@etcsec-com/etc-collector 1.4.0

package/dist/services/audit/detectors/ad/permissions.detector.js

@@ -0,0 +1,392 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectAclGenericAll = detectAclGenericAll;
+exports.detectAclWriteDacl = detectAclWriteDacl;
+exports.detectAclWriteOwner = detectAclWriteOwner;
+exports.detectAclGenericWrite = detectAclGenericWrite;
+exports.detectAclForceChangePassword = detectAclForceChangePassword;
+exports.detectEveryoneInAcl = detectEveryoneInAcl;
+exports.detectWriteSpnAbuse = detectWriteSpnAbuse;
+exports.detectGpoLinkPoisoning = detectGpoLinkPoisoning;
+exports.detectAdminSdHolderBackdoor = detectAdminSdHolderBackdoor;
+exports.detectAclSelfMembership = detectAclSelfMembership;
+exports.detectAclAddMember = detectAclAddMember;
+exports.detectAclWritePropertyExtended = detectAclWritePropertyExtended;
+exports.detectAclDsReplicationGetChanges = detectAclDsReplicationGetChanges;
+exports.detectAclUserForceChangePassword = detectAclUserForceChangePassword;
+exports.detectAclComputerWriteValidatedDns = detectAclComputerWriteValidatedDns;
+exports.detectComputerAclGenericAll = detectComputerAclGenericAll;
+exports.detectPermissionsVulnerabilities = detectPermissionsVulnerabilities;
+function getUniqueObjects(entries) {
+    return [...new Set(entries.map((ace) => ace.objectDn))];
+}
+function detectAclGenericAll(aclEntries, includeDetails) {
+    const GENERIC_ALL = 0x10000000;
+    const AD_FULL_CONTROL = 0x000f01ff;
+    const affected = aclEntries.filter((ace) => {
+        if ((ace.accessMask & GENERIC_ALL) !== 0)
+            return true;
+        return (ace.accessMask & AD_FULL_CONTROL) === AD_FULL_CONTROL;
+    });
+    const uniqueObjects = getUniqueObjects(affected);
+    const totalInstances = affected.length;
+    return {
+        type: 'ACL_GENERICALL',
+        severity: 'high',
+        category: 'permissions',
+        title: 'ACL GenericAll',
+        description: 'GenericAll permission on sensitive AD objects. Full control over object (reset passwords, modify groups, etc.).',
+        count: uniqueObjects.length,
+        totalInstances: totalInstances !== uniqueObjects.length ? totalInstances : undefined,
+        affectedEntities: includeDetails ? uniqueObjects : undefined,
+    };
+}
+function detectAclWriteDacl(aclEntries, includeDetails) {
+    const WRITE_DACL = 0x00040000;
+    const affected = aclEntries.filter((ace) => {
+        return (ace.accessMask & WRITE_DACL) !== 0;
+    });
+    const uniqueObjects = getUniqueObjects(affected);
+    const totalInstances = affected.length;
+    return {
+        type: 'ACL_WRITEDACL',
+        severity: 'high',
+        category: 'permissions',
+        title: 'ACL WriteDACL',
+        description: "WriteDACL permission on sensitive AD objects. Can modify object's security descriptor to grant additional permissions.",
+        count: uniqueObjects.length,
+        totalInstances: totalInstances !== uniqueObjects.length ? totalInstances : undefined,
+        affectedEntities: includeDetails ? uniqueObjects : undefined,
+    };
+}
+function detectAclWriteOwner(aclEntries, includeDetails) {
+    const WRITE_OWNER = 0x00080000;
+    const affected = aclEntries.filter((ace) => {
+        return (ace.accessMask & WRITE_OWNER) !== 0;
+    });
+    const uniqueObjects = getUniqueObjects(affected);
+    const totalInstances = affected.length;
+    return {
+        type: 'ACL_WRITEOWNER',
+        severity: 'high',
+        category: 'permissions',
+        title: 'ACL WriteOwner',
+        description: 'WriteOwner permission on sensitive AD objects. Can take ownership of object and modify permissions.',
+        count: uniqueObjects.length,
+        totalInstances: totalInstances !== uniqueObjects.length ? totalInstances : undefined,
+        affectedEntities: includeDetails ? uniqueObjects : undefined,
+    };
+}
+function detectAclGenericWrite(aclEntries, includeDetails) {
+    const GENERIC_WRITE = 0x40000000;
+    const affected = aclEntries.filter((ace) => {
+        return (ace.accessMask & GENERIC_WRITE) !== 0;
+    });
+    const uniqueObjects = getUniqueObjects(affected);
+    const totalInstances = affected.length;
+    return {
