@etcsec-com/etc-collector 1.4.0

package/dist/services/audit/detectors/ad/advanced.detector.js

@@ -0,0 +1,867 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectShadowCredentials = detectShadowCredentials;
+exports.detectRbcdAbuse = detectRbcdAbuse;
+exports.detectEsc1VulnerableTemplate = detectEsc1VulnerableTemplate;
+exports.detectEsc2AnyPurpose = detectEsc2AnyPurpose;
+exports.detectEsc3EnrollmentAgent = detectEsc3EnrollmentAgent;
+exports.detectEsc4VulnerableTemplateAcl = detectEsc4VulnerableTemplateAcl;
+exports.detectEsc6EditfAttributeSubjectAltName2 = detectEsc6EditfAttributeSubjectAltName2;
+exports.detectLapsPasswordReadable = detectLapsPasswordReadable;
+exports.detectReplicationRights = detectReplicationRights;
+exports.detectDcsyncCapable = detectDcsyncCapable;
+exports.detectEsc8HttpEnrollment = detectEsc8HttpEnrollment;
+exports.detectLapsNotDeployed = detectLapsNotDeployed;
+exports.detectLapsLegacyAttribute = detectLapsLegacyAttribute;
+exports.detectDuplicateSpn = detectDuplicateSpn;
+exports.detectWeakPasswordPolicy = detectWeakPasswordPolicy;
+exports.detectWeakKerberosPolicy = detectWeakKerberosPolicy;
+exports.detectMachineAccountQuotaAbuse = detectMachineAccountQuotaAbuse;
+exports.detectMachineAccountQuotaHigh = detectMachineAccountQuotaHigh;
+exports.detectDelegationPrivilege = detectDelegationPrivilege;
+exports.detectForeignSecurityPrincipals = detectForeignSecurityPrincipals;
+exports.detectNtlmRelayOpportunity = detectNtlmRelayOpportunity;
+exports.detectLapsPasswordSet = detectLapsPasswordSet;
+exports.detectLapsPasswordLeaked = detectLapsPasswordLeaked;
+exports.detectAdcsWeakPermissions = detectAdcsWeakPermissions;
+exports.detectDangerousLogonScripts = detectDangerousLogonScripts;
+exports.detectAnonymousLdapAccess = detectAnonymousLdapAccess;
+exports.detectRecycleBinDisabled = detectRecycleBinDisabled;
+exports.detectLdapSigningDisabled = detectLdapSigningDisabled;
+exports.detectLdapChannelBindingDisabled = detectLdapChannelBindingDisabled;
+exports.detectSmbV1Enabled = detectSmbV1Enabled;
+exports.detectSmbSigningDisabled = detectSmbSigningDisabled;
+exports.detectAuditPolicyWeak = detectAuditPolicyWeak;
+exports.detectPowershellLoggingDisabled = detectPowershellLoggingDisabled;
+exports.detectDsHeuristicsModified = detectDsHeuristicsModified;
+exports.detectAdminSdHolderModified = detectAdminSdHolderModified;
+exports.detectExchangePrivEscPath = detectExchangePrivEscPath;
+exports.detectAdvancedVulnerabilities = detectAdvancedVulnerabilities;
+const entity_converter_1 = require("../../../../utils/entity-converter");
+function detectShadowCredentials(users, includeDetails) {
+    const affected = users.filter((u) => {
+        const keyLink = u['msDS-KeyCredentialLink'];
+        return keyLink && (Array.isArray(keyLink) ? keyLink.length > 0 : keyLink !== '');
+    });
+    return {
+        type: 'SHADOW_CREDENTIALS',
+        severity: 'critical',
+        category: 'advanced',
+        title: 'Shadow Credentials',
+        description: 'msDS-KeyCredentialLink attribute configured. Allows Kerberos authentication bypass by adding arbitrary public keys.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+function detectRbcdAbuse(users, includeDetails) {
+    const affected = users.filter((u) => {
+        const rbcdAttr = u['msDS-AllowedToActOnBehalfOfOtherIdentity'];
+        return rbcdAttr && (Array.isArray(rbcdAttr) ? rbcdAttr.length > 0 : rbcdAttr !== '');
+    });
+    return {
+        type: 'RBCD_ABUSE',
+        severity: 'critical',
+        category: 'advanced',
+        title: 'RBCD Abuse',
+        description: 'msDS-AllowedToActOnBehalfOfOtherIdentity configured. Enables privilege escalation via resource-based delegation.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+function detectEsc1VulnerableTemplate(templates, includeDetails) {
+    const affected = templates.filter((t) => {
+        const hasClientAuth = t.pKIExtendedKeyUsage?.includes('1.3.6.1.5.5.7.3.2');
+        const enrolleeSuppliesSubject = t['msPKI-Certificate-Name-Flag'] && (t['msPKI-Certificate-Name-Flag'] & 0x1) !== 0;
+        return hasClientAuth && enrolleeSuppliesSubject;
+    });
+    return {
+        type: 'ESC1_VULNERABLE_TEMPLATE',
+        severity: 'high',
+        category: 'advanced',
+        title: 'ESC1 Vulnerable Template',
+        description: 'ADCS template with client auth + enrollee supplies subject. Enables domain compromise by obtaining cert for any user.',
+        count: affected.length,
+        affectedEntities: includeDetails ? affected.map((t) => t.dn) : undefined,
+    };
+}
+function detectEsc2AnyPurpose(templates, includeDetails) {
+    const affected = templates.filter((t) => {
+        const hasAnyPurpose = t.pKIExtendedKeyUsage?.includes('2.5.29.37.0');
+        const isEmpty = !t.pKIExtendedKeyUsage || t.pKIExtendedKeyUsage.length === 0;
