@etcsec-com/etc-collector 1.4.0

package/dist/services/audit/detectors/ad/accounts.detector.js

@@ -0,0 +1,881 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectSensitiveDelegation = detectSensitiveDelegation;
+exports.detectDisabledAccountInAdminGroup = detectDisabledAccountInAdminGroup;
+exports.detectExpiredAccountInAdminGroup = detectExpiredAccountInAdminGroup;
+exports.detectSidHistory = detectSidHistory;
+exports.detectNotInProtectedUsers = detectNotInProtectedUsers;
+exports.detectDomainAdminInDescription = detectDomainAdminInDescription;
+exports.detectBackupOperatorsMember = detectBackupOperatorsMember;
+exports.detectAccountOperatorsMember = detectAccountOperatorsMember;
+exports.detectServerOperatorsMember = detectServerOperatorsMember;
+exports.detectPrintOperatorsMember = detectPrintOperatorsMember;
+exports.detectInactive365Days = detectInactive365Days;
+exports.detectStaleAccount = detectStaleAccount;
+exports.detectNeverLoggedOn = detectNeverLoggedOn;
+exports.detectAccountExpireSoon = detectAccountExpireSoon;
+exports.detectAdminLogonCountLow = detectAdminLogonCountLow;
+exports.detectTestAccount = detectTestAccount;
+exports.detectSharedAccount = detectSharedAccount;
+exports.detectSmartcardNotRequired = detectSmartcardNotRequired;
+exports.detectPrimaryGroupIdSpoofing = detectPrimaryGroupIdSpoofing;
+exports.detectServiceAccountWithSpn = detectServiceAccountWithSpn;
+exports.detectServiceAccountNaming = detectServiceAccountNaming;
+exports.detectServiceAccountOldPassword = detectServiceAccountOldPassword;
+exports.detectServiceAccountPrivileged = detectServiceAccountPrivileged;
+exports.detectServiceAccountNoPreauth = detectServiceAccountNoPreauth;
+exports.detectServiceAccountWeakEncryption = detectServiceAccountWeakEncryption;
+exports.detectAdminCountOrphaned = detectAdminCountOrphaned;
+exports.detectPrivilegedAccountSpn = detectPrivilegedAccountSpn;
+exports.detectAdminNoSmartcard = detectAdminNoSmartcard;
+exports.detectServiceAccountInteractive = detectServiceAccountInteractive;
+exports.detectServiceAccountVulnerabilities = detectServiceAccountVulnerabilities;
+exports.detectReplicaDirectoryChanges = detectReplicaDirectoryChanges;
+exports.detectDangerousBuiltinMembership = detectDangerousBuiltinMembership;
+exports.detectLockedAccountAdmin = detectLockedAccountAdmin;
+exports.detectAccountsVulnerabilities = detectAccountsVulnerabilities;
+const entity_converter_1 = require("../../../../utils/entity-converter");
+function detectSensitiveDelegation(users, includeDetails) {
+    const privilegedGroups = [
+        'Domain Admins',
+        'Enterprise Admins',
+        'Schema Admins',
+        'Administrators',
+    ];
+    const affected = users.filter((u) => {
+        if (!u.userAccountControl || !u.memberOf)
+            return false;
+        const hasUnconstrainedDeleg = (u.userAccountControl & 0x80000) !== 0;
+        const isPrivileged = u.memberOf.some((dn) => privilegedGroups.some((group) => dn.includes(`CN=${group}`)));
+        return hasUnconstrainedDeleg && isPrivileged;
+    });
+    return {
+        type: 'SENSITIVE_DELEGATION',
+        severity: 'critical',
+        category: 'accounts',
+        title: 'Sensitive Account with Delegation',
+        description: 'Privileged accounts (Domain/Enterprise Admins) with unconstrained delegation. Extreme security risk.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+function detectDisabledAccountInAdminGroup(users, includeDetails) {
+    const adminGroups = ['Domain Admins', 'Enterprise Admins', 'Schema Admins'];
+    const affected = users.filter((u) => {
+        if (!u.userAccountControl || !u.memberOf)
+            return false;
+        const isDisabled = (u.userAccountControl & 0x2) !== 0;
+        const isInAdminGroup = u.memberOf.some((dn) => adminGroups.some((group) => dn.includes(`CN=${group}`)));
+        return isDisabled && isInAdminGroup;
+    });
+    return {
+        type: 'DISABLED_ACCOUNT_IN_ADMIN_GROUP',
+        severity: 'high',
+        category: 'accounts',
+        title: 'Disabled Account in Admin Group',
+        description: 'Disabled user accounts still present in privileged groups. Should be removed immediately.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+function detectExpiredAccountInAdminGroup(users, includeDetails) {
+    const adminGroups = ['Domain Admins', 'Enterprise Admins', 'Schema Admins'];
+    const now = Date.now();
+    const affected = users.filter((u) => {
+        if (!u.memberOf)
+            return false;
+        const accountExpires = u['accountExpires'];
+        const isExpired = accountExpires && accountExpires.getTime() < now;
+        const isInAdminGroup = u.memberOf.some((dn) => adminGroups.some((group) => dn.includes(`CN=${group}`)));
+        return isExpired && isInAdminGroup;
+    });
+    return {
+        type: 'EXPIRED_ACCOUNT_IN_ADMIN_GROUP',
+        severity: 'high',
+        category: 'accounts',
+        title: 'Expired Account in Admin Group',
+        description: 'Expired user accounts still present in privileged groups. Should be removed immediately.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+function detectSidHistory(users, includeDetails) {
+    const affected = users.filter((u) => {
+        const userObj = u;
+        const sidHistory = userObj['sIDHistory'] ??
