@etcsec-com/etc-collector 1.4.0

package/dist/services/audit/detectors/ad/kerberos.detector.js

@@ -0,0 +1,293 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectAsrepRoastingRisk = detectAsrepRoastingRisk;
+exports.detectUnconstrainedDelegation = detectUnconstrainedDelegation;
+exports.detectGoldenTicketRisk = detectGoldenTicketRisk;
+exports.detectKerberoastingRisk = detectKerberoastingRisk;
+exports.detectConstrainedDelegation = detectConstrainedDelegation;
+exports.detectWeakEncryptionDES = detectWeakEncryptionDES;
+exports.detectAdminAsrepRoastable = detectAdminAsrepRoastable;
+exports.detectWeakEncryptionRC4 = detectWeakEncryptionRC4;
+exports.detectWeakEncryptionFlag = detectWeakEncryptionFlag;
+exports.detectKerberosAesDisabled = detectKerberosAesDisabled;
+exports.detectKerberosRc4Fallback = detectKerberosRc4Fallback;
+exports.detectKerberosTicketLifetimeLong = detectKerberosTicketLifetimeLong;
+exports.detectKerberosRenewableTicketLong = detectKerberosRenewableTicketLong;
+exports.detectKerberosVulnerabilities = detectKerberosVulnerabilities;
+const entity_converter_1 = require("../../../../utils/entity-converter");
+function detectAsrepRoastingRisk(users, includeDetails) {
+    const affected = users.filter((u) => {
+        if (!u.userAccountControl)
+            return false;
+        return (u.userAccountControl & 0x400000) !== 0;
+    });
+    return {
+        type: 'ASREP_ROASTING_RISK',
+        severity: 'critical',
+        category: 'kerberos',
+        title: 'AS-REP Roasting Risk',
+        description: 'User accounts without Kerberos pre-authentication required (UAC 0x400000). Vulnerable to AS-REP roasting attacks.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+function detectUnconstrainedDelegation(users, includeDetails) {
+    const affected = users.filter((u) => {
+        if (!u.userAccountControl)
+            return false;
+        return (u.userAccountControl & 0x80000) !== 0;
+    });
+    return {
+        type: 'UNCONSTRAINED_DELEGATION',
+        severity: 'critical',
+        category: 'kerberos',
+        title: 'Unconstrained Delegation',
+        description: 'User accounts with unconstrained Kerberos delegation enabled (UAC 0x80000). Can impersonate any user.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+function detectGoldenTicketRisk(users, includeDetails) {
+    const krbtgtAccount = users.find((u) => u.sAMAccountName === 'krbtgt');
+    if (!krbtgtAccount || !krbtgtAccount.passwordLastSet) {
+        return {
+            type: 'GOLDEN_TICKET_RISK',
+            severity: 'critical',
+            category: 'kerberos',
+            title: 'Golden Ticket Risk',
+            description: 'krbtgt account password unchanged for 180+ days or password date unavailable. Enables persistent Golden Ticket attacks.',
+            count: 0,
+        };
+    }
+    const now = Date.now();
+    const sixMonthsAgo = now - 180 * 24 * 60 * 60 * 1000;
+    const passwordAge = krbtgtAccount.passwordLastSet.getTime();
+    const isOld = passwordAge < sixMonthsAgo;
+    return {
+        type: 'GOLDEN_TICKET_RISK',
+        severity: 'critical',
+        category: 'kerberos',
+        title: 'Golden Ticket Risk',
+        description: `krbtgt account password unchanged for 180+ days. Enables persistent Golden Ticket attacks.`,
+        count: isOld ? 1 : 0,
+        affectedEntities: includeDetails && isOld ? [krbtgtAccount.dn] : undefined,
+    };
+}
+function detectKerberoastingRisk(users, includeDetails) {
+    const affected = users.filter((u) => {
+        const spns = u['servicePrincipalName'];
+        return spns && Array.isArray(spns) && spns.length > 0;
+    });
+    return {
+        type: 'KERBEROASTING_RISK',
+        severity: 'high',
+        category: 'kerberos',
+        title: 'Kerberoasting Risk',
+        description: 'User accounts with Service Principal Names (SPNs). Vulnerable to Kerberoasting attacks to crack service account passwords.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+function detectConstrainedDelegation(users, includeDetails) {
+    const affected = users.filter((u) => {
+        if (!u.userAccountControl)
+            return false;
+        return (u.userAccountControl & 0x1000000) !== 0;
+    });
+    return {
+        type: 'CONSTRAINED_DELEGATION',
+        severity: 'high',
+        category: 'kerberos',
+        title: 'Constrained Delegation',
+        description: 'User accounts with constrained Kerberos delegation configured (UAC 0x1000000). Can impersonate users to specific services.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+function detectWeakEncryptionDES(users, includeDetails) {
+    const DES_TYPES = 0x3;
+    const affected = users.filter((u) => {
+        if (u.userAccountControl && (u.userAccountControl & 0x200000) !== 0) {
+            return true;
+        }
+        const encTypes = u['msDS-SupportedEncryptionTypes'];
+        if (typeof encTypes === 'number' && (encTypes & DES_TYPES) !== 0) {