+        return hasAnyPurpose || isEmpty;
+    });
+    return {
+        type: 'ESC2_ANY_PURPOSE',
+        severity: 'high',
+        category: 'advanced',
+        title: 'ESC2 Any Purpose',
+        description: 'ADCS template with Any Purpose EKU or no usage restriction. Certificate can be used for domain authentication.',
+        count: affected.length,
+        affectedEntities: includeDetails ? affected.map((t) => t.dn) : undefined,
+    };
+}
+function detectEsc3EnrollmentAgent(templates, includeDetails) {
+    const affected = templates.filter((t) => {
+        return t.pKIExtendedKeyUsage?.includes('1.3.6.1.4.1.311.20.2.1');
+    });
+    return {
+        type: 'ESC3_ENROLLMENT_AGENT',
+        severity: 'high',
+        category: 'advanced',
+        title: 'ESC3 Enrollment Agent',
+        description: 'ADCS template with enrollment agent EKU. Can request certificates on behalf of other users.',
+        count: affected.length,
+        affectedEntities: includeDetails ? affected.map((t) => t.dn) : undefined,
+    };
+}
+function detectEsc4VulnerableTemplateAcl(templates, includeDetails) {
+    const affected = templates.filter((t) => {
+        return t.hasWeakAcl;
+    });
+    return {
+        type: 'ESC4_VULNERABLE_TEMPLATE_ACL',
+        severity: 'high',
+        category: 'advanced',
+        title: 'ESC4 Vulnerable Template ACL',
+        description: 'Certificate template with weak ACLs. Can modify template to make it vulnerable to ESC1/ESC2.',
+        count: affected.length,
+        affectedEntities: includeDetails ? affected.map((t) => t.dn) : undefined,
+    };
+}
+function detectEsc6EditfAttributeSubjectAltName2(cas, includeDetails) {
+    const affected = cas.filter((ca) => {
+        return ca.flags && (ca.flags & 0x40000) !== 0;
+    });
+    return {
+        type: 'ESC6_EDITF_ATTRIBUTESUBJECTALTNAME2',
+        severity: 'high',
+        category: 'advanced',
+        title: 'ESC6 EDITF Flag',
+        description: 'ADCS CA with EDITF_ATTRIBUTESUBJECTALTNAME2 flag. Allows specifying arbitrary SAN in certificate requests.',
+        count: affected.length,
+        affectedEntities: includeDetails ? affected.map((ca) => ca.dn) : undefined,
+    };
+}
+function detectLapsPasswordReadable(computers, includeDetails) {
+    const affected = computers.filter((c) => {
+        return c.lapsPasswordReadableByNonAdmins;
+    });
+    return {
+        type: 'LAPS_PASSWORD_READABLE',
+        severity: 'high',
+        category: 'advanced',
+        title: 'LAPS Password Readable',
+        description: 'Non-admin users can read LAPS password attributes. Exposure of local admin passwords.',
+        count: affected.length,
+        affectedEntities: includeDetails ? affected.map((c) => c.dn) : undefined,
+    };
+}
+function detectReplicationRights(users, includeDetails) {
+    const affected = users.filter((u) => {
+        if (u.adminCount !== 1)
+            return false;
+        if (!u.memberOf)
+            return true;
+        const isInStandardAdminGroups = u.memberOf.some((dn) => {
+            return (dn.includes('CN=Domain Admins') ||
+                dn.includes('CN=Enterprise Admins') ||
+                dn.includes('CN=Administrators'));
+        });
+        return !isInStandardAdminGroups;
+    });
+    return {
+        type: 'REPLICATION_RIGHTS',
+        severity: 'high',
+        category: 'advanced',
+        title: 'Replication Rights',
+        description: 'Account with adminCount=1 outside standard admin groups. May have replication rights (DCSync).',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+function detectDcsyncCapable(users, includeDetails) {
+    const affected = users.filter((u) => {
+        return u.hasDcsyncRights;
+    });
+    return {
+        type: 'DCSYNC_CAPABLE',
+        severity: 'high',
+        category: 'advanced',
+        title: 'DCSync Capable',
+        description: 'Account with DS-Replication-Get-Changes and DS-Replication-Get-Changes-All rights. Can extract all password hashes.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+function detectEsc8HttpEnrollment(cas, includeDetails) {
+    const affected = cas.filter((ca) => {
+        return ca.webEnrollment && ca.webEnrollment.protocol === 'http';
+    });
+    return {
+        type: 'ESC8_HTTP_ENROLLMENT',
+        severity: 'medium',
+        category: 'advanced',
+        title: 'ESC8 HTTP Enrollment',
+        description: 'ADCS web enrollment via HTTP. Enables NTLM relay attacks against certificate enrollment.',
+        count: affected.length,
+        affectedEntities: includeDetails ? affected.map((ca) => ca.dn) : undefined,
+    };
+}
+function detectLapsNotDeployed(computers, includeDetails) {
+    const affected = computers.filter((c) => {
+        return !('ms-Mcs-AdmPwd' in c) && !('msLAPS-Password' in c);