+            userObj['sidhistory'] ??
+            userObj['SIDHistory'] ??
+            userObj['sidHistory'];
+        if (!sidHistory)
+            return false;
+        if (Array.isArray(sidHistory)) {
+            return sidHistory.length > 0;
+        }
+        return !!sidHistory;
+    });
+    return {
+        type: 'SID_HISTORY',
+        severity: 'high',
+        category: 'accounts',
+        title: 'SID History Present',
+        description: 'User accounts with sIDHistory attribute. Can be abused for privilege escalation.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+function detectNotInProtectedUsers(users, includeDetails) {
+    const privilegedGroups = ['Domain Admins', 'Enterprise Admins', 'Schema Admins'];
+    const affected = users.filter((u) => {
+        if (!u.memberOf)
+            return false;
+        const isPrivileged = u.memberOf.some((dn) => privilegedGroups.some((group) => dn.includes(`CN=${group}`)));
+        const isInProtectedUsers = u.memberOf.some((dn) => dn.includes('CN=Protected Users'));
+        return isPrivileged && !isInProtectedUsers;
+    });
+    return {
+        type: 'NOT_IN_PROTECTED_USERS',
+        severity: 'high',
+        category: 'accounts',
+        title: 'Not in Protected Users Group',
+        description: 'Privileged accounts not in Protected Users group. Missing additional security protections.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+function detectDomainAdminInDescription(users, includeDetails) {
+    const sensitiveKeywords = [
+        /domain\s*admin/i,
+        /enterprise\s*admin/i,
+        /administrator/i,
+        /admin\s*account/i,
+        /privileged/i,
+    ];
+    const affected = users.filter((u) => {
+        const description = (0, entity_converter_1.ldapAttrToString)(u['description']);
+        if (!description)
+            return false;
+        return sensitiveKeywords.some((pattern) => pattern.test(description));
+    });
+    return {
+        type: 'DOMAIN_ADMIN_IN_DESCRIPTION',
+        severity: 'high',
+        category: 'accounts',
+        title: 'Sensitive Terms in Description',
+        description: 'User accounts with admin/privileged keywords in description field. Information disclosure.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+function detectBackupOperatorsMember(users, includeDetails) {
+    const affected = users.filter((u) => {
+        if (!u.memberOf)
+            return false;
+        return u.memberOf.some((dn) => dn.includes('CN=Backup Operators'));
+    });
+    return {
+        type: 'BACKUP_OPERATORS_MEMBER',
+        severity: 'high',
+        category: 'accounts',
+        title: 'Backup Operators Member',
+        description: 'Users in Backup Operators group. Can backup/restore files and bypass ACLs.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+function detectAccountOperatorsMember(users, includeDetails) {
+    const affected = users.filter((u) => {
+        if (!u.memberOf)
+            return false;
+        return u.memberOf.some((dn) => dn.includes('CN=Account Operators'));
+    });
+    return {
+        type: 'ACCOUNT_OPERATORS_MEMBER',
+        severity: 'high',
+        category: 'accounts',
+        title: 'Account Operators Member',
+        description: 'Users in Account Operators group. Can create/modify user accounts.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+function detectServerOperatorsMember(users, includeDetails) {
+    const affected = users.filter((u) => {
+        if (!u.memberOf)
+            return false;
+        return u.memberOf.some((dn) => dn.includes('CN=Server Operators'));
+    });
+    return {
+        type: 'SERVER_OPERATORS_MEMBER',
+        severity: 'high',
+        category: 'accounts',
+        title: 'Server Operators Member',
+        description: 'Users in Server Operators group. Can manage domain controllers.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+function detectPrintOperatorsMember(users, includeDetails) {
+    const affected = users.filter((u) => {
+        if (!u.memberOf)
+            return false;
+        return u.memberOf.some((dn) => dn.includes('CN=Print Operators'));
+    });
+    return {
+        type: 'PRINT_OPERATORS_MEMBER',
+        severity: 'high',
+        category: 'accounts',
+        title: 'Print Operators Member',
