@etcsec-com/etc-collector 1.4.0

package/dist/services/audit/detectors/ad/computers.detector.js

@@ -0,0 +1,799 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectComputerConstrainedDelegation = detectComputerConstrainedDelegation;
+exports.detectComputerRbcd = detectComputerRbcd;
+exports.detectComputerInAdminGroup = detectComputerInAdminGroup;
+exports.detectComputerDcsyncRights = detectComputerDcsyncRights;
+exports.detectComputerUnconstrainedDelegation = detectComputerUnconstrainedDelegation;
+exports.detectComputerStaleInactive = detectComputerStaleInactive;
+exports.detectComputerPasswordOld = detectComputerPasswordOld;
+exports.detectComputerWithSpns = detectComputerWithSpns;
+exports.detectComputerNoLaps = detectComputerNoLaps;
+exports.detectComputerAclAbuse = detectComputerAclAbuse;
+exports.detectComputerDisabledNotDeleted = detectComputerDisabledNotDeleted;
+exports.detectComputerWrongOu = detectComputerWrongOu;
+exports.detectComputerWeakEncryption = detectComputerWeakEncryption;
+exports.detectComputerDescriptionSensitive = detectComputerDescriptionSensitive;
+exports.detectComputerPreWindows2000 = detectComputerPreWindows2000;
+exports.detectComputerAdminCount = detectComputerAdminCount;
+exports.detectComputerSmbSigningDisabled = detectComputerSmbSigningDisabled;
+exports.detectComputerObsoleteOS = detectComputerObsoleteOS;
+exports.detectComputerNeverLoggedOn = detectComputerNeverLoggedOn;
+exports.detectComputerPreCreated = detectComputerPreCreated;
+exports.detectDcNotInDcOu = detectDcNotInDcOu;
+exports.detectComputerDuplicateSpn = detectComputerDuplicateSpn;
+exports.detectServerNoAdminGroup = detectServerNoAdminGroup;
+exports.detectWorkstationInServerOu = detectWorkstationInServerOu;
+exports.detectComputerNoBitlocker = detectComputerNoBitlocker;
+exports.detectComputerLegacyProtocol = detectComputerLegacyProtocol;
+exports.detectComputersVulnerabilities = detectComputersVulnerabilities;
+const entity_converter_1 = require("../../../../utils/entity-converter");
+const FILETIME_EPOCH_OFFSET = 11644473600000;
+function toTimestamp(value) {
+    if (!value)
+        return null;
+    if (value instanceof Date) {
+        const time = value.getTime();
+        return isNaN(time) ? null : time;
+    }
+    if (typeof value === 'string') {
+        if (value.includes('-') && value.includes('T')) {
+            const date = new Date(value);
+            const time = date.getTime();
+            return isNaN(time) ? null : time;
+        }
+        const gtMatch = value.match(/^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})/);
+        if (gtMatch && gtMatch[1] && gtMatch[2] && gtMatch[3] && gtMatch[4] && gtMatch[5] && gtMatch[6]) {
+            const date = new Date(Date.UTC(parseInt(gtMatch[1], 10), parseInt(gtMatch[2], 10) - 1, parseInt(gtMatch[3], 10), parseInt(gtMatch[4], 10), parseInt(gtMatch[5], 10), parseInt(gtMatch[6], 10)));
+            const time = date.getTime();
+            return isNaN(time) ? null : time;
+        }
+        const parsed = parseInt(value, 10);
+        if (!isNaN(parsed) && parsed > 0) {
+            return filetimeToTimestamp(parsed);
+        }
+        return null;
+    }
+    if (typeof value === 'number') {
+        if (value <= 0)
+            return null;
+        if (value > 100000000000000) {
+            return filetimeToTimestamp(value);
+        }
+        if (value > 946684800000 && value < 4102444800000) {
+            return value;
+        }
+        if (value > 946684800 && value < 4102444800) {
+            return value * 1000;
+        }
+        return filetimeToTimestamp(value);
+    }
+    return null;
+}
+function filetimeToTimestamp(filetime) {
+    if (filetime === 0 || filetime >= Number.MAX_SAFE_INTEGER) {
+        return null;
+    }
+    const ms = filetime / 10000 - FILETIME_EPOCH_OFFSET;
+    if (ms < 0 || ms > 4102444800000) {
+        return null;
+    }
+    return ms;
+}
+function detectComputerConstrainedDelegation(computers, includeDetails) {
+    const affected = computers.filter((c) => {
+        const delegateTo = c['msDS-AllowedToDelegateTo'];
+        return delegateTo && (Array.isArray(delegateTo) ? delegateTo.length > 0 : delegateTo !== '');