+    });
+    return {
+        type: 'LAPS_NOT_DEPLOYED',
+        severity: 'medium',
+        category: 'advanced',
+        title: 'LAPS Not Deployed',
+        description: 'LAPS not deployed on domain computers. Shared/static local admin passwords across workstations.',
+        count: affected.length,
+        affectedEntities: includeDetails ? affected.map((c) => c.dn) : undefined,
+    };
+}
+function detectLapsLegacyAttribute(computers, includeDetails) {
+    const affected = computers.filter((c) => {
+        return 'ms-Mcs-AdmPwd' in c && !('msLAPS-Password' in c);
+    });
+    return {
+        type: 'LAPS_LEGACY_ATTRIBUTE',
+        severity: 'medium',
+        category: 'advanced',
+        title: 'LAPS Legacy Attribute',
+        description: 'Legacy LAPS attribute used instead of Windows LAPS. Less secure implementation.',
+        count: affected.length,
+        affectedEntities: includeDetails ? affected.map((c) => c.dn) : undefined,
+    };
+}
+function detectDuplicateSpn(users, includeDetails) {
+    const spnMap = new Map();
+    users.forEach((u) => {
+        const spns = u.servicePrincipalName;
+        if (spns && Array.isArray(spns)) {
+            spns.forEach((spn) => {
+                if (!spnMap.has(spn)) {
+                    spnMap.set(spn, []);
+                }
+                spnMap.get(spn).push(u.dn);
+            });
+        }
+    });
+    const affected = [];
+    spnMap.forEach((dns, _spn) => {
+        if (dns.length > 1) {
+            affected.push(...dns);
+        }
+    });
+    return {
+        type: 'DUPLICATE_SPN',
+        severity: 'medium',
+        category: 'advanced',
+        title: 'Duplicate SPN',
+        description: 'Service Principal Name registered multiple times. Can cause Kerberos authentication failures.',
+        count: affected.length,
+        affectedEntities: includeDetails ? affected : undefined,
+    };
+}
+function detectWeakPasswordPolicy(domain, includeDetails) {
+    if (!domain) {
+        return {
+            type: 'WEAK_PASSWORD_POLICY',
+            severity: 'medium',
+            category: 'advanced',
+            title: 'Weak Password Policy',
+            description: 'Unable to check domain password policy.',
+            count: 0,
+        };
+    }
+    const minPwdLength = domain.minPwdLength || 0;
+    const maxPwdAge = domain.maxPwdAge || 0;
+    const pwdHistoryLength = domain.pwdHistoryLength || 0;
+    const isWeak = minPwdLength < 14 || maxPwdAge > 90 || pwdHistoryLength < 24;
+    return {
+        type: 'WEAK_PASSWORD_POLICY',
+        severity: 'medium',
+        category: 'advanced',
+        title: 'Weak Password Policy',
+        description: 'Domain password policy below minimum standards. Enables easier password cracking.',
+        count: isWeak ? 1 : 0,
+        affectedEntities: includeDetails && isWeak ? [domain.dn] : undefined,
+        details: isWeak
+            ? {
+                minPwdLength,
+                maxPwdAge,
+                pwdHistoryLength,
+            }
+            : undefined,
+    };
+}
+function detectWeakKerberosPolicy(domain, includeDetails) {
+    if (!domain) {
+        return {
+            type: 'WEAK_KERBEROS_POLICY',
+            severity: 'medium',
+            category: 'advanced',
+            title: 'Weak Kerberos Policy',
+            description: 'Unable to check Kerberos policy.',
+            count: 0,
+        };
+    }
+    const maxTicketAge = domain.maxTicketAge || 0;
+    const maxRenewAge = domain.maxRenewAge || 0;
+    const isWeak = maxTicketAge > 10 || maxRenewAge > 7;
+    return {
+        type: 'WEAK_KERBEROS_POLICY',
+        severity: 'medium',
+        category: 'advanced',
+        title: 'Weak Kerberos Policy',
+        description: 'Kerberos ticket lifetimes exceed recommended values. Longer window for ticket-based attacks.',
+        count: isWeak ? 1 : 0,
+        affectedEntities: includeDetails && isWeak ? [domain.dn] : undefined,
+        details: isWeak
+            ? {
+                maxTicketAge,
+                maxRenewAge,
+            }
+            : undefined,
+    };
+}
+function detectMachineAccountQuotaAbuse(domain, includeDetails) {
+    if (!domain) {
+        return {
+            type: 'MACHINE_ACCOUNT_QUOTA_ABUSE',
+            severity: 'medium',
+            category: 'advanced',
+            title: 'Machine Account Quota Abuse',
+            description: 'Unable to check machine account quota.',
+            count: 0,
+        };
+    }
+    const quota = domain['ms-DS-MachineAccountQuota'];
+    const isVulnerable = typeof quota === 'number' && quota > 0;
+    return {
+        type: 'MACHINE_ACCOUNT_QUOTA_ABUSE',
+        severity: 'medium',
+        category: 'advanced',
+        title: 'Machine Account Quota Abuse',