+        description: 'Users in Print Operators group. Can load drivers and manage printers on DCs.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+function detectInactive365Days(users, includeDetails) {
+    const now = Date.now();
+    const oneYearAgo = now - 365 * 24 * 60 * 60 * 1000;
+    const affected = users.filter((u) => {
+        if (!u.lastLogon)
+            return false;
+        return u.lastLogon.getTime() < oneYearAgo;
+    });
+    return {
+        type: 'INACTIVE_365_DAYS',
+        severity: 'medium',
+        category: 'accounts',
+        title: 'Inactive 365+ Days',
+        description: 'User accounts inactive for 365+ days. Should be disabled or deleted.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+function detectStaleAccount(users, includeDetails) {
+    const now = Date.now();
+    const sixMonthsAgo = now - 180 * 24 * 60 * 60 * 1000;
+    const affected = users.filter((u) => {
+        if (!u.enabled)
+            return false;
+        if (!u.lastLogon)
+            return false;
+        const lastLogonTime = u.lastLogon instanceof Date ? u.lastLogon.getTime() : new Date(u.lastLogon).getTime();
+        if (isNaN(lastLogonTime))
+            return false;
+        return lastLogonTime < sixMonthsAgo;
+    });
+    return {
+        type: 'STALE_ACCOUNT',
+        severity: 'high',
+        category: 'accounts',
+        title: 'Stale Account (180+ Days)',
+        description: 'Enabled user accounts inactive for 180+ days. Stale accounts increase attack surface and should be reviewed.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+function detectNeverLoggedOn(users, includeDetails) {
+    const affected = users.filter((u) => {
+        if (!u.enabled)
+            return false;
+        return !u.lastLogon;
+    });
+    return {
+        type: 'NEVER_LOGGED_ON',
+        severity: 'medium',
+        category: 'accounts',
+        title: 'Never Logged On',
+        description: 'Enabled user accounts that have never logged into the domain. May indicate orphaned accounts, provisioning issues, or unused accounts that should be disabled.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+function filetimeToDate(filetime) {
+    if (!filetime)
+        return null;
+    const ft = typeof filetime === 'string' ? BigInt(filetime) : BigInt(filetime);
+    if (ft === BigInt(0) || ft === BigInt('9223372036854775807'))
+        return null;
+    const ms = Number(ft / BigInt(10000)) - 11644473600000;
+    return new Date(ms);
+}
+function detectAccountExpireSoon(users, includeDetails) {
+    const now = Date.now();
+    const thirtyDaysFromNow = now + 30 * 24 * 60 * 60 * 1000;
+    const affected = users.filter((u) => {
+        if (!u.enabled)
+            return false;
+        const expiresDate = filetimeToDate(u.accountExpires);
+        if (!expiresDate)
+            return false;
+        return expiresDate.getTime() > now && expiresDate.getTime() <= thirtyDaysFromNow;
+    });
+    return {
+        type: 'ACCOUNT_EXPIRE_SOON',
+        severity: 'medium',
+        category: 'accounts',
+        title: 'Account Expiring Soon',
+        description: 'User accounts set to expire within the next 30 days. Review if these expirations are intentional or if accounts need to be extended.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+function detectAdminLogonCountLow(users, includeDetails) {
+    const affected = users.filter((u) => {
+        if (!u.enabled)
+            return false;
+        if (u.adminCount !== 1)
+            return false;
+        const logonCount = u['logonCount'];
+        return logonCount !== undefined && logonCount < 5;
+    });
+    return {
+        type: 'ADMIN_LOGON_COUNT_LOW',
+        severity: 'low',
+        category: 'accounts',
+        title: 'Admin Account with Low Logon Count',
+        description: 'Administrative accounts (adminCount=1) with fewer than 5 logons. May indicate unused privileged accounts that should be reviewed or disabled.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+function detectTestAccount(users, includeDetails) {
+    const testPatterns = [/^test/i, /test$/i, /_test/i, /\.test/i, /^demo/i, /^temp/i];
+    const affected = users.filter((u) => {
+        return testPatterns.some((pattern) => pattern.test(u.sAMAccountName));
+    });
+    return {
+        type: 'TEST_ACCOUNT',
+        severity: 'medium',
+        category: 'accounts',
+        title: 'Test Account',
