);
+        if (relations.includes('DCSync')) {
+            return 'DCSYNC';
+        }
+        if (relations.includes('AllowedToDelegate') || relations.includes('AllowedToAct')) {
+            return 'DELEGATION_ABUSE';
+        }
+        const firstNodeId = path.nodes[0];
+        const sourceNode = firstNodeId ? this.nodes.get(firstNodeId) : undefined;
+        if (sourceNode?.type === 'user' &&
+            sourceNode.servicePrincipalName &&
+            sourceNode.servicePrincipalName.length > 0) {
+            return 'KERBEROASTING';
+        }
+        if (sourceNode?.userAccountControl &&
+            (sourceNode.userAccountControl & 0x400000) !== 0) {
+            return 'ASREP_ROASTING';
+        }
+        if (relations.includes('Owns')) {
+            return 'OWNERSHIP_ABUSE';
+        }
+        const aclRelations = [
+            'GenericAll',
+            'WriteDacl',
+            'WriteOwner',
+            'GenericWrite',
+            'ForceChangePassword',
+            'AddMember',
+        ];
+        if (relations.some((r) => aclRelations.includes(r))) {
+            return 'ACL_ABUSE';
+        }
+        if (relations.every((r) => r === 'MemberOf')) {
+            return 'GROUP_MEMBERSHIP';
+        }
+        return 'ACL_ABUSE';
+    }
+    calculatePathRisk(path, pathType) {
+        const hops = path.edges.length;
+        const hasAbusableEdge = path.edges.some((e) => e.isAbusable);
+        if (pathType === 'DCSYNC')
+            return 'critical';
+        if (hops <= 2 && hasAbusableEdge)
+            return 'critical';
+        if (pathType === 'DELEGATION_ABUSE')
+            return 'high';
+        if (hops <= 2)
+            return 'high';
+        if (hops <= 4)
+            return 'medium';
+        return 'low';
+    }
+    generateDescription(path, pathType, source, target) {
+        const typeDescriptions = {
+            ACL_ABUSE: 'can abuse ACL permissions to reach',
+            KERBEROASTING: 'has an SPN and can be Kerberoasted to reach',
+            ASREP_ROASTING: 'has no pre-authentication and can be AS-REP roasted to reach',
+            DELEGATION_ABUSE: 'can abuse delegation to reach',
+            LATERAL_MOVEMENT: 'can move laterally to reach',
+            CERTIFICATE_ABUSE: 'can abuse certificate services to reach',
+            GROUP_MEMBERSHIP: 'is a member of groups leading to',
+            DCSYNC: 'has DCSync rights to',
+            OWNERSHIP_ABUSE: 'owns objects leading to',
+        };
+        return `${source.name} ${typeDescriptions[pathType]} ${target.name} in ${path.edges.length} hop(s)`;
+    }
+    generateMitigation(_path, pathType) {
+        const mitigations = {
+            ACL_ABUSE: 'Review and remove unnecessary ACL permissions. Apply least privilege principle.',
+            KERBEROASTING: 'Remove unnecessary SPNs from user accounts. Use Group Managed Service Accounts (gMSA) or strong passwords for service accounts.',
+            ASREP_ROASTING: 'Enable Kerberos pre-authentication for all user accounts.',
+            DELEGATION_ABUSE: 'Review and restrict delegation settings. Use resource-based constrained delegation with explicit trusts.',
+            LATERAL_MOVEMENT: 'Segment networks and restrict local admin access. Implement LAPS for local administrator passwords.',
+            CERTIFICATE_ABUSE: 'Review certificate template permissions. Disable vulnerable enrollment patterns.',
+            GROUP_MEMBERSHIP: 'Review nested group memberships. Remove unnecessary members from privileged groups.',
+            DCSYNC: 'Remove DCSync rights from non-DC accounts. Monitor for DCSync activity.',
+            OWNERSHIP_ABUSE: 'Review object ownership. Ensure privileged objects are owned by appropriate administrators.',
+        };
+        return mitigations[pathType];
+    }
+    toAttackGraphNode(node) {
+        return {
+            id: node.id,
+            name: node.name,
+            type: node.type,
+            sid: node.sid,
+            dn: node.dn,
+            domain: this.domainName,
+            isEnabled: node.isEnabled,
+            isPrivileged: node.isPrivileged,
+        };
+    }
+    toAttackGraphRelation(edge) {
+        return {
+            relation: edge.relation,
+            isAbusable: edge.isAbusable,
+            accessMask: edge.accessMask,
+            objectType: edge.objectType,
+        };
+    }
+    toEntryPoint(node) {
+        return {
+            id: node.id,