+            return true;
+        }
+        return false;
+    });
+    return {
+        type: 'WEAK_ENCRYPTION_DES',
+        severity: 'high',
+        category: 'kerberos',
+        title: 'Weak DES Encryption',
+        description: 'User accounts with DES encryption algorithms enabled (UAC 0x200000 or msDS-SupportedEncryptionTypes). DES is cryptographically broken.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+function detectAdminAsrepRoastable(users, includeDetails) {
+    const privilegedGroups = [
+        'Domain Admins',
+        'Enterprise Admins',
+        'Schema Admins',
+        'Administrators',
+        'Account Operators',
+        'Backup Operators',
+        'Server Operators',
+    ];
+    const affected = users.filter((u) => {
+        if (!u.userAccountControl || (u.userAccountControl & 0x400000) === 0) {
+            return false;
+        }
+        if (!u.memberOf)
+            return false;
+        return u.memberOf.some((dn) => privilegedGroups.some((group) => dn.toUpperCase().includes(`CN=${group.toUpperCase()}`)));
+    });
+    return {
+        type: 'ADMIN_ASREP_ROASTABLE',
+        severity: 'critical',
+        category: 'kerberos',
+        title: 'Privileged Account AS-REP Roastable',
+        description: 'Privileged accounts (Domain Admins, Enterprise Admins, etc.) without Kerberos pre-authentication. ' +
+            'High-value targets for AS-REP roasting attacks - immediate domain compromise risk.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+        details: affected.length > 0 ? {
+            risk: 'CRITICAL - Privileged account password hash can be obtained offline',
+            recommendation: 'Enable Kerberos pre-authentication immediately for all privileged accounts',
+        } : undefined,
+    };
+}
+function detectWeakEncryptionRC4(users, includeDetails) {
+    const affected = users.filter((u) => {
+        const encTypes = u['msDS-SupportedEncryptionTypes'];
+        if (typeof encTypes !== 'number')
+            return false;
+        return (encTypes & 4) !== 0 && (encTypes & 24) === 0;
+    });
+    return {
+        type: 'WEAK_ENCRYPTION_RC4',
+        severity: 'medium',
+        category: 'kerberos',
+        title: 'Weak RC4 Encryption',
+        description: 'User accounts supporting RC4 encryption without AES. RC4 is deprecated and vulnerable to attacks.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+function detectWeakEncryptionFlag(users, includeDetails) {
+    const affected = users.filter((u) => {
+        if (!u.userAccountControl)
+            return false;
+        return (u.userAccountControl & 0x200000) !== 0;
+    });
+    return {
+        type: 'WEAK_ENCRYPTION_FLAG',
+        severity: 'medium',
+        category: 'kerberos',
+        title: 'Weak Encryption Flag',
+        description: 'User accounts with USE_DES_KEY_ONLY flag enabled (UAC 0x200000). Forces weak DES encryption.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+function detectKerberosAesDisabled(users, includeDetails) {
+    const AES_SUPPORT = 0x18;
+    const affected = users.filter((u) => {
+        if (!u.enabled)
+            return false;
+        const encTypes = u['msDS-SupportedEncryptionTypes'];
+        if (encTypes !== undefined && (encTypes & AES_SUPPORT) === 0) {
+            return true;
+        }
+        if (u.userAccountControl && (u.userAccountControl & 0x200000) !== 0) {
+            return true;
+        }
+        return false;
+    });
+    return {
+        type: 'KERBEROS_AES_DISABLED',
+        severity: 'high',
+        category: 'kerberos',
+        title: 'AES Encryption Disabled',
+        description: 'User accounts with AES Kerberos encryption disabled. ' +
+            'Forces use of weaker DES/RC4 encryption vulnerable to offline attacks.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+    };
+}
+function detectKerberosRc4Fallback(users, includeDetails) {
+    const RC4_SUPPORT = 0x4;
+    const AES_SUPPORT = 0x18;
+    const affected = users.filter((u) => {
+        if (!u.enabled)
+            return false;
+        const encTypes = u['msDS-SupportedEncryptionTypes'];
+        if (encTypes === undefined)
+            return false;
+        const hasAes = (encTypes & AES_SUPPORT) !== 0;
+        const hasRc4 = (encTypes & RC4_SUPPORT) !== 0;
+        return hasAes && hasRc4;
+    });
+    return {
+        type: 'KERBEROS_RC4_FALLBACK',
+        severity: 'medium',
+        category: 'kerberos',
+        title: 'RC4 Fallback Enabled',
+        description: 'User accounts support both AES and RC4 encryption. ' +
+            'RC4 fallback enables downgrade attacks even when AES is available.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(affected) : undefined,
+        details: {
+            recommendation: 'Disable RC4 support when AES is available.',
+        },
+    };
+}
+function detectKerberosTicketLifetimeLong(_users, _includeDetails) {
+    return {
+        type: 'KERBEROS_TICKET_LIFETIME_LONG',