+        description: 'ms-DS-MachineAccountQuota > 0. Non-admin users can join computers to domain (potential Kerberos attacks).',
+        count: isVulnerable ? 1 : 0,
+        affectedEntities: includeDetails && isVulnerable ? [domain.dn] : undefined,
+        details: isVulnerable
+            ? {
+                quota,
+            }
+            : undefined,
+    };
+}
+function detectMachineAccountQuotaHigh(domain, includeDetails) {
+    if (!domain) {
+        return {
+            type: 'MACHINE_ACCOUNT_QUOTA_HIGH',
+            severity: 'high',
+            category: 'advanced',
+            title: 'Machine Account Quota Elevated',
+            description: 'Unable to check machine account quota.',
+            count: 0,
+        };
+    }
+    const quota = domain['ms-DS-MachineAccountQuota'];
+    const DEFAULT_QUOTA = 10;
+    const isElevated = typeof quota === 'number' && quota > DEFAULT_QUOTA;
+    return {
+        type: 'MACHINE_ACCOUNT_QUOTA_HIGH',
+        severity: 'high',
+        category: 'advanced',
+        title: 'Machine Account Quota Elevated Above Default',
+        description: 'ms-DS-MachineAccountQuota is higher than the default (10). Someone intentionally increased this value, allowing non-admin users to join more computers to the domain.',
+        count: isElevated ? 1 : 0,
+        affectedEntities: includeDetails && isElevated ? [domain.dn] : undefined,
+        details: isElevated
+            ? {
+                currentQuota: quota,
+                defaultQuota: DEFAULT_QUOTA,
+                recommendation: 'Set ms-DS-MachineAccountQuota to 0 to prevent non-admin domain joins.',
+            }
+            : undefined,
+    };
+}
+function detectDelegationPrivilege(users, includeDetails) {
+    const affected = users.filter((u) => {
+        return u.hasSeEnableDelegationPrivilege;
+    });
+    return {
+        type: 'DELEGATION_PRIVILEGE',
+        severity: 'medium',
+        category: 'advanced',
+        title: 'Delegation Privilege',
+        description: 'Account has SeEnableDelegationPrivilege. Can enable delegation on user/computer accounts.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+function detectForeignSecurityPrincipals(fsps, includeDetails) {
+    return {
+        type: 'FOREIGN_SECURITY_PRINCIPALS',
+        severity: 'medium',
+        category: 'advanced',
+        title: 'Foreign Security Principals',
+        description: 'Foreign security principals from external forests. Potential for cross-forest privilege escalation.',
+        count: fsps.length,
+        affectedEntities: includeDetails ? fsps.map((fsp) => fsp.dn) : undefined,
+    };
+}
+function detectNtlmRelayOpportunity(domain, includeDetails) {
+    if (!domain) {
+        return {
+            type: 'NTLM_RELAY_OPPORTUNITY',
+            severity: 'medium',
+            category: 'advanced',
+            title: 'NTLM Relay Opportunity',
+            description: 'Unable to check LDAP signing configuration.',
+            count: 0,
+        };
+    }
+    const ldapSigningRequired = domain.ldapSigningRequired;
+    const channelBindingRequired = domain.channelBindingRequired;
+    const isVulnerable = !ldapSigningRequired || !channelBindingRequired;
+    return {
+        type: 'NTLM_RELAY_OPPORTUNITY',
+        severity: 'medium',
+        category: 'advanced',
+        title: 'NTLM Relay Opportunity',
+        description: 'LDAP signing or channel binding not enforced. Enables NTLM relay attacks.',
+        count: isVulnerable ? 1 : 0,
+        affectedEntities: includeDetails && isVulnerable ? [domain.dn] : undefined,
+    };
+}
+function detectLapsPasswordSet(computers, includeDetails) {
+    const affected = computers.filter((c) => {
+        return 'ms-Mcs-AdmPwd' in c || 'msLAPS-Password' in c;
+    });
+    return {
+        type: 'LAPS_PASSWORD_SET',
+        severity: 'low',
+        category: 'advanced',
+        title: 'LAPS Password Set',
+        description: 'LAPS password successfully managed. Informational - indicates proper LAPS deployment.',
+        count: affected.length,
+        affectedEntities: includeDetails ? affected.map((c) => c.dn) : undefined,
+    };
+}
+function detectLapsPasswordLeaked(computers, includeDetails) {
+    const affected = computers.filter((c) => {
+        return c.lapsPasswordExcessiveReaders;
+    });
+    return {
+        type: 'LAPS_PASSWORD_LEAKED',
+        severity: 'low',
+        category: 'advanced',
+        title: 'LAPS Password Leaked',
+        description: 'LAPS password visible to too many users. Reduces effectiveness of LAPS.',
+        count: affected.length,
+        affectedEntities: includeDetails ? affected.map((c) => c.dn) : undefined,
+    };
+}
+function detectAdcsWeakPermissions(templates, includeDetails) {
+    const affected = templates.filter((t) => {
+        return t.hasWeakEnrollmentAcl || t.hasGenericAllPermission;