+            name: node.name,
+            type: node.type,
+            properties: {
+                hasSPN: node.servicePrincipalName && node.servicePrincipalName.length > 0,
+                noPreauth: node.userAccountControl
+                    ? (node.userAccountControl & 0x400000) !== 0
+                    : false,
+                passwordNotExpire: node.userAccountControl
+                    ? (node.userAccountControl & 0x10000) !== 0
+                    : false,
+                unconstrained: node.userAccountControl
+                    ? (node.userAccountControl & 0x80000) !== 0
+                    : false,
+                constrained: node.delegateTo && node.delegateTo.length > 0,
+                rbcd: node.rbcdFrom && node.rbcdFrom.length > 0,
+                adminCount: node.adminCount === 1,
+                enabled: node.isEnabled,
+            },
+        };
+    }
+    computeStats(paths) {
+        const byRisk = { critical: 0, high: 0, medium: 0, low: 0 };
+        const byType = {
+            ACL_ABUSE: 0,
+            KERBEROASTING: 0,
+            ASREP_ROASTING: 0,
+            DELEGATION_ABUSE: 0,
+            LATERAL_MOVEMENT: 0,
+            CERTIFICATE_ABUSE: 0,
+            GROUP_MEMBERSHIP: 0,
+            DCSYNC: 0,
+            OWNERSHIP_ABUSE: 0,
+        };
+        let totalHops = 0;
+        let shortestPath = Infinity;
+        let longestPath = 0;
+        for (const path of paths) {
+            byRisk[path.risk]++;
+            byType[path.type]++;
+            totalHops += path.hops;
+            shortestPath = Math.min(shortestPath, path.hops);
+            longestPath = Math.max(longestPath, path.hops);
+        }
+        return {
+            totalPaths: paths.length,
+            byRisk,
+            byType,
+            averageHops: paths.length > 0 ? Math.round((totalHops / paths.length) * 100) / 100 : 0,
+            shortestPath: paths.length > 0 ? shortestPath : 0,
+            longestPath: paths.length > 0 ? longestPath : 0,
+        };
+    }
+    getUniqueNodes(paths) {
+        const nodeCount = new Map();
+        for (const path of paths) {
+            for (const element of path.chain) {
+                if ((0, attack_graph_types_1.isAttackGraphNode)(element)) {
+                    const existing = nodeCount.get(element.id);
+                    if (existing) {
+                        existing.count++;
+                    }
+                    else {
+                        nodeCount.set(element.id, { node: element, count: 1 });
+                    }
+                }
+            }
+        }
+        return Array.from(nodeCount.values())
+            .map(({ node, count }) => ({
+            id: node.id,
+            name: node.name,
+            type: node.type,
+            pathCount: count,
+            sid: node.sid,
+        }))
+            .sort((a, b) => b.pathCount - a.pathCount);
+    }
+    addEdge(edge) {
+        const sourceEdges = this.edges.get(edge.source);
+        if (sourceEdges) {
+            sourceEdges.push(edge);
+        }
+        const targetEdges = this.reverseEdges.get(edge.target);
+        if (targetEdges) {
+            targetEdges.push(edge);
+        }
+    }
+    countEdges() {
+        let count = 0;
+        for (const edges of this.edges.values()) {
+            count += edges.length;
+        }
+        return count;
+    }
+    extractSid(obj) {
+        const sid = obj.objectSid || obj.objectSID || obj.sid;
+        if (typeof sid === 'string')
+            return sid;
+        if (Buffer.isBuffer(sid))
+            return this.bufferToSid(sid);
+        return undefined;
+    }
+    bufferToSid(buffer) {
+        if (buffer.length < 8)
+            return '';
+        const revision = buffer.readUInt8(0);
+        const subAuthCount = buffer.readUInt8(1);
+        const authority = buffer.readUInt8(2) * Math.pow(2, 40) +
+            buffer.readUInt8(3) * Math.pow(2, 32) +
+            buffer.readUInt8(4) * Math.pow(2, 24) +
+            buffer.readUInt8(5) * Math.pow(2, 16) +
+            buffer.readUInt8(6) * Math.pow(2, 8) +
+            buffer.readUInt8(7);
+        let sid = `S-${revision}-${authority}`;
+        for (let i = 0; i < subAuthCount; i++) {
+            const offset = 8 + i * 4;
+            if (offset + 4 <= buffer.length) {
+                const subAuth = buffer.readUInt32LE(offset);
+                sid += `-${subAuth}`;
+            }
+        }
+        return sid;