+    });
+    return {
+        type: 'COMPUTER_CONSTRAINED_DELEGATION',
+        severity: 'critical',
+        category: 'computers',
+        title: 'Computer Constrained Delegation',
+        description: 'Computer with constrained Kerberos delegation. Can impersonate users to specified services.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedComputerEntities)(affected) : undefined,
+    };
+}
+function detectComputerRbcd(computers, includeDetails) {
+    const affected = computers.filter((c) => {
+        const rbcdAttr = c['msDS-AllowedToActOnBehalfOfOtherIdentity'];
+        return rbcdAttr && (Array.isArray(rbcdAttr) ? rbcdAttr.length > 0 : rbcdAttr !== '');
+    });
+    return {
+        type: 'COMPUTER_RBCD',
+        severity: 'critical',
+        category: 'computers',
+        title: 'Computer RBCD',
+        description: 'Computer with Resource-Based Constrained Delegation. Enables privilege escalation via RBCD attack.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedComputerEntities)(affected) : undefined,
+    };
+}
+function detectComputerInAdminGroup(computers, includeDetails) {
+    const adminGroups = ['Domain Admins', 'Enterprise Admins'];
+    const affected = computers.filter((c) => {
+        const memberOf = c.memberOf;
+        if (!memberOf)
+            return false;
+        return memberOf.some((dn) => adminGroups.some((group) => dn.includes(`CN=${group}`)));
+    });
+    return {
+        type: 'COMPUTER_IN_ADMIN_GROUP',
+        severity: 'critical',
+        category: 'computers',
+        title: 'Computer in Admin Group',
+        description: 'Computer account in Domain Admins or Enterprise Admins. Computer compromise leads to domain admin access.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedComputerEntities)(affected) : undefined,
+    };
+}
+function detectComputerDcsyncRights(computers, includeDetails) {
+    const affected = computers.filter((c) => {
+        return 'replicationRights' in c && c.replicationRights;
+    });
+    return {
+        type: 'COMPUTER_DCSYNC_RIGHTS',
+        severity: 'critical',
+        category: 'computers',
+        title: 'Computer DCSync Rights',
+        description: 'Computer with DCSync replication rights. Can extract all domain password hashes.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedComputerEntities)(affected) : undefined,
+    };
+}
+function detectComputerUnconstrainedDelegation(computers, includeDetails) {
+    const affected = computers.filter((c) => {
+        const uac = c.userAccountControl;
+        if (!uac)
+            return false;
+        return (uac & 0x80000) !== 0;
+    });
+    return {
+        type: 'COMPUTER_UNCONSTRAINED_DELEGATION',
+        severity: 'critical',
+        category: 'computers',
+        title: 'Computer Unconstrained Delegation',
+        description: 'Computer with unconstrained delegation enabled. Servers can be used for privilege escalation attacks.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedComputerEntities)(affected) : undefined,
+    };
+}
+function detectComputerStaleInactive(computers, includeDetails) {
+    const now = Date.now();
+    const ninetyDaysAgo = now - 90 * 24 * 60 * 60 * 1000;
+    const affected = computers.filter((c) => {
+        if (!c.enabled)
+            return false;
+        const lastLogonTime = toTimestamp(c.lastLogon) ?? toTimestamp(c['lastLogonTimestamp']);
+        if (!lastLogonTime)
+            return false;
+        return lastLogonTime < ninetyDaysAgo;
+    });
+    return {
+        type: 'COMPUTER_STALE_INACTIVE',
+        severity: 'high',
+        category: 'computers',
+        title: 'Computer Stale/Inactive',
+        description: 'Computer inactive for 90+ days. Orphaned computer accounts could be exploited without detection.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedComputerEntities)(affected) : undefined,
+    };
+}
+function detectComputerPasswordOld(computers, includeDetails) {
+    const now = Date.now();
+    const ninetyDaysAgo = now - 90 * 24 * 60 * 60 * 1000;
+    let debugStats = { total: 0, disabled: 0, noPwdLastSet: 0, recent: 0, old: 0 };