+        type: 'ACL_GENERICWRITE',
+        severity: 'medium',
+        category: 'permissions',
+        title: 'ACL GenericWrite',
+        description: 'GenericWrite permission on sensitive AD objects. Can modify many object attributes.',
+        count: uniqueObjects.length,
+        totalInstances: totalInstances !== uniqueObjects.length ? totalInstances : undefined,
+        affectedEntities: includeDetails ? uniqueObjects : undefined,
+    };
+}
+function detectAclForceChangePassword(aclEntries, includeDetails) {
+    const FORCE_CHANGE_PASSWORD_GUID = '00299570-246d-11d0-a768-00aa006e0529';
+    const affected = aclEntries.filter((ace) => {
+        return ace.objectType === FORCE_CHANGE_PASSWORD_GUID;
+    });
+    const uniqueObjects = getUniqueObjects(affected);
+    const totalInstances = affected.length;
+    return {
+        type: 'ACL_FORCECHANGEPASSWORD',
+        severity: 'medium',
+        category: 'permissions',
+        title: 'ACL Force Change Password',
+        description: 'ExtendedRight to force password change on user accounts. Can reset passwords without knowing current password.',
+        count: uniqueObjects.length,
+        totalInstances: totalInstances !== uniqueObjects.length ? totalInstances : undefined,
+        affectedEntities: includeDetails ? uniqueObjects : undefined,
+    };
+}
+function detectEveryoneInAcl(aclEntries, includeDetails) {
+    const EVERYONE_SID = 'S-1-1-0';
+    const AUTHENTICATED_USERS_SID = 'S-1-5-11';
+    const WRITE_MASK = 0x00020000;
+    const affected = aclEntries.filter((ace) => {
+        const isEveryone = ace.trustee === EVERYONE_SID || ace.trustee === AUTHENTICATED_USERS_SID;
+        const hasWrite = (ace.accessMask & WRITE_MASK) !== 0;
+        return isEveryone && hasWrite;
+    });
+    const uniqueObjects = getUniqueObjects(affected);
+    const totalInstances = affected.length;
+    return {
+        type: 'EVERYONE_IN_ACL',
+        severity: 'medium',
+        category: 'permissions',
+        title: 'Everyone in ACL',
+        description: 'Everyone or Authenticated Users with write permissions in ACL. Overly permissive access.',
+        count: uniqueObjects.length,
+        totalInstances: totalInstances !== uniqueObjects.length ? totalInstances : undefined,
+        affectedEntities: includeDetails ? uniqueObjects : undefined,
+    };
+}
+function detectWriteSpnAbuse(aclEntries, includeDetails) {
+    const SPN_PROPERTY_GUID = 'f3a64788-5306-11d1-a9c5-0000f80367c1';
+    const affected = aclEntries.filter((ace) => {
+        return ace.objectType === SPN_PROPERTY_GUID;
+    });
+    const uniqueObjects = getUniqueObjects(affected);
+    const totalInstances = affected.length;
+    return {
+        type: 'WRITESPN_ABUSE',
+        severity: 'medium',
+        category: 'permissions',
+        title: 'Write SPN Abuse',
+        description: 'WriteProperty permission for servicePrincipalName attribute. Can set SPNs for targeted Kerberoasting.',
+        count: uniqueObjects.length,
+        totalInstances: totalInstances !== uniqueObjects.length ? totalInstances : undefined,
+        affectedEntities: includeDetails ? uniqueObjects : undefined,
+    };
+}
+function detectGpoLinkPoisoning(aclEntries, includeDetails) {
+    const GENERIC_WRITE = 0x40000000;
+    const GENERIC_ALL = 0x10000000;
+    const WRITE_DACL = 0x00040000;
+    const affected = aclEntries.filter((ace) => {
+        const isGpo = ace.objectDn.includes('CN=Policies,CN=System');
+        const hasDangerousPermission = (ace.accessMask & GENERIC_ALL) !== 0 ||
+            (ace.accessMask & GENERIC_WRITE) !== 0 ||
+            (ace.accessMask & WRITE_DACL) !== 0;
+        return isGpo && hasDangerousPermission;
+    });
+    const uniqueObjects = getUniqueObjects(affected);
+    const totalInstances = affected.length;
+    return {
+        type: 'GPO_LINK_POISONING',
+        severity: 'medium',
+        category: 'permissions',
+        title: 'GPO Link Poisoning',
+        description: 'Weak ACLs on Group Policy Objects. Can modify GPO to execute code on targeted systems.',
+        count: uniqueObjects.length,
+        totalInstances: totalInstances !== uniqueObjects.length ? totalInstances : undefined,