+    }
+    extractDomainSid() {
+        for (const user of this.users) {
+            const sid = this.extractSid(user);
+            if (sid) {
+                const parts = sid.split('-');
+                if (parts.length > 4) {
+                    return parts.slice(0, -1).join('-');
+                }
+            }
+        }
+        return '';
+    }
+    isPrivilegedBySid(sid) {
+        if (!sid)
+            return false;
+        for (const suffix of Object.values(attack_graph_types_1.PRIVILEGED_SID_SUFFIXES)) {
+            if (sid.endsWith(suffix))
+                return true;
+        }
+        return false;
+    }
+    generateId(dn) {
+        return `dn:${dn.toLowerCase()}`;
+    }
+    getSpn(user) {
+        const spn = user.servicePrincipalName;
+        if (!spn)
+            return undefined;
+        return Array.isArray(spn) ? spn : [spn];
+    }
+    getDelegationTargets(obj) {
+        const attr = obj['msDS-AllowedToDelegateTo'];
+        if (!attr)
+            return undefined;
+        return Array.isArray(attr) ? attr : [attr];
+    }
+    getRbcdPrincipals(computer) {
+        const attr = computer['msDS-AllowedToActOnBehalfOfOtherIdentity'];
+        if (!attr)
+            return undefined;
+        return [];
+    }
+    resolveAclTrustee(trustee) {
+        if (trustee.startsWith('S-1-')) {
+            if (this.nodes.has(trustee)) {
+                return trustee;
+            }
+            return this.findNodeBySid(trustee);
+        }
+        return this.dnToId.get(trustee.toLowerCase());
+    }
+    findNodeBySid(sid) {
+        for (const [nodeId, node] of this.nodes) {
+            if (node.sid === sid)
+                return nodeId;
+        }
+        return undefined;
+    }
+    resolveSPNTarget(spn) {
+        const parts = spn.split('/');
+        if (parts.length < 2 || !parts[1])
+            return undefined;
+        const hostPart = parts[1].split(':')[0];
+        if (!hostPart)
+            return undefined;
+        const host = hostPart.toLowerCase();
+        const hostShort = host.split('.')[0] || host;
+        for (const [nodeId, node] of this.nodes) {
+            if (node.type === 'computer') {
+                const nodeName = node.name.toLowerCase().replace(/\$$/, '');
+                if (nodeName === host || nodeName.startsWith(hostShort)) {
+                    return nodeId;
+                }
+            }
+        }
+        return undefined;
+    }
+    classifyAclRelation(acl) {
+        const relations = [];
+        const mask = acl.accessMask;
+        const objectType = acl.objectType?.toLowerCase();
+        if (mask & attack_graph_types_1.ACCESS_MASK.GENERIC_ALL) {
+            relations.push({ type: 'GenericAll', isAbusable: true });
+        }
+        if (mask & attack_graph_types_1.ACCESS_MASK.GENERIC_WRITE) {
+            relations.push({ type: 'GenericWrite', isAbusable: true });
+        }
+        if (mask & attack_graph_types_1.ACCESS_MASK.WRITE_DACL) {
+            relations.push({ type: 'WriteDacl', isAbusable: true });
+        }
+        if (mask & attack_graph_types_1.ACCESS_MASK.WRITE_OWNER) {
+            relations.push({ type: 'WriteOwner', isAbusable: true });
+        }
+        if (mask & attack_graph_types_1.ACCESS_MASK.CONTROL_ACCESS && objectType) {
+            if (objectType === attack_graph_types_1.ACL_GUIDS.FORCE_CHANGE_PASSWORD.toLowerCase()) {
+                relations.push({ type: 'ForceChangePassword', isAbusable: true });
+            }
+            if (objectType === attack_graph_types_1.ACL_GUIDS.DS_REPLICATION_GET_CHANGES.toLowerCase() ||
+                objectType === attack_graph_types_1.ACL_GUIDS.DS_REPLICATION_GET_CHANGES_ALL.toLowerCase()) {
+                relations.push({ type: 'DCSync', isAbusable: true });
+            }
+        }
+        if (mask & attack_graph_types_1.ACCESS_MASK.SELF && objectType === attack_graph_types_1.ACL_GUIDS.SELF_MEMBERSHIP.toLowerCase()) {
+            relations.push({ type: 'AddMember', isAbusable: true });
+        }
+        return relations;
+    }
+}
+exports.AttackGraphService = AttackGraphService;
+function computeAttackGraph(users, groups, computers, aclEntries, certTemplates = [], gpos = [], domain, maxPaths = 500) {
+    const service = new AttackGraphService(users, groups, computers, aclEntries, certTemplates, gpos, domain);
+    return service.export(maxPaths);
+}
+//# sourceMappingURL=attack-graph.service.js.map