+    const affected = computers.filter((c) => {
+        debugStats.total++;
+        if (!c.enabled) {
+            debugStats.disabled++;
+            return false;
+        }
+        const pwdLastSet = toTimestamp(c.pwdLastSet) ?? toTimestamp(c.passwordLastSet);
+        if (!pwdLastSet) {
+            debugStats.noPwdLastSet++;
+            return false;
+        }
+        if (pwdLastSet < ninetyDaysAgo) {
+            debugStats.old++;
+            return true;
+        }
+        debugStats.recent++;
+        return false;
+    });
+    return {
+        type: 'COMPUTER_PASSWORD_OLD',
+        severity: 'high',
+        category: 'computers',
+        title: 'Computer Password Old',
+        description: 'Computer password not changed for 90+ days. Increases risk of password-based attacks.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedComputerEntities)(affected) : undefined,
+        details: {
+            debug: debugStats,
+            threshold: '90 days',
+            checkDate: new Date(ninetyDaysAgo).toISOString(),
+        },
+    };
+}
+function detectComputerWithSpns(computers, includeDetails) {
+    const affected = computers.filter((c) => {
+        const spns = c.servicePrincipalName;
+        return spns && spns.length > 0;
+    });
+    return {
+        type: 'COMPUTER_WITH_SPNS',
+        severity: 'high',
+        category: 'computers',
+        title: 'Computer with SPNs',
+        description: 'Computer with Service Principal Names. Enables Kerberoasting attack against computer account.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedComputerEntities)(affected) : undefined,
+    };
+}
+function detectComputerNoLaps(computers, includeDetails) {
+    const total = computers.length;
+    const disabled = computers.filter((c) => !c.enabled).length;
+    const enabled = total - disabled;
+    const domainControllers = computers.filter((c) => {
+        const uac = c.userAccountControl;
+        return uac && (uac & 0x2000) !== 0;
+    }).length;
+    let hasLegacyLapsSchema = false;
+    let hasWindowsLapsSchema = false;
+    let withLegacyLaps = 0;
+    let withWindowsLaps = 0;
+    const affected = computers.filter((c) => {
+        if (!c.enabled)
+            return false;
+        const uac = c.userAccountControl;
+        if (uac && (uac & 0x2000) !== 0)
+            return false;
+        const comp = c;
+        const legacyLaps = comp['ms-Mcs-AdmPwd'];
+        const legacyLapsExpiry = comp['ms-Mcs-AdmPwdExpirationTime'];
+        const isValidLapsValue = (val) => {
+            if (val === undefined || val === null || val === '')
+                return false;
+            if (Array.isArray(val) && val.length === 0)
+                return false;
+            if (val === '0' || val === 0)
+                return false;
+            return true;
+        };
+        if (isValidLapsValue(legacyLaps) || isValidLapsValue(legacyLapsExpiry)) {
+            hasLegacyLapsSchema = true;
+        }
+        const hasLegacyLaps = isValidLapsValue(legacyLaps) || isValidLapsValue(legacyLapsExpiry);
+        if (hasLegacyLaps)
+            withLegacyLaps++;
+        const windowsLaps = comp['msLAPS-Password'];
+        const windowsLapsExpiry = comp['msLAPS-PasswordExpirationTime'];
+        if (isValidLapsValue(windowsLaps) || isValidLapsValue(windowsLapsExpiry)) {
+            hasWindowsLapsSchema = true;
+        }
+        const hasWindowsLaps = isValidLapsValue(windowsLaps) || isValidLapsValue(windowsLapsExpiry);
+        if (hasWindowsLaps)
+            withWindowsLaps++;
+        return !hasLegacyLaps && !hasWindowsLaps;
+    });
+    const schemaExtended = hasLegacyLapsSchema || hasWindowsLapsSchema;
+    const eligibleComputers = enabled - domainControllers;
+    return {
+        type: 'COMPUTER_NO_LAPS',
+        severity: !schemaExtended ? 'critical' : 'high',
+        category: 'computers',
+        title: !schemaExtended ? 'LAPS Not Deployed (Schema Not Extended)' : 'Computer No LAPS',
+        description: !schemaExtended
+            ? 'LAPS schema is not extended in Active Directory. ALL local admin passwords are unmanaged and likely shared across computers.'