+        severity: 'medium',
+        category: 'kerberos',
+        title: 'Kerberos Ticket Lifetime Review',
+        description: 'Kerberos ticket lifetime should be reviewed. ' +
+            'Default of 10 hours is reasonable; longer lifetimes increase attack window.',
+        count: 0,
+        details: {
+            recommendation: 'TGT lifetime should not exceed 10 hours. Service tickets should not exceed 600 minutes.',
+            checkCommand: 'gpresult /r or check Default Domain Policy',
+        },
+    };
+}
+function detectKerberosRenewableTicketLong(_users, _includeDetails) {
+    return {
+        type: 'KERBEROS_RENEWABLE_TICKET_LONG',
+        severity: 'low',
+        category: 'kerberos',
+        title: 'Kerberos Renewable Ticket Lifetime Review',
+        description: 'Renewable ticket lifetime should be reviewed. ' +
+            'Default of 7 days is reasonable; longer allows persistent access with stolen tickets.',
+        count: 0,
+        details: {
+            recommendation: 'Renewable TGT lifetime should not exceed 7 days.',
+        },
+    };
+}
+function detectKerberosVulnerabilities(users, includeDetails) {
+    return [
+        detectAsrepRoastingRisk(users, includeDetails),
+        detectAdminAsrepRoastable(users, includeDetails),
+        detectUnconstrainedDelegation(users, includeDetails),
+        detectGoldenTicketRisk(users, includeDetails),
+        detectKerberoastingRisk(users, includeDetails),
+        detectConstrainedDelegation(users, includeDetails),
+        detectWeakEncryptionDES(users, includeDetails),
+        detectWeakEncryptionRC4(users, includeDetails),
+        detectWeakEncryptionFlag(users, includeDetails),
+        detectKerberosAesDisabled(users, includeDetails),
+        detectKerberosRc4Fallback(users, includeDetails),
+        detectKerberosTicketLifetimeLong(users, includeDetails),
+        detectKerberosRenewableTicketLong(users, includeDetails),
+    ].filter((finding) => finding.count > 0);
+}
+//# sourceMappingURL=kerberos.detector.js.map

package/dist/services/audit/detectors/ad/kerberos.detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kerberos.detector.js","sourceRoot":"","sources":["../../../../../src/services/audit/detectors/ad/kerberos.detector.ts"],"names":[],"mappings":";;AA6BA,0DAeC;AAMD,sEAeC;AAKD,wDA4BC;AAKD,0DAeC;AAMD,kEAeC;AAOD,0DAyBC;AAMD,8DAsCC;AAKD,0DAgBC;AAKD,4DAeC;AAYD,8DA+BC;AAWD,8DA+BC;AAWD,4EAoBC;AAWD,8EAkBC;AAKD,sEAiBC;AAhZD,yEAA4E;AAM5E,SAAgB,uBAAuB,CAAC,KAAe,EAAE,cAAuB;IAC9E,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,IAAI,CAAC,CAAC,CAAC,kBAAkB;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,CAAC,CAAC,CAAC,kBAAkB,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EAAE,mHAAmH;QAChI,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,IAAA,yCAAsB,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KAChF,CAAC;AACJ,CAAC;AAMD,SAAgB,6BAA6B,CAAC,KAAe,EAAE,cAAuB;IACpF,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,IAAI,CAAC,CAAC,CAAC,kBAAkB;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,CAAC,CAAC,CAAC,kBAAkB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,0BAA0B;QACjC,WAAW,EAAE,uGAAuG;QACpH,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,IAAA,yCAAsB,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KAChF,CAAC;AACJ,CAAC;AAKD,SAAgB,sBAAsB,CAAC,KAAe,EAAE,cAAuB;IAC7E,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC;IAEvE,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,CAAC;QACrD,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,oBAAoB;YAC3B,WAAW,EAAE,yHAAyH;YACtI,KAAK,EAAE,CAAC;SACT,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,YAAY,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACrD,MAAM,WAAW,GAAG,aAAa,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;IAC5D,MAAM,KAAK,GAAG,WAAW,GAAG,YAAY,CAAC;IAEzC,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EAAE,4FAA4F;QACzG,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpB,gBAAgB,EAAE,cAAc,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;KAC3E,CAAC;AACJ,CAAC;AAKD,SAAgB,uBAAuB,CAAC,KAAe,EAAE,cAAuB;IAC9E,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,MAAM,IAAI,GAAI,CAAS,CAAC,sBAAsB,CAAC,CAAC;QAChD,OAAO,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EAAE,4HAA4H;QACzI,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,IAAA,yCAAsB,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KAChF,CAAC;AACJ,CAAC;AAMD,SAAgB,2BAA2B,CAAC,KAAe,EAAE,cAAuB;IAClF,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,IAAI,CAAC,CAAC,CAAC,kBAAkB;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,CAAC,CAAC,CAAC,kBAAkB,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EAAE,4HAA4H;QACzI,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,IAAA,yCAAsB,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KAChF,CAAC;AACJ,CAAC;AAOD,SAAgB,uBAAuB,CAAC,KAAe,EAAE,cAAuB;IAC9E,MAAM,SAAS,GAAG,GAAG,CAAC;IAEtB,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAElC,IAAI,CAAC