+    });
+    return {
+        type: 'ADCS_WEAK_PERMISSIONS',
+        severity: 'medium',
+        category: 'advanced',
+        title: 'ADCS Weak Permissions',
+        description: 'Weak permissions on ADCS objects or certificate templates allow unauthorized enrollment.',
+        count: affected.length,
+        affectedEntities: includeDetails ? affected.map((t) => t.dn || t.name) : undefined,
+    };
+}
+function detectDangerousLogonScripts(users, includeDetails) {
+    const affected = users.filter((u) => {
+        const scriptPath = u.scriptPath;
+        return scriptPath && (scriptPath.includes('\\\\') || scriptPath.startsWith('//'));
+    });
+    return {
+        type: 'DANGEROUS_LOGON_SCRIPTS',
+        severity: 'medium',
+        category: 'advanced',
+        title: 'Dangerous Logon Scripts',
+        description: 'Logon scripts with weak ACLs can be modified by attackers for code execution on user login.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+function detectAnonymousLdapAccess(anonymousAccessAllowed, domain, includeDetails) {
+    return {
+        type: 'ANONYMOUS_LDAP_ACCESS',
+        severity: 'medium',
+        category: 'advanced',
+        title: 'Anonymous LDAP Access Allowed',
+        description: 'LDAP server accepts anonymous binds. Attackers can enumerate AD objects (users, groups, computers) without valid credentials.',
+        count: anonymousAccessAllowed ? 1 : 0,
+        affectedEntities: includeDetails && anonymousAccessAllowed && domain ? [domain.dn] : undefined,
+        details: anonymousAccessAllowed
+            ? {
+                recommendation: 'Configure "Network security: LDAP client signing requirements" and restrict anonymous access via dsHeuristics.',
+                currentStatus: 'Anonymous bind allowed',
+            }
+            : undefined,
+    };
+}
+function detectRecycleBinDisabled(domain, includeDetails) {
+    if (!domain) {
+        return {
+            type: 'RECYCLE_BIN_DISABLED',
+            severity: 'medium',
+            category: 'advanced',
+            title: 'AD Recycle Bin Status Unknown',
+            description: 'Unable to determine AD Recycle Bin status.',
+            count: 0,
+        };
+    }
+    const recycleBinEnabled = domain.recycleBinEnabled === true;
+    return {
+        type: 'RECYCLE_BIN_DISABLED',
+        severity: 'medium',
+        category: 'advanced',
+        title: 'AD Recycle Bin Not Enabled',
+        description: 'Active Directory Recycle Bin is not enabled. Deleted objects cannot be easily recovered, which complicates incident response and may lead to permanent data loss.',
+        count: recycleBinEnabled ? 0 : 1,
+        affectedEntities: includeDetails && !recycleBinEnabled ? [domain.dn] : undefined,
+        details: !recycleBinEnabled
+            ? {
+                recommendation: 'Enable AD Recycle Bin feature. Note: This requires forest functional level 2008 R2 or higher and is irreversible.',
+                currentStatus: 'Disabled',
+            }
+            : undefined,
+    };
+}
+function detectLdapSigningDisabled(gpoSettings, domain, includeDetails) {
+    if (gpoSettings && gpoSettings.ldapServerIntegrity !== undefined) {
+        const signingDisabled = gpoSettings.ldapServerIntegrity === 0;
+        return {
+            type: 'LDAP_SIGNING_DISABLED',
+            severity: 'critical',
+            category: 'advanced',
+            title: 'LDAP Signing Not Required',
+            description: 'LDAP server signing is not required. This allows NTLM relay attacks and man-in-the-middle attacks against LDAP connections.',
+            count: signingDisabled ? 1 : 0,
+            affectedEntities: includeDetails && signingDisabled && domain ? [domain.dn] : undefined,
+            details: signingDisabled
+                ? {
+                    recommendation: 'Configure "Domain controller: LDAP server signing requirements" to "Require signing".',
+                    currentSetting: gpoSettings.ldapServerIntegrity,
+                    requiredSetting: 2,
+                }
+                : undefined,
+        };
+    }
+    return {
+        type: 'LDAP_SIGNING_DISABLED',
+        severity: 'critical',
+        category: 'advanced',
+        title: 'LDAP Signing Not Configured in GPO',
+        description: 'LDAP signing is not configured via Group Policy. Windows defaults do not require LDAP signing, making this environment vulnerable to LDAP relay attacks.',
+        count: 1,
+        affectedEntities: includeDetails && domain ? [domain.dn] : undefined,
+        details: {
+            recommendation: 'Configure "Domain controller: LDAP server signing requirements" to "Require signing" via Group Policy.',
+            note: 'No GPO security template found. Windows defaults do not require LDAP signing.',
+        },