+        affectedEntities: includeDetails ? uniqueObjects : undefined,
+    };
+}
+function detectAdminSdHolderBackdoor(aclEntries, includeDetails) {
+    const affected = aclEntries.filter((ace) => {
+        return ace.objectDn.includes('CN=AdminSDHolder,CN=System');
+    });
+    const uniqueObjects = getUniqueObjects(affected);
+    const totalInstances = affected.length;
+    return {
+        type: 'ADMINSDHOLDER_BACKDOOR',
+        severity: 'medium',
+        category: 'permissions',
+        title: 'AdminSDHolder Backdoor',
+        description: 'Unexpected ACL on AdminSDHolder object. Persistent permissions on admin accounts.',
+        count: uniqueObjects.length,
+        totalInstances: totalInstances !== uniqueObjects.length ? totalInstances : undefined,
+        affectedEntities: includeDetails ? uniqueObjects : undefined,
+    };
+}
+function detectAclSelfMembership(aclEntries, includeDetails) {
+    const SELF_MEMBERSHIP_GUID = 'bf9679c0-0de6-11d0-a285-00aa003049e2';
+    const WRITE_SELF = 0x8;
+    const affected = aclEntries.filter((ace) => {
+        const hasWriteSelf = (ace.accessMask & WRITE_SELF) !== 0;
+        const isSelfMembership = ace.objectType?.toLowerCase() === SELF_MEMBERSHIP_GUID ||
+            ace.objectType?.toLowerCase().includes('member');
+        return hasWriteSelf || isSelfMembership;
+    });
+    const uniqueObjects = getUniqueObjects(affected);
+    const totalInstances = affected.length;
+    return {
+        type: 'ACL_SELF_MEMBERSHIP',
+        severity: 'high',
+        category: 'permissions',
+        title: 'Self-Membership Rights',
+        description: 'Principals with self-membership rights on groups. ' +
+            'Allows adding oneself to a group, potentially gaining elevated privileges.',
+        count: uniqueObjects.length,
+        totalInstances: totalInstances !== uniqueObjects.length ? totalInstances : undefined,
+        affectedEntities: includeDetails ? uniqueObjects : undefined,
+    };
+}
+function detectAclAddMember(aclEntries, includeDetails) {
+    const MEMBER_GUID = 'bf9679c0-0de6-11d0-a285-00aa003049e2';
+    const WRITE_PROPERTY = 0x20;
+    const affected = aclEntries.filter((ace) => {
+        const hasWriteProperty = (ace.accessMask & WRITE_PROPERTY) !== 0;
+        const isMemberProperty = ace.objectType?.toLowerCase() === MEMBER_GUID;
+        return hasWriteProperty && isMemberProperty;
+    });
+    const uniqueObjects = getUniqueObjects(affected);
+    const totalInstances = affected.length;
+    return {
+        type: 'ACL_ADD_MEMBER',
+        severity: 'medium',
+        category: 'permissions',
+        title: 'Add-Member Rights on Groups',
+        description: 'Principals with rights to add members to groups. ' +
+            'Can be abused to add accounts to privileged groups.',
+        count: uniqueObjects.length,
+        totalInstances: totalInstances !== uniqueObjects.length ? totalInstances : undefined,
+        affectedEntities: includeDetails ? uniqueObjects : undefined,
+    };
+}
+function detectAclWritePropertyExtended(aclEntries, includeDetails) {
+    const DANGEROUS_PROPERTIES = [
+        '00299570-246d-11d0-a768-00aa006e0529',
+        'bf967a68-0de6-11d0-a285-00aa003049e2',
+        'bf967950-0de6-11d0-a285-00aa003049e2',
+        '5f202010-79a5-11d0-9020-00c04fc2d4cf',
+    ];
+    const WRITE_PROPERTY = 0x20;
+    const affected = aclEntries.filter((ace) => {
+        const hasWriteProperty = (ace.accessMask & WRITE_PROPERTY) !== 0;
+        const isDangerousProperty = ace.objectType && DANGEROUS_PROPERTIES.includes(ace.objectType.toLowerCase());
+        return hasWriteProperty && isDangerousProperty;
+    });
+    const uniqueObjects = getUniqueObjects(affected);
+    const totalInstances = affected.length;
+    return {
+        type: 'ACL_WRITE_PROPERTY_EXTENDED',
+        severity: 'medium',
+        category: 'permissions',
+        title: 'Extended Write Property Rights',
+        description: 'Principals with dangerous extended write property rights. ' +
+            'Can modify script paths, home directories, or key credentials.',
+        count: uniqueObjects.length,