+        description: 'User accounts with test/demo/temp naming. Should be removed from production.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+function detectSharedAccount(users, includeDetails) {
+    const sharedPatterns = [/^shared/i, /^common/i, /^generic/i, /^service/i, /^svc/i];
+    const affected = users.filter((u) => {
+        return sharedPatterns.some((pattern) => pattern.test(u.sAMAccountName));
+    });
+    return {
+        type: 'SHARED_ACCOUNT',
+        severity: 'medium',
+        category: 'accounts',
+        title: 'Shared Account',
+        description: 'User accounts with shared/generic naming. Prevents proper accountability.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+function detectSmartcardNotRequired(users, includeDetails) {
+    const affected = users.filter((u) => {
+        if (!u.enabled)
+            return false;
+        if (!u.adminCount || u.adminCount !== 1)
+            return false;
+        const uac = u.userAccountControl || 0;
+        return (uac & 0x40000) === 0;
+    });
+    return {
+        type: 'SMARTCARD_NOT_REQUIRED',
+        severity: 'medium',
+        category: 'accounts',
+        title: 'Smartcard Not Required',
+        description: 'Privileged accounts (adminCount=1) without smartcard requirement. ' +
+            'High-value accounts should require strong authentication.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+function detectPrimaryGroupIdSpoofing(users, includeDetails) {
+    const affected = users.filter((u) => {
+        const primaryGroupId = u.primaryGroupID;
+        if (!primaryGroupId)
+            return false;
+        return primaryGroupId !== 513;
+    });
+    return {
+        type: 'PRIMARYGROUPID_SPOOFING',
+        severity: 'medium',
+        category: 'accounts',
+        title: 'primaryGroupID Spoofing',
+        description: 'User accounts with non-standard primaryGroupID. Can be used to hide group membership.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+const SERVICE_ACCOUNT_PATTERNS = [
+    /^svc[_-]/i,
+    /[_-]svc$/i,
+    /^service[_-]/i,
+    /[_-]service$/i,
+    /^sa[_-]/i,
+    /[_-]sa$/i,
+    /^app[_-]/i,
+    /^sql[_-]/i,
+    /^iis[_-]/i,
+    /^web[_-]/i,
+    /^batch[_-]/i,
+    /^task[_-]/i,
+    /^job[_-]/i,
+    /^daemon[_-]/i,
+    /^agent[_-]/i,
+];
+function getServicePrincipalNames(user) {
+    const spn = user['servicePrincipalName'];
+    if (!spn)
+        return [];
+    if (Array.isArray(spn))
+        return spn;
+    return [spn];
+}
+function isServiceAccount(user) {
+    const spns = getServicePrincipalNames(user);
+    if (spns.length > 0) {
+        return true;
+    }
+    return SERVICE_ACCOUNT_PATTERNS.some((pattern) => pattern.test(user.sAMAccountName));
+}
+function detectServiceAccountWithSpn(users, includeDetails) {
+    const affected = users.filter((u) => {
+        const spns = getServicePrincipalNames(u);
+        if (spns.length === 0)
+            return false;
+        if (u.userAccountControl && (u.userAccountControl & 0x2) !== 0)
+            return false;
+        return true;
+    });
+    return {
+        type: 'SERVICE_ACCOUNT_WITH_SPN',
+        severity: 'medium',
+        category: 'accounts',
+        title: 'Service Account with SPN (Kerberoasting Target)',
+        description: 'User accounts with Service Principal Name configured. These accounts are targets for Kerberoasting attacks where attackers request TGS tickets and crack them offline.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+        details: affected.length > 0
+            ? {
+                recommendation: 'Use gMSA (Group Managed Service Accounts) instead. For existing accounts, ensure strong passwords (25+ chars) and regular rotation.',
+                spnCount: affected.reduce((sum, u) => sum + getServicePrincipalNames(u).length, 0),
+            }
+            : undefined,
+    };
+}
+function detectServiceAccountNaming(users, includeDetails) {
+    const affected = users.filter((u) => {
+        const spns = getServicePrincipalNames(u);
+        if (spns.length > 0)
+            return false;
+        if (u.userAccountControl && (u.userAccountControl & 0x2) !== 0)
+            return false;
+        return SERVICE_ACCOUNT_PATTERNS.some((pattern) => pattern.test(u.sAMAccountName));
+    });
+    return {
+        type: 'SERVICE_ACCOUNT_NAMING',
+        severity: 'low',
+        category: 'accounts',
+        title: 'Service Account by Naming Convention',