+            : 'Computer without LAPS deployed. Shared/static local admin passwords across workstations.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedComputerEntities)(affected) : undefined,
+        details: {
+            debug: {
+                total,
+                enabled,
+                disabled,
+                domainControllers,
+                eligibleComputers,
+                withLegacyLaps,
+                withWindowsLaps,
+                withoutLaps: affected.length,
+                schemaExtended,
+                hasLegacyLapsSchema,
+                hasWindowsLapsSchema,
+            },
+            recommendation: !schemaExtended
+                ? 'Install LAPS (legacy or Windows LAPS) and extend the AD schema. Then deploy via GPO.'
+                : 'Deploy LAPS to remaining computers via GPO.',
+        },
+    };
+}
+function detectComputerAclAbuse(computers, includeDetails) {
+    const affected = computers.filter((c) => {
+        return 'dangerousAcl' in c && c.dangerousAcl;
+    });
+    return {
+        type: 'COMPUTER_ACL_ABUSE',
+        severity: 'high',
+        category: 'computers',
+        title: 'Computer ACL Abuse',
+        description: 'Computer with dangerous ACL permissions. Can modify computer object properties and escalate privileges.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedComputerEntities)(affected) : undefined,
+    };
+}
+function detectComputerDisabledNotDeleted(computers, includeDetails) {
+    const now = Date.now();
+    const thirtyDaysAgo = now - 30 * 24 * 60 * 60 * 1000;
+    const debugStats = { total: 0, enabled: 0, noWhenChanged: 0, recent: 0, old: 0, sampleDates: [] };
+    const affected = computers.filter((c) => {
+        debugStats.total++;
+        if (c.enabled) {
+            debugStats.enabled++;
+            return false;
+        }
+        const rawWhenChanged = c.whenChanged;
+        const whenChangedTime = toTimestamp(rawWhenChanged);
+        if (debugStats.sampleDates.length < 5) {
+            debugStats.sampleDates.push({
+                name: c.sAMAccountName || 'unknown',
+                raw: rawWhenChanged,
+                rawType: typeof rawWhenChanged,
+                rawStringified: JSON.stringify(rawWhenChanged),
+                parsed: whenChangedTime,
+                asIso: whenChangedTime ? new Date(whenChangedTime).toISOString() : null,
+                whenCreated: c.whenCreated,
+            });
+        }
+        if (!whenChangedTime) {
+            debugStats.noWhenChanged++;
+            return false;
+        }
+        if (whenChangedTime < thirtyDaysAgo) {
+            debugStats.old++;
+            return true;
+        }
+        debugStats.recent++;
+        return false;
+    });
+    return {
+        type: 'COMPUTER_DISABLED_NOT_DELETED',
+        severity: 'medium',
+        category: 'computers',
+        title: 'Computer Disabled Not Deleted',
+        description: 'Disabled computer not deleted (>30 days). Clutters AD, potential security oversight.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedComputerEntities)(affected) : undefined,
+        details: {
+            debug: debugStats,
+            threshold: '30 days',
+            checkDate: new Date(thirtyDaysAgo).toISOString(),
+            nowDate: new Date(now).toISOString(),
+        },
+    };
+}
+function detectComputerWrongOu(computers, includeDetails) {
+    const affected = computers.filter((c) => {
+        const dnLower = c.dn.toLowerCase();
+        const isInDefaultContainer = dnLower.includes(',cn=computers,dc=');
+        return isInDefaultContainer;
+    });
+    return {
+        type: 'COMPUTER_WRONG_OU',
+        severity: 'medium',
+        category: 'computers',
+        title: 'Computer in Default Container',
+        description: 'Computer in default Computers container instead of an organizational OU. ' +
+            'May not receive proper Group Policy and indicates lack of organization.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedComputerEntities)(affected) : undefined,
+    };
+}
+function detectComputerWeakEncryption(computers, includeDetails) {
+    const affected = computers.filter((c) => {
+        const encTypes = c['msDS-SupportedEncryptionTypes'];
+        if (typeof encTypes !== 'number')
+            return false;
+        return (encTypes & 0x18) === 0 && (encTypes & 0x7) !== 0;
+    });
+    return {