+        totalInstances: totalInstances !== uniqueObjects.length ? totalInstances : undefined,
+        affectedEntities: includeDetails ? uniqueObjects : undefined,
+    };
+}
+function detectAclDsReplicationGetChanges(aclEntries, includeDetails) {
+    const REPLICATION_GUIDS = [
+        '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2',
+        '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2',
+    ];
+    const affected = aclEntries.filter((ace) => {
+        return (ace.objectType && REPLICATION_GUIDS.includes(ace.objectType.toLowerCase()));
+    });
+    const uniqueObjects = getUniqueObjects(affected);
+    const totalInstances = affected.length;
+    return {
+        type: 'ACL_DS_REPLICATION_GET_CHANGES',
+        severity: 'critical',
+        category: 'permissions',
+        title: 'DS-Replication-Get-Changes Rights (DCSync)',
+        description: 'Non-standard principals with directory replication rights. ' +
+            'Enables DCSync attacks to extract all password hashes from the domain.',
+        count: uniqueObjects.length,
+        totalInstances: totalInstances !== uniqueObjects.length ? totalInstances : undefined,
+        affectedEntities: includeDetails ? uniqueObjects : undefined,
+        details: {
+            risk: 'Complete domain compromise through password hash extraction.',
+            recommendation: 'Remove replication rights from all non-DC accounts.',
+        },
+    };
+}
+function detectAclUserForceChangePassword(aclEntries, includeDetails) {
+    const FORCE_CHANGE_PASSWORD_GUID = '00299570-246d-11d0-a768-00aa006e0529';
+    const affected = aclEntries.filter((ace) => {
+        return ace.objectType?.toLowerCase() === FORCE_CHANGE_PASSWORD_GUID;
+    });
+    const uniqueObjects = getUniqueObjects(affected);
+    const totalInstances = affected.length;
+    return {
+        type: 'ACL_USER_FORCE_CHANGE_PASSWORD',
+        severity: 'medium',
+        category: 'permissions',
+        title: 'User-Force-Change-Password Rights',
+        description: 'Principals with rights to force password change on user accounts. ' +
+            'Can reset passwords to take over accounts.',
+        count: uniqueObjects.length,
+        totalInstances: totalInstances !== uniqueObjects.length ? totalInstances : undefined,
+        affectedEntities: includeDetails ? uniqueObjects : undefined,
+    };
+}
+function detectAclComputerWriteValidatedDns(aclEntries, includeDetails) {
+    const VALIDATED_DNS_GUID = '72e39547-7b18-11d1-adef-00c04fd8d5cd';
+    const affected = aclEntries.filter((ace) => {
+        const isComputerObject = ace.objectDn.toLowerCase().includes('cn=computers');
+        const hasDnsRight = ace.objectType?.toLowerCase() === VALIDATED_DNS_GUID;
+        return isComputerObject && hasDnsRight;
+    });
+    const uniqueObjects = getUniqueObjects(affected);
+    const totalInstances = affected.length;
+    return {
+        type: 'ACL_COMPUTER_WRITE_VALIDATED_DNS',
+        severity: 'medium',
+        category: 'permissions',
+        title: 'Validated-Write-DNS on Computers',
+        description: 'Principals with rights to modify DNS host names on computer objects. ' +
+            'Can be used for DNS spoofing and MITM attacks.',
+        count: uniqueObjects.length,
+        totalInstances: totalInstances !== uniqueObjects.length ? totalInstances : undefined,
+        affectedEntities: includeDetails ? uniqueObjects : undefined,
+    };
+}
+function detectComputerAclGenericAll(aclEntries, includeDetails, computerDns) {
+    const GENERIC_ALL = 0x10000000;
+    const AD_FULL_CONTROL = 0x000f01ff;
+    const computerDnSet = new Set(computerDns ? computerDns.map((dn) => dn.toLowerCase()) : []);
+    const computerAcls = aclEntries.filter((ace) => {
+        const dn = ace.objectDn.toLowerCase();
+        if (computerDnSet.size > 0) {
+            return computerDnSet.has(dn);
+        }
+        const cnMatch = dn.match(/cn=([^,]+)/i);
+        if (cnMatch && cnMatch[1] && cnMatch[1].endsWith('$')) {
+            return true;
+        }
+        return (dn.includes('ou=computers') ||
+            dn.includes('ou=workstations') ||
+            dn.includes('ou=servers') ||