+    };
+}
+function detectLdapChannelBindingDisabled(gpoSettings, domain, includeDetails) {
+    if (gpoSettings && gpoSettings.ldapChannelBinding !== undefined) {
+        const bindingDisabled = gpoSettings.ldapChannelBinding === 0;
+        return {
+            type: 'LDAP_CHANNEL_BINDING_DISABLED',
+            severity: 'high',
+            category: 'advanced',
+            title: 'LDAP Channel Binding Not Required',
+            description: 'LDAP channel binding is not required. This allows NTLM relay attacks against LDAPS connections even when signing is enabled.',
+            count: bindingDisabled ? 1 : 0,
+            affectedEntities: includeDetails && bindingDisabled && domain ? [domain.dn] : undefined,
+            details: bindingDisabled
+                ? {
+                    recommendation: 'Configure "Domain controller: LDAP server channel binding token requirements" to "Always".',
+                    currentSetting: gpoSettings.ldapChannelBinding,
+                    requiredSetting: 2,
+                }
+                : undefined,
+        };
+    }
+    return {
+        type: 'LDAP_CHANNEL_BINDING_DISABLED',
+        severity: 'high',
+        category: 'advanced',
+        title: 'LDAP Channel Binding Configuration Unknown',
+        description: 'Unable to determine LDAP channel binding configuration. Manual review recommended.',
+        count: 0,
+        details: {
+            note: 'GPO/Registry settings not available. Check LdapEnforceChannelBinding registry value manually.',
+        },
+    };
+}
+function detectSmbV1Enabled(gpoSettings, domain, includeDetails) {
+    if (gpoSettings && (gpoSettings.smbv1ServerEnabled !== undefined || gpoSettings.smbv1ClientEnabled !== undefined)) {
+        const smbv1Enabled = gpoSettings.smbv1ServerEnabled === true || gpoSettings.smbv1ClientEnabled === true;
+        return {
+            type: 'SMB_V1_ENABLED',
+            severity: 'high',
+            category: 'advanced',
+            title: 'SMBv1 Protocol Enabled',
+            description: 'SMBv1 protocol is enabled. SMBv1 is deprecated and vulnerable to attacks like EternalBlue (WannaCry, NotPetya).',
+            count: smbv1Enabled ? 1 : 0,
+            affectedEntities: includeDetails && smbv1Enabled && domain ? [domain.dn] : undefined,
+            details: smbv1Enabled
+                ? {
+                    recommendation: 'Disable SMBv1 on all systems. Use SMBv2/v3 instead.',
+                    smbv1Server: gpoSettings.smbv1ServerEnabled,
+                    smbv1Client: gpoSettings.smbv1ClientEnabled,
+                }
+                : undefined,
+        };
+    }
+    return {
+        type: 'SMB_V1_ENABLED',
+        severity: 'high',
+        category: 'advanced',
+        title: 'SMBv1 Configuration Unknown',
+        description: 'Unable to determine SMBv1 configuration. Manual review recommended.',
+        count: 0,
+        details: {
+            note: 'GPO/Registry settings not available. Check SMB1 registry values and Windows features manually.',
+        },
+    };
+}
+function detectSmbSigningDisabled(gpoSettings, domain, includeDetails) {
+    if (gpoSettings && gpoSettings.smbSigningRequired !== undefined) {
+        const signingDisabled = gpoSettings.smbSigningRequired === false;
+        return {
+            type: 'SMB_SIGNING_DISABLED',
+            severity: 'critical',
+            category: 'advanced',
+            title: 'SMB Signing Not Required',
+            description: 'SMB server signing is not required. This allows man-in-the-middle attacks and NTLM relay attacks against SMB connections.',
+            count: signingDisabled ? 1 : 0,
+            affectedEntities: includeDetails && signingDisabled && domain ? [domain.dn] : undefined,
+            details: signingDisabled
+                ? {
+                    recommendation: 'Configure "Microsoft network server: Digitally sign communications (always)" to Enabled.',
+                    currentSetting: 'Not Required',
+                    requiredSetting: 'Required',
+                    smbServerSigning: gpoSettings.smbSigningRequired,
+                    smbClientSigning: gpoSettings.smbClientSigningRequired,
+                }
+                : undefined,
+        };
+    }
+    return {
+        type: 'SMB_SIGNING_DISABLED',
+        severity: 'critical',
+        category: 'advanced',
+        title: 'SMB Signing Not Configured in GPO',
+        description: 'SMB signing is not configured via Group Policy. Windows defaults do not require SMB signing, making this environment vulnerable to NTLM relay attacks.',
+        count: 1,
+        affectedEntities: includeDetails && domain ? [domain.dn] : undefined,
+        details: {
+            recommendation: 'Configure "Microsoft network server: Digitally sign communications (always)" via Group Policy.',