+        description: 'User accounts matching service account naming patterns (svc_, _svc, service, etc.) without SPN. Review if these are actual service accounts.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+function detectServiceAccountOldPassword(users, includeDetails) {
+    const now = Date.now();
+    const oneYearAgo = now - 365 * 24 * 60 * 60 * 1000;
+    const affected = users.filter((u) => {
+        if (!isServiceAccount(u))
+            return false;
+        if (u.userAccountControl && (u.userAccountControl & 0x2) !== 0)
+            return false;
+        if (!u.passwordLastSet)
+            return true;
+        return u.passwordLastSet.getTime() < oneYearAgo;
+    });
+    return {
+        type: 'SERVICE_ACCOUNT_OLD_PASSWORD',
+        severity: 'high',
+        category: 'accounts',
+        title: 'Service Account with Old Password',
+        description: 'Service accounts with passwords not changed in over 1 year. These accounts are high-value targets and passwords should be rotated regularly.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+        details: affected.length > 0
+            ? {
+                recommendation: 'Rotate service account passwords every 90 days or migrate to gMSA for automatic password management.',
+            }
+            : undefined,
+    };
+}
+function detectServiceAccountPrivileged(users, includeDetails) {
+    const privilegedGroups = [
+        'Domain Admins',
+        'Enterprise Admins',
+        'Schema Admins',
+        'Administrators',
+        'Backup Operators',
+        'Account Operators',
+        'Server Operators',
+    ];
+    const affected = users.filter((u) => {
+        if (!isServiceAccount(u))
+            return false;
+        if (u.userAccountControl && (u.userAccountControl & 0x2) !== 0)
+            return false;
+        if (!u.memberOf)
+            return false;
+        return u.memberOf.some((dn) => privilegedGroups.some((group) => dn.includes(`CN=${group}`)));
+    });
+    return {
+        type: 'SERVICE_ACCOUNT_PRIVILEGED',
+        severity: 'critical',
+        category: 'accounts',
+        title: 'Service Account in Privileged Group',
+        description: 'Service accounts with membership in privileged groups (Domain Admins, etc.). If compromised, attackers gain full domain control.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+        details: affected.length > 0
+            ? {
+                recommendation: 'Remove service accounts from privileged groups. Grant only the minimum permissions needed for the service to function.',
+            }
+            : undefined,
+    };
+}
+function detectServiceAccountNoPreauth(users, includeDetails) {
+    const DONT_REQUIRE_PREAUTH = 0x400000;
+    const affected = users.filter((u) => {
+        if (!isServiceAccount(u))
+            return false;
+        if (!u.userAccountControl)
+            return false;
+        if ((u.userAccountControl & 0x2) !== 0)
+            return false;
+        return (u.userAccountControl & DONT_REQUIRE_PREAUTH) !== 0;
+    });
+    return {
+        type: 'SERVICE_ACCOUNT_NO_PREAUTH',
+        severity: 'high',
+        category: 'accounts',
+        title: 'Service Account Without Pre-Authentication (AS-REP Roasting)',
+        description: 'Service accounts with "Do not require Kerberos pre-authentication" enabled. Attackers can request AS-REP tickets and crack them offline.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+        details: affected.length > 0
+            ? {
+                recommendation: 'Enable Kerberos pre-authentication for all service accounts.',
+            }
+            : undefined,
+    };
+}
+function detectServiceAccountWeakEncryption(users, includeDetails) {
+    const affected = users.filter((u) => {
+        if (!isServiceAccount(u))
+            return false;
+        if (u.userAccountControl && (u.userAccountControl & 0x2) !== 0)
+            return false;
+        const encTypes = u['msDS-SupportedEncryptionTypes'];
+        if (!encTypes)
+            return false;
+        const encTypesNum = typeof encTypes === 'string' ? parseInt(encTypes, 10) : encTypes;
+        const hasOnlyWeak = (encTypesNum & 0x7) !== 0 && (encTypesNum & 0x18) === 0;
+        return hasOnlyWeak;
+    });
+    return {
+        type: 'SERVICE_ACCOUNT_WEAK_ENCRYPTION',
+        severity: 'medium',
+        category: 'accounts',
+        title: 'Service Account Using Weak Kerberos Encryption',