,CAAC,kBAAkB,IAAI,CAAC,CAAC,CAAC,kBAAkB,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACpE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAI,CAAS,CAAC,+BAA+B,CAAC,CAAC;QAC7D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YACjE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EAAE,wIAAwI;QACrJ,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,IAAA,yCAAsB,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KAChF,CAAC;AACJ,CAAC;AAMD,SAAgB,yBAAyB,CAAC,KAAe,EAAE,cAAuB;IAChF,MAAM,gBAAgB,GAAG;QACvB,eAAe;QACf,mBAAmB;QACnB,eAAe;QACf,gBAAgB;QAChB,mBAAmB;QACnB,kBAAkB;QAClB,kBAAkB;KACnB,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAElC,IAAI,CAAC,CAAC,CAAC,kBAAkB,IAAI,CAAC,CAAC,CAAC,kBAAkB,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACrE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,CAAC,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC9B,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAC5B,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CACzF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,qCAAqC;QAC5C,WAAW,EACT,oGAAoG;YACpG,oFAAoF;QACtF,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,IAAA,yCAAsB,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;QAC/E,OAAO,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;YAC7B,IAAI,EAAE,qEAAqE;YAC3E,cAAc,EAAE,4EAA4E;SAC7F,CAAC,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC;AAKD,SAAgB,uBAAuB,CAAC,KAAe,EAAE,cAAuB;IAC9E,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,MAAM,QAAQ,GAAI,CAAS,CAAC,+BAA+B,CAAC,CAAC;QAC7D,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC/C,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EAAE,mGAAmG;QAChH,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,IAAA,yCAAsB,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KAChF,CAAC;AACJ,CAAC;AAKD,SAAgB,wBAAwB,CAAC,KAAe,EAAE,cAAuB;IAC/E,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,IAAI,CAAC,CAAC,CAAC,kBAAkB;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,CAAC,CAAC,CAAC,kBAAkB,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EAAE,8FAA8F;QAC3G,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,IAAA,yCAAsB,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KAChF,CAAC;AACJ,CAAC;AAYD,SAAgB,yBAAyB,CAAC,KAAe,EAAE,cAAuB;IAEhF,MAAM,WAAW,GAAG,IAAI,CAAC;IAEzB,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC7B,MAAM,QAAQ,GAAI,CAA6B,CAAC,+BAA+B,CAElE,CAAC;QAEd,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,CAAC,kBAAkB,IAAI,CAAC,CAAC,CAAC,kBAAkB,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACpE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,yBAAyB;QAChC,WAAW,EACT,uDAAuD;YACvD,wEAAwE;QAC1E,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,IAAA,yCAAsB,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KAChF,CAAC;AACJ,CAAC;AAWD,SAAgB,yBAAyB,CAAC,KAAe,EAAE,cAAuB;IAEhF,MAAM,WAAW,GAAG,GAAG,CAAC;IACxB,MAAM,WAAW,GAAG,IAAI,CAAC;IAEzB,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC7B,MAAM,QAAQ,GAAI,CAA6B,CAAC,+BAA+B,CAElE,CAAC;QACd,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAEzC,MAAM,MAAM,GAAG,CAAC,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,CAAC,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAC9C,OAAO,MAAM,IAAI,MAAM,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,qDAAqD;YACrD,oEAAoE;QACtE,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,IAAA,yCAAsB,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;QAC/E,OAAO,EAAE;YACP,cAAc,EAAE,4CAA4C;SAC7D;KACF,CAAC;AACJ,CAAC;AAWD,SAAgB,gCAAgC,CAC9C,MAAgB,EAChB,eAAwB;IAIxB,OAAO;QACL,IAAI,EAAE,+BAA+B;QACrC,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,iCAAiC;QACxC,WAAW,EACT,+CAA+C;YAC/C,6EAA6E;QAC/E,KAAK,EAAE,CAAC;QACR,OAAO,EAAE;YACP,cAAc,EAAE,yFAAyF;YACzG,YAAY,EAAE,4CAA4C;SAC3D;KACF,CAAC;AACJ,CAAC;AAWD,SAAgB,iCAAiC,CAC/C,MAAgB,EAChB,eAAwB;IAGxB,OAAO;QACL,IAAI,EAAE,gCAAgC;QACtC,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,2CAA2C;QAClD,WAAW,EACT,gDAAgD;YAChD,uFAAuF;QACzF,KAAK,EAAE,CAAC;QACR,OAAO,EAAE;YACP,cAAc,EAAE,kDAAkD;SACnE;KACF,CAAC;AACJ,CAAC;AAKD,SAAgB,6BAA6B,CAAC,KAAe,EAAE,cAAuB;IACpF,OAAO;QACL,uBAAuB,CAAC,KAAK,EAAE,cAAc,CAAC;QAC9C,yBAAyB,CAAC,KAAK,EAAE,cAAc,CAAC;QAChD,6BAA6B,CAAC,KAAK,EAAE,cAAc,CAAC;QACpD,sBAAsB,CAAC,KAAK,EAAE,cAAc,CAAC;QAC7C,uBAAuB,CAAC,KAAK,EAAE,cAAc,CAAC;QAC9C,2BAA2B,CAAC,KAAK,EAAE,cAAc,CAAC;QAClD,uBAAuB,CAAC,KAAK,EAAE,cAAc,CAAC;QAC9C,uBAAuB,CAAC,KAAK,EAAE,cAAc,CAAC;QAC9C,wBAAwB,CAAC,KAAK,EAAE,cAAc,CAAC;QAE/C,yBAAyB,CAAC,KAAK,EAAE,cAAc,CAAC;QAChD,yBAAyB,CAAC,KAAK,EAAE,cAAc,CAAC;QAChD,gCAAgC,CAAC,KAAK,EAAE,cAAc,CAAC;QACvD,iCAAiC,CAAC,KAAK,EAAE,cAAc,CAAC;KACzD,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC"}

package/dist/services/audit/detectors/ad/monitoring.detector.d.ts

@@ -0,0 +1,23 @@
+import { ADUser, ADGroup, ADDomain } from '../../../../types/ad.types';
+import { Finding } from '../../../../types/finding.types';
+import { GpoSecuritySettings } from '../../../../providers/smb/smb.provider';
+export interface MonitoringGpoSettings extends GpoSecuritySettings {