+            note: 'No GPO security template found. Windows defaults do not require SMB signing.',
+        },
+    };
+}
+function detectAuditPolicyWeak(gpoSettings, domain, includeDetails) {
+    const criticalAuditCategories = [
+        'Account Logon',
+        'Account Management',
+        'Logon/Logoff',
+        'Object Access',
+        'Policy Change',
+        'Privilege Use',
+        'System',
+    ];
+    if (gpoSettings && gpoSettings.auditPolicies && gpoSettings.auditPolicies.length > 0) {
+        const configuredCategories = new Set(gpoSettings.auditPolicies.map((p) => p.category));
+        const missingCategories = criticalAuditCategories.filter((cat) => !configuredCategories.has(cat));
+        const hasWeakAudit = missingCategories.length > 0;
+        return {
+            type: 'AUDIT_POLICY_WEAK',
+            severity: 'medium',
+            category: 'advanced',
+            title: 'Audit Policy Incomplete',
+            description: 'Domain audit policy does not cover all critical security events. Attacks may go undetected.',
+            count: hasWeakAudit ? 1 : 0,
+            affectedEntities: includeDetails && hasWeakAudit && domain ? [domain.dn] : undefined,
+            details: hasWeakAudit
+                ? {
+                    recommendation: 'Configure Advanced Audit Policy to audit all critical security categories.',
+                    missingCategories,
+                    configuredCategories: Array.from(configuredCategories),
+                }
+                : undefined,
+        };
+    }
+    return {
+        type: 'AUDIT_POLICY_WEAK',
+        severity: 'medium',
+        category: 'advanced',
+        title: 'Audit Policy Configuration Unknown',
+        description: 'Unable to determine audit policy configuration. Manual review recommended.',
+        count: 0,
+        details: {
+            note: 'GPO audit settings not available. Check Advanced Audit Policy Configuration manually.',
+            requiredCategories: criticalAuditCategories,
+        },
+    };
+}
+function detectPowershellLoggingDisabled(gpoSettings, domain, includeDetails) {
+    if (gpoSettings && gpoSettings.powershellLogging) {
+        const logging = gpoSettings.powershellLogging;
+        const loggingDisabled = !logging.moduleLogging && !logging.scriptBlockLogging;
+        return {
+            type: 'POWERSHELL_LOGGING_DISABLED',
+            severity: 'medium',
+            category: 'advanced',
+            title: 'PowerShell Logging Not Configured',
+            description: 'PowerShell script block logging and module logging are not enabled. Malicious PowerShell activity will not be logged.',
+            count: loggingDisabled ? 1 : 0,
+            affectedEntities: includeDetails && loggingDisabled && domain ? [domain.dn] : undefined,
+            details: loggingDisabled
+                ? {
+                    recommendation: 'Enable "Turn on PowerShell Script Block Logging" and "Turn on Module Logging" via GPO.',
+                    moduleLogging: logging.moduleLogging,
+                    scriptBlockLogging: logging.scriptBlockLogging,
+                    transcription: logging.transcription,
+                }
+                : undefined,
+        };
+    }
+    return {
+        type: 'POWERSHELL_LOGGING_DISABLED',
+        severity: 'medium',
+        category: 'advanced',
+        title: 'PowerShell Logging Configuration Unknown',
+        description: 'Unable to determine PowerShell logging configuration. Manual review recommended.',
+        count: 0,
+        details: {
+            note: 'GPO/Registry settings not available. Check PowerShell logging GPO settings manually.',
+        },
+    };
+}
+function detectDsHeuristicsModified(domain, _includeDetails) {
+    const dsHeuristics = domain ? domain['dsHeuristics'] : undefined;
+    const isModified = dsHeuristics !== undefined && dsHeuristics !== null && dsHeuristics !== '';
+    const dangerousSettings = [];
+    if (dsHeuristics) {
+        if (dsHeuristics.length >= 7 && dsHeuristics[6] === '2') {
+            dangerousSettings.push('Anonymous LDAP operations allowed (position 7)');
+        }
+        if (dsHeuristics.length >= 3 && dsHeuristics[2] === '1') {
+            dangerousSettings.push('List Object mode disabled (position 3)');
+        }
+    }
+    return {
+        type: 'DS_HEURISTICS_MODIFIED',
+        severity: 'medium',
+        category: 'advanced',
+        title: 'dsHeuristics Modified',
+        description: 'The dsHeuristics attribute has been modified from defaults. ' +
+            'This may weaken AD security or enable dangerous features.',
+        count: isModified ? 1 : 0,
+        details: {
+            currentValue: dsHeuristics || '(empty)',
+            dangerousSettings: dangerousSettings.length > 0 ? dangerousSettings : undefined,