+        type: 'COMPUTER_WEAK_ENCRYPTION',
+        severity: 'medium',
+        category: 'computers',
+        title: 'Computer Weak Encryption',
+        description: 'Computer with weak encryption types (DES/RC4 only). Vulnerable to Kerberos downgrade attacks.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedComputerEntities)(affected) : undefined,
+    };
+}
+function detectComputerDescriptionSensitive(computers, includeDetails) {
+    const sensitivePatterns = [
+        /password|passwd|pwd/i,
+        /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/,
+        /admin|root|sa/i,
+    ];
+    const affected = computers.filter((c) => {
+        const rawDesc = c.description;
+        const description = (0, entity_converter_1.ldapAttrToString)(rawDesc);
+        if (!description)
+            return false;
+        return sensitivePatterns.some((pattern) => pattern.test(description));
+    });
+    return {
+        type: 'COMPUTER_DESCRIPTION_SENSITIVE',
+        severity: 'medium',
+        category: 'computers',
+        title: 'Computer Description Sensitive',
+        description: 'Computer description contains sensitive data (passwords, IPs, etc.). Information disclosure.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedComputerEntities)(affected) : undefined,
+    };
+}
+function detectComputerPreWindows2000(computers, includeDetails) {
+    const affected = computers.filter((c) => {
+        const os = (0, entity_converter_1.ldapAttrToString)(c.operatingSystem);
+        if (!os)
+            return false;
+        return /Windows NT|Windows 2000|Windows 95|Windows 98/i.test(os);
+    });
+    return {
+        type: 'COMPUTER_PRE_WINDOWS_2000',
+        severity: 'medium',
+        category: 'computers',
+        title: 'Pre-Windows 2000 Computer',
+        description: 'Pre-Windows 2000 compatible computer. Weak security settings, potential compatibility exploits.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedComputerEntities)(affected) : undefined,
+    };
+}
+function detectComputerAdminCount(computers, includeDetails) {
+    const affected = computers.filter((c) => {
+        const adminCount = c.adminCount;
+        return adminCount === 1;
+    });
+    return {
+        type: 'COMPUTER_ADMIN_COUNT',
+        severity: 'low',
+        category: 'computers',
+        title: 'Computer adminCount Set',
+        description: 'Computer with adminCount attribute set to 1. May indicate current or former administrative privileges.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedComputerEntities)(affected) : undefined,
+    };
+}
+function detectComputerSmbSigningDisabled(computers, includeDetails) {
+    const affected = computers.filter((c) => {
+        return 'smbSigningDisabled' in c && c.smbSigningDisabled;
+    });
+    return {
+        type: 'COMPUTER_SMB_SIGNING_DISABLED',
+        severity: 'low',
+        category: 'computers',
+        title: 'Computer SMB Signing Disabled',
+        description: 'Computer with SMB signing disabled. Vulnerable to SMB relay attacks (informational finding).',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedComputerEntities)(affected) : undefined,
+    };
+}
+const OBSOLETE_OS_PATTERNS = [
+    {
+        pattern: /Windows XP/i,
+        type: 'COMPUTER_OS_OBSOLETE_XP',
+        severity: 'critical',
+        osName: 'Windows XP',
+    },
+    {
+        pattern: /Server 2003/i,
+        type: 'COMPUTER_OS_OBSOLETE_2003',
+        severity: 'critical',
+        osName: 'Windows Server 2003',
+    },
+    {
+        pattern: /Server 2008(?!\s*R2)/i,
+        type: 'COMPUTER_OS_OBSOLETE_2008',
+        severity: 'high',
+        osName: 'Windows Server 2008',
+    },
+    {
+        pattern: /Windows Vista/i,
+        type: 'COMPUTER_OS_OBSOLETE_VISTA',
+        severity: 'high',
+        osName: 'Windows Vista',
+    },
+];
+function detectComputerObsoleteOS(computers, includeDetails) {
+    return OBSOLETE_OS_PATTERNS.map(({ pattern, type, severity, osName }) => {
+        const affected = computers.filter((c) => {
+            const os = (0, entity_converter_1.ldapAttrToString)(c.operatingSystem);
+            return os && pattern.test(os);
+        });
+        return {
+            type,
+            severity,
+            category: 'computers',
+            title: `Obsolete OS: ${osName}`,