+    eventLogSettings?: {
+        securityLogMaxSize?: number;
+        systemLogMaxSize?: number;
+        applicationLogMaxSize?: number;
+    };
+}
+export declare function detectAuditLogonEventsDisabled(gpoSettings: GpoSecuritySettings | null, domain: ADDomain | null, includeDetails: boolean): Finding;
+export declare function detectAuditAccountMgmtDisabled(gpoSettings: GpoSecuritySettings | null, domain: ADDomain | null, includeDetails: boolean): Finding;
+export declare function detectAuditPolicyChangeDisabled(gpoSettings: GpoSecuritySettings | null, domain: ADDomain | null, includeDetails: boolean): Finding;
+export declare function detectAuditPrivilegeUseDisabled(gpoSettings: GpoSecuritySettings | null, domain: ADDomain | null, includeDetails: boolean): Finding;
+export declare function detectNoHoneypotAccounts(users: ADUser[], _includeDetails: boolean): Finding;
+export declare function detectAdminAuditBypass(users: ADUser[], _domain: ADDomain | null, includeDetails: boolean): Finding;
+export declare function detectSecurityLogSizeSmall(gpoSettings: MonitoringGpoSettings | null, domain: ADDomain | null, includeDetails: boolean): Finding;
+export declare function detectNoProtectedUsersMonitoring(users: ADUser[], groups: ADGroup[], includeDetails: boolean): Finding;
+export interface MonitoringDetectorOptions {
+    gpoSettings?: MonitoringGpoSettings | null;
+}
+export declare function detectMonitoringVulnerabilities(users: ADUser[], groups: ADGroup[], domain: ADDomain | null, includeDetails: boolean, options?: MonitoringDetectorOptions): Finding[];
+//# sourceMappingURL=monitoring.detector.d.ts.map

package/dist/services/audit/detectors/ad/monitoring.detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"monitoring.detector.d.ts","sourceRoot":"","sources":["../../../../../src/services/audit/detectors/ad/monitoring.detector.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,OAAO,EAAE,MAAM,iCAAiC,CAAC;AAE1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAK7E,MAAM,WAAW,qBAAsB,SAAQ,mBAAmB;IAEhE,gBAAgB,CAAC,EAAE;QACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAC;KAChC,CAAC;CACH;AAMD,wBAAgB,8BAA8B,CAC5C,WAAW,EAAE,mBAAmB,GAAG,IAAI,EACvC,MAAM,EAAE,QAAQ,GAAG,IAAI,EACvB,cAAc,EAAE,OAAO,GACtB,OAAO,CA8CT;AAKD,wBAAgB,8BAA8B,CAC5C,WAAW,EAAE,mBAAmB,GAAG,IAAI,EACvC,MAAM,EAAE,QAAQ,GAAG,IAAI,EACvB,cAAc,EAAE,OAAO,GACtB,OAAO,CAuCT;AAKD,wBAAgB,+BAA+B,CAC7C,WAAW,EAAE,mBAAmB,GAAG,IAAI,EACvC,MAAM,EAAE,QAAQ,GAAG,IAAI,EACvB,cAAc,EAAE,OAAO,GACtB,OAAO,CAuCT;AAKD,wBAAgB,+BAA+B,CAC7C,WAAW,EAAE,mBAAmB,GAAG,IAAI,EACvC,MAAM,EAAE,QAAQ,GAAG,IAAI,EACvB,cAAc,EAAE,OAAO,GACtB,OAAO,CAuCT;AAMD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,eAAe,EAAE,OAAO,GAAG,OAAO,CAkD3F;AAMD,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,EAAE,QAAQ,GAAG,IAAI,EACxB,cAAc,EAAE,OAAO,GACtB,OAAO,CA+CT;AAMD,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,qBAAqB,GAAG,IAAI,EACzC,MAAM,EAAE,QAAQ,GAAG,IAAI,EACvB,cAAc,EAAE,OAAO,GACtB,OAAO,CA8CT;AAMD,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,MAAM,EAAE,EACf,MAAM,EAAE,OAAO,EAAE,EACjB,cAAc,EAAE,OAAO,GACtB,OAAO,CAoDT;AAKD,MAAM,WAAW,yBAAyB;IAExC,WAAW,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;CAC5C;AAKD,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,MAAM,EAAE,EACf,MAAM,EAAE,OAAO,EAAE,EACjB,MAAM,EAAE,QAAQ,GAAG,IAAI,EACvB,cAAc,EAAE,OAAO,EACvB,OAAO,GAAE,yBAA8B,GACtC,OAAO,EAAE,CAeX"}

package/dist/services/audit/detectors/ad/monitoring.detector.js

@@ -0,0 +1,328 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectAuditLogonEventsDisabled = detectAuditLogonEventsDisabled;
+exports.detectAuditAccountMgmtDisabled = detectAuditAccountMgmtDisabled;
+exports.detectAuditPolicyChangeDisabled = detectAuditPolicyChangeDisabled;
+exports.detectAuditPrivilegeUseDisabled = detectAuditPrivilegeUseDisabled;
+exports.detectNoHoneypotAccounts = detectNoHoneypotAccounts;
+exports.detectAdminAuditBypass = detectAdminAuditBypass;
+exports.detectSecurityLogSizeSmall = detectSecurityLogSizeSmall;
+exports.detectNoProtectedUsersMonitoring = detectNoProtectedUsersMonitoring;
+exports.detectMonitoringVulnerabilities = detectMonitoringVulnerabilities;
+const entity_converter_1 = require("../../../../utils/entity-converter");
+function detectAuditLogonEventsDisabled(gpoSettings, domain, includeDetails) {
+    if (gpoSettings?.auditPolicies && gpoSettings.auditPolicies.length > 0) {
+        const auditPolicies = gpoSettings.auditPolicies;
+        const logonCategories = ['Account Logon', 'Logon/Logoff', 'Logon'];
+        const hasLogonAudit = auditPolicies.some((p) => logonCategories.some((cat) => p.category.includes(cat)) && (p.success || p.failure));
+        return {
+            type: 'AUDIT_LOGON_EVENTS_DISABLED',
+            severity: 'high',
+            category: 'monitoring',
+            title: 'Logon Events Not Audited',
+            description: 'Logon events are not being audited. Failed and successful authentication attempts will not be logged, hindering intrusion detection.',