+            recommendation: 'Review dsHeuristics value and document any intentional modifications.',
+        },
+    };
+}
+function detectAdminSdHolderModified(domain, _includeDetails) {
+    const adminSdHolderInfo = domain
+        ? domain['adminSDHolderModified']
+        : undefined;
+    return {
+        type: 'ADMIN_SD_HOLDER_MODIFIED',
+        severity: 'high',
+        category: 'advanced',
+        title: 'AdminSDHolder Review Required',
+        description: 'AdminSDHolder permissions should be reviewed. Modifications propagate to all protected accounts ' +
+            '(Domain Admins, Enterprise Admins, etc.) via SDProp process.',
+        count: adminSdHolderInfo ? 1 : 0,
+        details: {
+            recommendation: 'Compare AdminSDHolder ACL against baseline. Look for non-standard principals with permissions.',
+            checkCommand: 'Get-ADObject "CN=AdminSDHolder,CN=System,DC=..." -Properties nTSecurityDescriptor',
+        },
+    };
+}
+function detectExchangePrivEscPath(users, includeDetails) {
+    const exchangeGroups = [
+        'Exchange Trusted Subsystem',
+        'Exchange Windows Permissions',
+        'Organization Management',
+        'Exchange Servers',
+    ];
+    const affected = users.filter((u) => {
+        if (!u.enabled || !u.memberOf)
+            return false;
+        return u.memberOf.some((dn) => exchangeGroups.some((eg) => dn.toLowerCase().includes(eg.toLowerCase())));
+    });
+    return {
+        type: 'EXCHANGE_PRIV_ESC_PATH',
+        severity: 'critical',
+        category: 'advanced',
+        title: 'Exchange Privilege Escalation Risk',
+        description: 'Users in Exchange security groups with potentially dangerous permissions. ' +
+            'Exchange Trusted Subsystem has WriteDacl on domain by default (CVE-2019-1166).',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+        details: {
+            exchangeGroups: exchangeGroups,
+            recommendation: 'Review Exchange group permissions on domain head. Apply PrivExchange mitigations.',
+            reference: 'CVE-2019-1166, PrivExchange',
+        },
+    };
+}
+function detectAdvancedVulnerabilities(users, computers, domain, templates = [], cas = [], fsps = [], includeDetails, options = {}) {
+    const { gpoSettings = null, anonymousAccessAllowed = false } = options;
+    return [
+        detectShadowCredentials(users, includeDetails),
+        detectRbcdAbuse(users, includeDetails),
+        detectLdapSigningDisabled(gpoSettings, domain, includeDetails),
+        detectSmbSigningDisabled(gpoSettings, domain, includeDetails),
+        detectEsc1VulnerableTemplate(templates, includeDetails),
+        detectEsc2AnyPurpose(templates, includeDetails),
+        detectEsc3EnrollmentAgent(templates, includeDetails),
+        detectEsc4VulnerableTemplateAcl(templates, includeDetails),
+        detectEsc6EditfAttributeSubjectAltName2(cas, includeDetails),
+        detectLapsPasswordReadable(computers, includeDetails),
+        detectReplicationRights(users, includeDetails),
+        detectDcsyncCapable(users, includeDetails),
+        detectMachineAccountQuotaHigh(domain, includeDetails),
+        detectLdapChannelBindingDisabled(gpoSettings, domain, includeDetails),
+        detectSmbV1Enabled(gpoSettings, domain, includeDetails),
+        detectEsc8HttpEnrollment(cas, includeDetails),
+        detectLapsNotDeployed(computers, includeDetails),
+        detectLapsLegacyAttribute(computers, includeDetails),
+        detectDuplicateSpn(users, includeDetails),
+        detectWeakPasswordPolicy(domain, includeDetails),
+        detectWeakKerberosPolicy(domain, includeDetails),
+        detectMachineAccountQuotaAbuse(domain, includeDetails),
+        detectDelegationPrivilege(users, includeDetails),
+        detectForeignSecurityPrincipals(fsps, includeDetails),
+        detectNtlmRelayOpportunity(domain, includeDetails),
+        detectAdcsWeakPermissions(templates, includeDetails),
+        detectDangerousLogonScripts(users, includeDetails),
+        detectRecycleBinDisabled(domain, includeDetails),
+        detectAnonymousLdapAccess(anonymousAccessAllowed, domain, includeDetails),
+        detectAuditPolicyWeak(gpoSettings, domain, includeDetails),
+        detectPowershellLoggingDisabled(gpoSettings, domain, includeDetails),
+        detectLapsPasswordSet(computers, includeDetails),
+        detectLapsPasswordLeaked(computers, includeDetails),
+        detectDsHeuristicsModified(domain, includeDetails),
+        detectAdminSdHolderModified(domain, includeDetails),
+        detectExchangePrivEscPath(users, includeDetails),
+    ].filter((finding) => finding.count > 0 ||
+        finding.type === 'SMB_SIGNING_DISABLED' ||
+        finding.type === 'LDAP_SIGNING_DISABLED');
+}
+//# sourceMappingURL=advanced.detector.js.map