+        description: 'Service accounts configured to use only weak Kerberos encryption (DES/RC4) without AES. Makes offline cracking easier.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+        details: affected.length > 0
+            ? {
+                recommendation: 'Enable AES128 and AES256 encryption for all service accounts.',
+            }
+            : undefined,
+    };
+}
+function detectAdminCountOrphaned(users, includeDetails) {
+    const adminGroups = [
+        'Domain Admins',
+        'Enterprise Admins',
+        'Schema Admins',
+        'Administrators',
+        'Account Operators',
+        'Server Operators',
+        'Backup Operators',
+        'Print Operators',
+    ];
+    const affected = users.filter((u) => {
+        if (u.adminCount !== 1)
+            return false;
+        const memberOf = u['memberOf'];
+        if (!memberOf || memberOf.length === 0)
+            return true;
+        const isInAdminGroup = memberOf.some((dn) => adminGroups.some((group) => dn.toLowerCase().includes(`cn=${group.toLowerCase()}`)));
+        return !isInAdminGroup;
+    });
+    return {
+        type: 'ADMIN_COUNT_ORPHANED',
+        severity: 'medium',
+        category: 'accounts',
+        title: 'Orphaned AdminCount Flag',
+        description: 'Accounts with adminCount=1 but not in any privileged group. This may indicate removed admins that still have residual privileges or SDProp protection.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+        details: affected.length > 0
+            ? {
+                recommendation: 'Review these accounts. If no longer admins, clear adminCount flag and reset ACLs to allow proper inheritance.',
+                impact: 'Accounts may still have protected ACLs preventing proper management.',
+            }
+            : undefined,
+    };
+}
+function detectPrivilegedAccountSpn(users, includeDetails) {
+    const affected = users.filter((u) => {
+        if (u.adminCount !== 1)
+            return false;
+        if (!u.enabled)
+            return false;
+        const spn = u['servicePrincipalName'];
+        const hasSPN = spn && Array.isArray(spn) && spn.length > 0;
+        return hasSPN;
+    });
+    return {
+        type: 'PRIVILEGED_ACCOUNT_SPN',
+        severity: 'high',
+        category: 'accounts',
+        title: 'Privileged Account with SPN',
+        description: 'Privileged accounts (adminCount=1) have Service Principal Names configured. These accounts are vulnerable to Kerberoasting attacks.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+        details: affected.length > 0
+            ? {
+                attackVector: 'Request TGS ticket → Offline crack password → Full admin access',
+                recommendation: 'Remove SPNs from admin accounts. Use dedicated service accounts (preferably gMSA) for services.',
+                criticalRisk: 'Compromising these accounts grants immediate Domain Admin or equivalent access.',
+            }
+            : undefined,
+    };
+}
+function detectAdminNoSmartcard(users, includeDetails) {
+    const affected = users.filter((u) => {
+        if (u.adminCount !== 1)
+            return false;
+        if (!u.enabled)
+            return false;
+        const smartcardRequired = u.userAccountControl ? (u.userAccountControl & 0x40000) !== 0 : false;
+        return !smartcardRequired;
+    });
+    return {
+        type: 'ADMIN_NO_SMARTCARD',
+        severity: 'medium',
+        category: 'accounts',
+        title: 'Admin Account Without Smartcard Requirement',
+        description: 'Privileged accounts can authenticate with passwords instead of smartcards. Passwords are more vulnerable to theft and phishing.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+        details: affected.length > 0
+            ? {
+                recommendation: 'Enable "Smart card is required for interactive logon" for all admin accounts.',
+                benefits: [
+                    'Eliminates password-based attacks (phishing, credential theft)',
+                    'Provides two-factor authentication',
+                    'Reduces risk of credential replay attacks',
+                ],
+            }
+            : undefined,
+    };
+}
+function detectServiceAccountInteractive(users, includeDetails) {
+    const affected = users.filter((u) => {
+        const spn = u['servicePrincipalName'];