+            description: `Computers running ${osName}, an unsupported operating system. No security patches available, making these systems highly vulnerable to exploitation.`,
+            count: affected.length,
+            affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedComputerEntities)(affected) : undefined,
+        };
+    }).filter((f) => f.count > 0);
+}
+function detectComputerNeverLoggedOn(computers, includeDetails) {
+    const affected = computers.filter((c) => {
+        if (!c.enabled)
+            return false;
+        const lastLogonTime = toTimestamp(c.lastLogon) ?? toTimestamp(c['lastLogonTimestamp']);
+        return !lastLogonTime;
+    });
+    return {
+        type: 'COMPUTER_NEVER_LOGGED_ON',
+        severity: 'medium',
+        category: 'computers',
+        title: 'Computer Never Logged On',
+        description: 'Enabled computer accounts that have never authenticated to the domain. These may be orphaned accounts from failed deployments or unused systems that should be cleaned up.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedComputerEntities)(affected) : undefined,
+    };
+}
+function detectComputerPreCreated(computers, includeDetails) {
+    const affected = computers.filter((c) => {
+        if (c.enabled)
+            return false;
+        const lastLogonTime = toTimestamp(c.lastLogon) ?? toTimestamp(c['lastLogonTimestamp']);
+        return !lastLogonTime;
+    });
+    return {
+        type: 'COMPUTER_PRE_CREATED',
+        severity: 'medium',
+        category: 'computers',
+        title: 'Computer Pre-Created (Staging)',
+        description: 'Disabled computer accounts that have never logged on. These are staging accounts that were created but never deployed. Should be reviewed and cleaned up.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedComputerEntities)(affected) : undefined,
+    };
+}
+function detectDcNotInDcOu(computers, includeDetails) {
+    const dcPatterns = [/^DC\d*/i, /domain controller/i];
+    const affected = computers.filter((c) => {
+        const dnsName = typeof c.dNSHostName === 'string' ? c.dNSHostName : (Array.isArray(c.dNSHostName) ? c.dNSHostName[0] : '');
+        const isDC = dcPatterns.some((p) => p.test(c.sAMAccountName || '')) ||
+            (dnsName && dnsName.toLowerCase().includes('dc')) ||
+            ((c.userAccountControl ?? 0) & 0x2000) !== 0;
+        if (!isDC)
+            return false;
+        const isInDCOU = c.dn.toLowerCase().includes('ou=domain controllers');
+        return !isInDCOU;
+    });
+    return {
+        type: 'DC_NOT_IN_DC_OU',
+        severity: 'high',
+        category: 'computers',
+        title: 'Domain Controller Not in Domain Controllers OU',
+        description: 'Domain Controllers found outside the Domain Controllers OU. This may indicate misconfiguration or an attempt to hide a rogue DC.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedComputerEntities)(affected) : undefined,
+        details: affected.length > 0
+            ? {
+                recommendation: 'Move all Domain Controllers to the Domain Controllers OU for proper GPO application and management.',
+                risks: [
+                    'GPOs targeting Domain Controllers OU may not apply',
+                    'May indicate rogue or compromised DC',
+                    'Security baselines may not be applied correctly',
+                ],
+            }
+            : undefined,
+    };
+}
+function detectComputerDuplicateSpn(computers, includeDetails) {
+    const spnMap = new Map();
+    for (const computer of computers) {
+        const spns = computer['servicePrincipalName'];
+        if (!spns || !Array.isArray(spns))
+            continue;
+        for (const spn of spns) {
+            const normalizedSpn = spn.toLowerCase();
+            if (!spnMap.has(normalizedSpn)) {
+                spnMap.set(normalizedSpn, []);
+            }
+            spnMap.get(normalizedSpn).push(computer);
+        }
+    }
+    const duplicateComputers = new Set();
+    const duplicateSpns = [];
+    for (const [spn, computersList] of spnMap.entries()) {
+        if (computersList.length > 1) {
+            duplicateSpns.push({
+                spn,
+                computers: computersList.map((c) => c.sAMAccountName || c.dn),
+            });
+            computersList.forEach((c) => duplicateComputers.add(c));
+        }
+    }
+    return {
+        type: 'COMPUTER_DUPLICATE_SPN',
+        severity: 'medium',
+        category: 'computers',