+            count: hasLogonAudit ? 0 : 1,
+            affectedEntities: includeDetails && !hasLogonAudit && domain ? [domain.dn] : undefined,
+            details: !hasLogonAudit
+                ? {
+                    recommendation: 'Enable "Audit Logon Events" and "Audit Account Logon Events" for both Success and Failure.',
+                    missingCategories: logonCategories,
+                    attacksUndetected: [
+                        'Brute force attacks',
+                        'Password spraying',
+                        'Pass-the-hash',
+                        'Kerberos ticket attacks',
+                    ],
+                }
+                : undefined,
+        };
+    }
+    return {
+        type: 'AUDIT_LOGON_EVENTS_DISABLED',
+        severity: 'high',
+        category: 'monitoring',
+        title: 'Logon Audit Configuration Unknown',
+        description: 'Unable to determine logon audit configuration. Manual review recommended.',
+        count: 0,
+        details: {
+            note: 'GPO audit settings not available. Check Advanced Audit Policy Configuration manually.',
+        },
+    };
+}
+function detectAuditAccountMgmtDisabled(gpoSettings, domain, includeDetails) {
+    if (gpoSettings?.auditPolicies && gpoSettings.auditPolicies.length > 0) {
+        const auditPolicies = gpoSettings.auditPolicies;
+        const hasAccountMgmtAudit = auditPolicies.some((p) => p.category.includes('Account Management') && (p.success || p.failure));
+        return {
+            type: 'AUDIT_ACCOUNT_MGMT_DISABLED',
+            severity: 'high',
+            category: 'monitoring',
+            title: 'Account Management Not Audited',
+            description: 'Account management events are not being audited. User/group creation, modification, and deletion will not be logged.',
+            count: hasAccountMgmtAudit ? 0 : 1,
+            affectedEntities: includeDetails && !hasAccountMgmtAudit && domain ? [domain.dn] : undefined,
+            details: !hasAccountMgmtAudit
+                ? {
+                    recommendation: 'Enable "Audit Account Management" for both Success and Failure.',
+                    attacksUndetected: [
+                        'Unauthorized account creation',
+                        'Privilege escalation via group membership',
+                        'Backdoor accounts',
+                        'Account takeover',
+                    ],
+                }
+                : undefined,
+        };
+    }
+    return {
+        type: 'AUDIT_ACCOUNT_MGMT_DISABLED',
+        severity: 'high',
+        category: 'monitoring',
+        title: 'Account Management Audit Configuration Unknown',
+        description: 'Unable to determine account management audit configuration.',
+        count: 0,
+    };
+}
+function detectAuditPolicyChangeDisabled(gpoSettings, domain, includeDetails) {
+    if (gpoSettings?.auditPolicies && gpoSettings.auditPolicies.length > 0) {
+        const auditPolicies = gpoSettings.auditPolicies;
+        const hasPolicyChangeAudit = auditPolicies.some((p) => p.category.includes('Policy Change') && (p.success || p.failure));
+        return {
+            type: 'AUDIT_POLICY_CHANGE_DISABLED',
+            severity: 'high',
+            category: 'monitoring',
+            title: 'Policy Changes Not Audited',
+            description: 'Policy change events are not being audited. GPO modifications and security policy changes will not be logged.',
+            count: hasPolicyChangeAudit ? 0 : 1,
+            affectedEntities: includeDetails && !hasPolicyChangeAudit && domain ? [domain.dn] : undefined,
+            details: !hasPolicyChangeAudit
+                ? {
+                    recommendation: 'Enable "Audit Policy Change" for both Success and Failure.',
+                    attacksUndetected: [
+                        'GPO poisoning',
+                        'Security policy weakening',
+                        'Audit policy tampering',
+                        'Firewall rule modifications',
+                    ],
+                }
+                : undefined,
+        };
+    }
+    return {
+        type: 'AUDIT_POLICY_CHANGE_DISABLED',
+        severity: 'high',
+        category: 'monitoring',
+        title: 'Policy Change Audit Configuration Unknown',
+        description: 'Unable to determine policy change audit configuration.',
+        count: 0,
+    };
+}
+function detectAuditPrivilegeUseDisabled(gpoSettings, domain, includeDetails) {
+    if (gpoSettings?.auditPolicies && gpoSettings.auditPolicies.length > 0) {
+        const auditPolicies = gpoSettings.auditPolicies;
+        const hasPrivilegeUseAudit = auditPolicies.some((p) => p.category.includes('Privilege Use') && (p.success || p.failure));
+        return {
+            type: 'AUDIT_PRIVILEGE_USE_DISABLED',
+            severity: 'medium',
+            category: 'monitoring',
+            title: 'Privilege Use Not Audited',