+        const hasSPN = spn && Array.isArray(spn) && spn.length > 0;
+        const servicePatterns = [/^svc[_-]/i, /^sa[_-]/i, /service/i, /^sql/i, /^iis/i, /^app/i];
+        const matchesPattern = servicePatterns.some((p) => p.test(u.sAMAccountName || ''));
+        if (!hasSPN && !matchesPattern)
+            return false;
+        if (!u.enabled)
+            return false;
+        const lastLogonStr = u.lastLogon;
+        if (lastLogonStr) {
+            const lastLogon = new Date(lastLogonStr);
+            const daysSinceLogon = (Date.now() - lastLogon.getTime()) / (1000 * 60 * 60 * 24);
+            if (daysSinceLogon < 30) {
+                return true;
+            }
+        }
+        const pwdNeverExpires = u.userAccountControl ? (u.userAccountControl & 0x10000) !== 0 : false;
+        const notDelegated = u.userAccountControl ? (u.userAccountControl & 0x100000) !== 0 : false;
+        return pwdNeverExpires && !notDelegated;
+    });
+    return {
+        type: 'SERVICE_ACCOUNT_INTERACTIVE',
+        severity: 'high',
+        category: 'accounts',
+        title: 'Service Account with Interactive Logon',
+        description: 'Service accounts appear to allow or use interactive logon. Service accounts should be restricted to service-only authentication.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+        details: affected.length > 0
+            ? {
+                recommendation: 'Apply "Deny log on locally" and "Deny log on through Remote Desktop Services" rights. Use gMSA where possible.',
+                risks: [
+                    'Interactive sessions leave credentials in memory (mimikatz target)',
+                    'Increases attack surface for credential theft',
+                    'May indicate misuse of service accounts',
+                ],
+            }
+            : undefined,
+    };
+}
+function detectServiceAccountVulnerabilities(users, includeDetails) {
+    return [
+        detectServiceAccountWithSpn(users, includeDetails),
+        detectServiceAccountNaming(users, includeDetails),
+        detectServiceAccountOldPassword(users, includeDetails),
+        detectServiceAccountPrivileged(users, includeDetails),
+        detectServiceAccountNoPreauth(users, includeDetails),
+        detectServiceAccountWeakEncryption(users, includeDetails),
+    ].filter((finding) => finding.count > 0);
+}
+function detectReplicaDirectoryChanges(users, includeDetails) {
+    const replicationGroups = [
+        'Domain Controllers',
+        'Enterprise Domain Controllers',
+        'Administrators',
+        'Domain Admins',
+        'Enterprise Admins',
+    ];
+    const affected = users.filter((u) => {
+        if (!u.enabled || !u.memberOf)
+            return false;
+        const rawDesc = u['description'];
+        const description = typeof rawDesc === 'string' ? rawDesc : (Array.isArray(rawDesc) ? rawDesc[0] : '') || '';
+        const hasReplicationHint = description.toLowerCase().includes('replication') ||
+            description.toLowerCase().includes('dcsync') ||
+            description.toLowerCase().includes('directory sync');
+        const isServiceLike = /^(svc|service|sync|repl)/i.test(u.sAMAccountName);
+        const hasAdminCount = u.adminCount === 1;
+        const isInReplicationGroup = u.memberOf.some((dn) => replicationGroups.some((g) => dn.toLowerCase().includes(g.toLowerCase())));
+        return hasReplicationHint || (isServiceLike && hasAdminCount && !isInReplicationGroup);
+    });
+    return {
+        type: 'REPLICA_DIRECTORY_CHANGES',
+        severity: 'critical',
+        category: 'accounts',
+        title: 'Potential Directory Replication Rights',
+        description: 'Accounts that may have directory replication rights (DCSync capability). ' +
+            'These accounts can extract all password hashes from the domain.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+        details: {
+            recommendation: 'Review ACLs on domain head for DS-Replication-Get-Changes rights. Only Domain Controllers should have this permission.',
+        },
+    };
+}
+function detectDangerousBuiltinMembership(users, includeDetails) {
+    const dangerousGroups = [
+        'Cert Publishers',
+        'RAS and IAS Servers',
+        'Windows Authorization Access Group',
+        'Terminal Server License Servers',
+        'Incoming Forest Trust Builders',
+        'Performance Log Users',