+        title: 'Duplicate SPNs Detected',
+        description: 'Multiple computers share the same Service Principal Name. This causes Kerberos authentication failures.',
+        count: duplicateComputers.size,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedComputerEntities)(Array.from(duplicateComputers)) : undefined,
+        details: duplicateSpns.length > 0
+            ? {
+                duplicateSpns: duplicateSpns.slice(0, 10),
+                totalDuplicates: duplicateSpns.length,
+                recommendation: 'Remove duplicate SPNs using setspn -D. Ensure each SPN is unique across the domain.',
+            }
+            : undefined,
+    };
+}
+function detectServerNoAdminGroup(computers, includeDetails) {
+    const serverPatterns = [/server/i, /^srv/i, /^sql/i, /^web/i, /^app/i, /^db/i, /^file/i];
+    const serverOsPatterns = [/server/i];
+    const affected = computers.filter((c) => {
+        const os = (0, entity_converter_1.ldapAttrToString)(c.operatingSystem);
+        const isServer = serverPatterns.some((p) => p.test(c.sAMAccountName || '')) ||
+            (os && serverOsPatterns.some((p) => p.test(os)));
+        if (!isServer)
+            return false;
+        if (!c.enabled)
+            return false;
+        const rawDesc = c['description'];
+        const description = (typeof rawDesc === 'string' ? rawDesc : (Array.isArray(rawDesc) ? rawDesc[0] : '') || '').toLowerCase();
+        const isUnmanaged = description.includes('unmanaged') ||
+            description.includes('legacy') ||
+            description.includes('deprecated');
+        return isUnmanaged;
+    });
+    return {
+        type: 'SERVER_NO_ADMIN_GROUP',
+        severity: 'medium',
+        category: 'computers',
+        title: 'Server Without Managed Admin Group',
+        description: 'Servers identified as unmanaged or without proper administrative group documentation. Local admin access may not be properly controlled.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedComputerEntities)(affected) : undefined,
+        details: affected.length > 0
+            ? {
+                recommendation: 'Create dedicated admin groups for each server (e.g., SRV01-Admins) and document access.',
+                risks: [
+                    'Unknown administrators may have access',
+                    'Audit trail for admin actions may be incomplete',
+                    'Compliance violations for access management',
+                ],
+            }
+            : undefined,
+    };
+}
+function detectWorkstationInServerOu(computers, includeDetails) {
+    const serverOuPatterns = [/ou=servers/i, /ou=server/i, /ou=datacenter/i, /ou=production/i];
+    const workstationOsPatterns = [/windows 10/i, /windows 11/i, /windows 7/i, /windows 8/i];
+    const workstationNamePatterns = [/^ws/i, /^pc/i, /^laptop/i, /^desktop/i, /^nb/i];
+    const affected = computers.filter((c) => {
+        const isInServerOU = serverOuPatterns.some((p) => p.test(c.dn));
+        if (!isInServerOU)
+            return false;
+        const os = (0, entity_converter_1.ldapAttrToString)(c.operatingSystem);
+        const isWorkstation = workstationNamePatterns.some((p) => p.test(c.sAMAccountName || '')) ||
+            (os && workstationOsPatterns.some((p) => p.test(os)));
+        return isWorkstation;
+    });
+    return {
+        type: 'WORKSTATION_IN_SERVER_OU',
+        severity: 'low',
+        category: 'computers',
+        title: 'Workstation in Server OU',
+        description: 'Workstation computers found in server OUs. This causes incorrect GPO application and may indicate organizational issues.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedComputerEntities)(affected) : undefined,
+        details: affected.length > 0
+            ? {
+                recommendation: 'Move workstations to appropriate workstation OUs for proper GPO targeting.',
+                impact: 'Server-targeted GPOs may apply to workstations causing configuration issues.',
+            }
+            : undefined,
+    };
+}
+function detectComputerNoBitlocker(computers, includeDetails) {
+    const serversWithoutBitlocker = computers.filter((c) => {
+        if (!c.enabled)
+            return false;
+        const os = (0, entity_converter_1.ldapAttrToString)(c.operatingSystem).toLowerCase();
+        const isServer = os.includes('server');