+            description: 'Privilege use events are not being audited. Sensitive privilege usage will not be logged.',
+            count: hasPrivilegeUseAudit ? 0 : 1,
+            affectedEntities: includeDetails && !hasPrivilegeUseAudit && domain ? [domain.dn] : undefined,
+            details: !hasPrivilegeUseAudit
+                ? {
+                    recommendation: 'Enable "Audit Privilege Use" for Failure events at minimum.',
+                    attacksUndetected: [
+                        'Privilege abuse',
+                        'SeDebugPrivilege exploitation',
+                        'Token manipulation',
+                        'Impersonation attacks',
+                    ],
+                }
+                : undefined,
+        };
+    }
+    return {
+        type: 'AUDIT_PRIVILEGE_USE_DISABLED',
+        severity: 'medium',
+        category: 'monitoring',
+        title: 'Privilege Use Audit Configuration Unknown',
+        description: 'Unable to determine privilege use audit configuration.',
+        count: 0,
+    };
+}
+function detectNoHoneypotAccounts(users, _includeDetails) {
+    const honeypotPatterns = ['honeypot', 'decoy', 'trap', 'canary', 'bait', 'fake'];
+    const attractivePatterns = ['svc_', 'admin_backup', 'admin_old', 'sa_', 'sqlsvc', 'backup_admin'];
+    const honeypots = users.filter((u) => {
+        const rawDesc = u.description;
+        const desc = (typeof rawDesc === 'string' ? rawDesc : '').toLowerCase();
+        const name = (u.sAMAccountName || '').toLowerCase();
+        return honeypotPatterns.some((p) => desc.includes(p) || name.includes(p));
+    });
+    const potentialBaits = users.filter((u) => {
+        const name = (u.sAMAccountName || '').toLowerCase();
+        const hasAttractiveNaming = attractivePatterns.some((p) => name.includes(p));
+        const neverLoggedIn = !u.lastLogon;
+        const isEnabled = u.enabled;
+        return hasAttractiveNaming && neverLoggedIn && isEnabled;
+    });
+    const hasHoneypots = honeypots.length > 0 || potentialBaits.length >= 2;
+    return {
+        type: 'NO_HONEYPOT_ACCOUNTS',
+        severity: 'medium',
+        category: 'monitoring',
+        title: 'No Honeypot/Decoy Accounts Detected',
+        description: 'No honeypot or decoy accounts detected in the directory. These accounts help detect attackers during enumeration phase.',
+        count: hasHoneypots ? 0 : 1,
+        affectedEntities: undefined,
+        details: hasHoneypots
+            ? {
+                honeypotCount: honeypots.length,
+                potentialBaitCount: potentialBaits.length,
+                status: 'Honeypot accounts detected',
+            }
+            : {
+                recommendation: 'Create honeypot accounts with attractive names (e.g., svc_backup, admin_old) and monitor for any usage.',
+                benefits: [
+                    'Early detection of attacker enumeration',
+                    'Detect credential stuffing attempts',
+                    'Alert on lateral movement',
+                ],
+                implementationGuide: 'Create accounts with attractive names but no real permissions. Alert on any authentication attempt.',
+            },
+    };
+}
+function detectAdminAuditBypass(users, _domain, includeDetails) {
+    const adminUsers = users.filter((u) => u.adminCount === 1 && u.enabled);
+    const protectedUsersPattern = /protected users/i;
+    const adminsNotProtected = adminUsers.filter((u) => {
+        const memberOf = u['memberOf'];
+        if (!memberOf)
+            return true;
+        return !memberOf.some((g) => protectedUsersPattern.test(g));
+    });
+    const auditBypassRisk = adminsNotProtected.filter((u) => {
+        const pwdAge = u.pwdLastSet ? Date.now() - new Date(u.pwdLastSet).getTime() : Infinity;
+        const pwdAgeMonths = pwdAge / (1000 * 60 * 60 * 24 * 30);
+        return pwdAgeMonths > 6;
+    });
+    const hasRisk = auditBypassRisk.length > 0;
+    return {
+        type: 'ADMIN_AUDIT_BYPASS',
+        severity: 'high',
+        category: 'monitoring',
+        title: 'Administrators Can Bypass Audit',
+        description: 'Privileged accounts not in Protected Users group with old passwords may bypass audit controls.',
+        count: auditBypassRisk.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(auditBypassRisk) : undefined,
+        details: hasRisk
+            ? {
+                totalAdmins: adminUsers.length,
+                adminsNotProtected: adminsNotProtected.length,
+                adminsWithOldPasswords: auditBypassRisk.length,
+                recommendation: 'Add admin accounts to Protected Users group and enforce regular password rotation.',
+                risks: [
+                    'Admins can clear security logs',
+                    'Compromised admin credentials may evade detection',
+                    'Audit policies may be disabled by compromised admin',
+                ],