+        'Performance Monitor Users',
+        'Distributed COM Users',
+        'Remote Desktop Users',
+        'Network Configuration Operators',
+        'Cryptographic Operators',
+        'Event Log Readers',
+        'Hyper-V Administrators',
+        'Access Control Assistance Operators',
+        'Remote Management Users',
+    ];
+    const affected = users.filter((u) => {
+        if (!u.enabled || !u.memberOf)
+            return false;
+        return u.memberOf.some((dn) => dangerousGroups.some((g) => dn.toLowerCase().includes(g.toLowerCase())));
+    });
+    return {
+        type: 'DANGEROUS_BUILTIN_MEMBERSHIP',
+        severity: 'medium',
+        category: 'accounts',
+        title: 'Dangerous Built-in Group Membership',
+        description: 'User accounts with membership in overlooked but dangerous built-in groups. ' +
+            'These groups grant elevated privileges that may allow privilege escalation.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+        details: {
+            dangerousGroups: dangerousGroups,
+        },
+    };
+}
+function detectLockedAccountAdmin(users, includeDetails) {
+    const adminGroups = [
+        'Domain Admins',
+        'Enterprise Admins',
+        'Schema Admins',
+        'Administrators',
+        'Account Operators',
+        'Server Operators',
+        'Backup Operators',
+    ];
+    const affected = users.filter((u) => {
+        if (!u.memberOf)
+            return false;
+        const isLocked = (u.lockoutTime && u.lockoutTime !== '0' && u.lockoutTime !== 0) ||
+            (u.userAccountControl && (u.userAccountControl & 0x10) !== 0);
+        const isAdmin = u.memberOf.some((dn) => adminGroups.some((g) => dn.toLowerCase().includes(g.toLowerCase())));
+        return isLocked && isAdmin;
+    });
+    return {
+        type: 'LOCKED_ACCOUNT_ADMIN',
+        severity: 'high',
+        category: 'accounts',
+        title: 'Locked Administrative Account',
+        description: 'Administrative accounts that are currently locked out. ' +
+            'May indicate password spray attacks or compromised credential attempts.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+        details: {
+            recommendation: 'Investigate why these admin accounts are locked. Check security logs for failed authentication attempts.',
+        },
+    };
+}
+function detectAccountsVulnerabilities(users, includeDetails) {
+    return [
+        detectSensitiveDelegation(users, includeDetails),
+        detectDisabledAccountInAdminGroup(users, includeDetails),
+        detectExpiredAccountInAdminGroup(users, includeDetails),
+        detectSidHistory(users, includeDetails),
+        detectNotInProtectedUsers(users, includeDetails),
+        detectDomainAdminInDescription(users, includeDetails),
+        detectBackupOperatorsMember(users, includeDetails),
+        detectAccountOperatorsMember(users, includeDetails),
+        detectServerOperatorsMember(users, includeDetails),
+        detectPrintOperatorsMember(users, includeDetails),
+        detectStaleAccount(users, includeDetails),
+        detectInactive365Days(users, includeDetails),
+        detectNeverLoggedOn(users, includeDetails),
+        detectAccountExpireSoon(users, includeDetails),
+        detectAdminLogonCountLow(users, includeDetails),
+        detectTestAccount(users, includeDetails),
+        detectSharedAccount(users, includeDetails),
+        detectSmartcardNotRequired(users, includeDetails),
+        detectPrimaryGroupIdSpoofing(users, includeDetails),
+        detectServiceAccountWithSpn(users, includeDetails),
+        detectServiceAccountNaming(users, includeDetails),
+        detectServiceAccountOldPassword(users, includeDetails),
+        detectServiceAccountPrivileged(users, includeDetails),
+        detectServiceAccountNoPreauth(users, includeDetails),
+        detectServiceAccountWeakEncryption(users, includeDetails),
+        detectAdminCountOrphaned(users, includeDetails),
+        detectPrivilegedAccountSpn(users, includeDetails),
+        detectAdminNoSmartcard(users, includeDetails),
+        detectServiceAccountInteractive(users, includeDetails),
+        detectReplicaDirectoryChanges(users, includeDetails),
+        detectDangerousBuiltinMembership(users, includeDetails),
+        detectLockedAccountAdmin(users, includeDetails),
+    ].filter((finding) => finding.count > 0);
+}
+//# sourceMappingURL=accounts.detector.js.map