+        const hasBitlockerInfo = c['ms-FVE-RecoveryInformation'] !== undefined;
+        return isServer && !hasBitlockerInfo;
+    });
+    return {
+        type: 'COMPUTER_NO_BITLOCKER',
+        severity: 'high',
+        category: 'computers',
+        title: 'BitLocker Not Detected',
+        description: 'Servers without BitLocker recovery information in AD. ' +
+            'Unencrypted disks are vulnerable to physical theft and offline attacks.',
+        count: serversWithoutBitlocker.length,
+        affectedEntities: includeDetails
+            ? (0, entity_converter_1.toAffectedComputerEntities)(serversWithoutBitlocker)
+            : undefined,
+        details: {
+            recommendation: 'Enable BitLocker on all servers and configure AD backup of recovery keys.',
+            note: 'This detection checks for ms-FVE-RecoveryInformation in AD. Standalone BitLocker may not be detected.',
+        },
+    };
+}
+function detectComputerLegacyProtocol(computers, includeDetails) {
+    const legacyOsPatterns = [
+        /Windows XP/i,
+        /Windows 2000/i,
+        /Windows NT/i,
+        /Server 2003/i,
+        /Windows Vista/i,
+    ];
+    const affected = computers.filter((c) => {
+        if (!c.enabled)
+            return false;
+        const os = (0, entity_converter_1.ldapAttrToString)(c.operatingSystem);
+        const hasLegacyOs = legacyOsPatterns.some((p) => p.test(os));
+        if (hasLegacyOs)
+            return true;
+        const encTypes = c['msDS-SupportedEncryptionTypes'];
+        if (encTypes !== undefined) {
+            const onlyLegacy = (encTypes & 0x18) === 0;
+            if (onlyLegacy && encTypes > 0)
+                return true;
+        }
+        return false;
+    });
+    return {
+        type: 'COMPUTER_LEGACY_PROTOCOL',
+        severity: 'medium',
+        category: 'computers',
+        title: 'Legacy Protocol Support',
+        description: 'Computers configured to use legacy protocols (SMBv1, NTLMv1, DES/RC4 only). ' +
+            'These are vulnerable to relay attacks, credential theft, and encryption downgrade.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedComputerEntities)(affected) : undefined,
+        details: {
+            recommendation: 'Upgrade legacy systems or disable legacy protocols. Enable AES encryption support.',
+            protocols: ['SMBv1', 'NTLMv1', 'DES', 'RC4'],
+        },
+    };
+}
+function detectComputersVulnerabilities(computers, includeDetails) {
+    const obsoleteOsFindings = detectComputerObsoleteOS(computers, includeDetails);
+    return [
+        ...obsoleteOsFindings,
+        detectComputerNeverLoggedOn(computers, includeDetails),
+        detectComputerPreCreated(computers, includeDetails),
+        detectComputerConstrainedDelegation(computers, includeDetails),
+        detectComputerRbcd(computers, includeDetails),
+        detectComputerInAdminGroup(computers, includeDetails),
+        detectComputerDcsyncRights(computers, includeDetails),
+        detectComputerUnconstrainedDelegation(computers, includeDetails),
+        detectComputerStaleInactive(computers, includeDetails),
+        detectComputerPasswordOld(computers, includeDetails),
+        detectComputerWithSpns(computers, includeDetails),
+        detectComputerNoLaps(computers, includeDetails),
+        detectComputerAclAbuse(computers, includeDetails),
+        detectComputerDisabledNotDeleted(computers, includeDetails),
+        detectComputerWrongOu(computers, includeDetails),
+        detectComputerWeakEncryption(computers, includeDetails),
+        detectComputerDescriptionSensitive(computers, includeDetails),
+        detectComputerPreWindows2000(computers, includeDetails),
+        detectComputerAdminCount(computers, includeDetails),
+        detectComputerSmbSigningDisabled(computers, includeDetails),
+        detectDcNotInDcOu(computers, includeDetails),
+        detectComputerDuplicateSpn(computers, includeDetails),
+        detectServerNoAdminGroup(computers, includeDetails),
+        detectWorkstationInServerOu(computers, includeDetails),
+        detectComputerNoBitlocker(computers, includeDetails),
+        detectComputerLegacyProtocol(computers, includeDetails),
+    ].filter((finding) => {
+        if (finding.count > 0)
+            return true;
+        if (finding.details?.['debug'])
+            return true;
+        return false;
+    });
+}
+//# sourceMappingURL=computers.detector.js.map