+            }
+            : undefined,
+    };
+}
+function detectSecurityLogSizeSmall(gpoSettings, domain, includeDetails) {
+    const MINIMUM_LOG_SIZE_KB = 128 * 1024;
+    if (gpoSettings?.eventLogSettings?.securityLogMaxSize !== undefined) {
+        const logSize = gpoSettings.eventLogSettings.securityLogMaxSize;
+        const isTooSmall = logSize < MINIMUM_LOG_SIZE_KB;
+        return {
+            type: 'SECURITY_LOG_SIZE_SMALL',
+            severity: 'medium',
+            category: 'monitoring',
+            title: 'Security Log Size Insufficient',
+            description: `Security event log maximum size is ${Math.round(logSize / 1024)} MB. Small logs cause events to be overwritten quickly, losing forensic data.`,
+            count: isTooSmall ? 1 : 0,
+            affectedEntities: includeDetails && isTooSmall && domain ? [domain.dn] : undefined,
+            details: isTooSmall
+                ? {
+                    currentSizeKB: logSize,
+                    currentSizeMB: Math.round(logSize / 1024),
+                    recommendedSizeKB: MINIMUM_LOG_SIZE_KB,
+                    recommendedSizeMB: Math.round(MINIMUM_LOG_SIZE_KB / 1024),
+                    recommendation: 'Increase Security log maximum size to at least 128 MB via GPO.',
+                    risks: [
+                        'Critical events may be lost due to log rotation',
+                        'Incident response hampered by missing events',
+                        'Compliance violations for log retention requirements',
+                    ],
+                }
+                : undefined,
+        };
+    }
+    return {
+        type: 'SECURITY_LOG_SIZE_SMALL',
+        severity: 'medium',
+        category: 'monitoring',
+        title: 'Security Log Size Configuration Unknown',
+        description: 'Unable to determine security event log size configuration.',
+        count: 0,
+        details: {
+            note: 'GPO event log settings not available. Verify Security log maximum size manually.',
+            recommendedSizeMB: Math.round(MINIMUM_LOG_SIZE_KB / 1024),
+        },
+    };
+}
+function detectNoProtectedUsersMonitoring(users, groups, includeDetails) {
+    const protectedUsersGroup = groups.find((g) => {
+        const name = (g.sAMAccountName || g.displayName || '').toLowerCase();
+        return name === 'protected users' || g.dn.toLowerCase().includes('cn=protected users');
+    });
+    const privilegedUsers = users.filter((u) => u.adminCount === 1 && u.enabled);
+    const notInProtectedUsers = privilegedUsers.filter((u) => {
+        const memberOf = u['memberOf'];
+        if (!memberOf)
+            return true;
+        return !memberOf.some((g) => g.toLowerCase().includes('cn=protected users') ||
+            (protectedUsersGroup && g.toLowerCase() === protectedUsersGroup.dn.toLowerCase()));
+    });
+    const groupExists = protectedUsersGroup !== undefined;
+    const groupMemberCount = protectedUsersGroup?.member?.length ?? 0;
+    return {
+        type: 'NO_PROTECTED_USERS_MONITORING',
+        severity: 'medium',
+        category: 'monitoring',
+        title: 'Protected Users Group Not Utilized',
+        description: 'Privileged accounts are not members of the Protected Users group. This group provides additional protections against credential theft.',
+        count: notInProtectedUsers.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedUserEntities)(notInProtectedUsers) : undefined,
+        details: {
+            groupExists,
+            currentMembers: groupMemberCount,
+            totalPrivilegedAccounts: privilegedUsers.length,
+            notInGroup: notInProtectedUsers.length,
+            protections: [
+                'NTLM authentication disabled',
+                'Kerberos DES/RC4 encryption disabled',
+                'Kerberos TGT lifetime reduced to 4 hours',
+                'Credential delegation disabled',
+                'Cached credentials not stored',
+            ],
+            recommendation: 'Add all privileged/admin accounts to Protected Users group for enhanced credential protection.',
+        },
+    };
+}
+function detectMonitoringVulnerabilities(users, groups, domain, includeDetails, options = {}) {
+    const { gpoSettings = null } = options;
+    return [
+        detectAuditLogonEventsDisabled(gpoSettings, domain, includeDetails),
+        detectAuditAccountMgmtDisabled(gpoSettings, domain, includeDetails),
+        detectAuditPolicyChangeDisabled(gpoSettings, domain, includeDetails),
+        detectAdminAuditBypass(users, domain, includeDetails),
+        detectAuditPrivilegeUseDisabled(gpoSettings, domain, includeDetails),
+        detectNoHoneypotAccounts(users, includeDetails),
+        detectSecurityLogSizeSmall(gpoSettings, domain, includeDetails),
+        detectNoProtectedUsersMonitoring(users, groups, includeDetails),
+    ].filter((finding) => finding.count > 0);
+}
+//# sourceMappingURL=monitoring.detector.js.map