+            dn.includes('cn=computers,'));
+    });
+    const affected = computerAcls.filter((ace) => {
+        if ((ace.accessMask & GENERIC_ALL) !== 0)
+            return true;
+        return (ace.accessMask & AD_FULL_CONTROL) === AD_FULL_CONTROL;
+    });
+    const uniqueObjects = getUniqueObjects(affected);
+    const totalInstances = affected.length;
+    return {
+        type: 'COMPUTER_ACL_GENERICALL',
+        severity: 'high',
+        category: 'permissions',
+        title: 'Computer ACL GenericAll',
+        description: 'GenericAll permission on computer objects. Attacker with this permission can take over the computer, ' +
+            'configure Resource-Based Constrained Delegation (RBCD), or extract credentials.',
+        count: uniqueObjects.length,
+        totalInstances: totalInstances !== uniqueObjects.length ? totalInstances : undefined,
+        affectedEntities: includeDetails ? uniqueObjects : undefined,
+    };
+}
+function detectPermissionsVulnerabilities(aclEntries, includeDetails, computerDns) {
+    return [
+        detectAclGenericAll(aclEntries, includeDetails),
+        detectComputerAclGenericAll(aclEntries, includeDetails, computerDns),
+        detectAclWriteDacl(aclEntries, includeDetails),
+        detectAclWriteOwner(aclEntries, includeDetails),
+        detectAclGenericWrite(aclEntries, includeDetails),
+        detectAclForceChangePassword(aclEntries, includeDetails),
+        detectEveryoneInAcl(aclEntries, includeDetails),
+        detectWriteSpnAbuse(aclEntries, includeDetails),
+        detectGpoLinkPoisoning(aclEntries, includeDetails),
+        detectAdminSdHolderBackdoor(aclEntries, includeDetails),
+        detectAclSelfMembership(aclEntries, includeDetails),
+        detectAclAddMember(aclEntries, includeDetails),
+        detectAclWritePropertyExtended(aclEntries, includeDetails),
+        detectAclDsReplicationGetChanges(aclEntries, includeDetails),
+        detectAclUserForceChangePassword(aclEntries, includeDetails),
+        detectAclComputerWriteValidatedDns(aclEntries, includeDetails),
+    ].filter((finding) => finding.count > 0);
+}
+//# sourceMappingURL=permissions.detector.js.map

package/dist/services/audit/detectors/ad/permissions.detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.detector.js","sourceRoot":"","sources":["../../../../../src/services/audit/detectors/ad/permissions.detector.ts"],"names":[],"mappings":";;AA8CA,kDA4BC;AAKD,gDAoBC;AAKD,kDAoBC;AAKD,sDAoBC;AAKD,oEAoBC;AAKD,kDAwBC;AAKD,kDAoBC;AAKD,wDA4BC;AAKD,kEAkBC;AAWD,0DA4BC;AAWD,gDA0BC;AAWD,wEAoCC;AAWD,4EAoCC;AAWD,4EA0BC;AAWD,gFA4BC;AAUD,kEA6DC;AASD,4EA0BC;AAzlBD,SAAS,gBAAgB,CAAC,OAAmB;IAC3C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AASD,SAAgB,mBAAmB,CAAC,UAAsB,EAAE,cAAuB;IAEjF,MAAM,WAAW,GAAG,UAAU,CAAC;IAG/B,MAAM,eAAe,GAAG,UAAU,CAAC;IAEnC,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QAEzC,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAGtD,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,eAAe,CAAC,KAAK,eAAe,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC;IAEvC,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,aAAa;QACvB,KAAK,EAAE,gBAAgB;QACvB,WAAW,EAAE,iHAAiH;QAC9H,KAAK,EAAE,aAAa,CAAC,MAAM;QAC3B,cAAc,EAAE,cAAc,KAAK,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;QACpF,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;KAC7D,CAAC;AACJ,CAAC;AAKD,SAAgB,kBAAkB,CAAC,UAAsB,EAAE,cAAuB;IAChF,MAAM,UAAU,GAAG,UAAU,CAAC;IAE9B,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACzC,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC;IAEvC,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,aAAa;QACvB,KAAK,EAAE,eAAe;QACtB,WAAW,EAAE,wHAAwH;QACrI,KAAK,EAAE,aAAa,CAAC,MAAM;QAC3B,cAAc,EAAE,cAAc,KAAK,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;QACpF,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;KAC7D,CAAC;AACJ,CAAC;AAKD,SAAgB,mBAAmB,CAAC,UAAsB,EAAE,cAAuB;IACjF,MAAM,WAAW,GAAG,UAAU,CAAC;IAE/B,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACzC,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC;IAEvC,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,aAAa;QACvB,KAAK,EAAE,gBAAgB;QACvB,WAAW,EAAE,qGAAqG;QAClH,KAAK,EAAE,aAAa,CAAC,MAAM;QAC3B,cAAc,EAAE,cAAc,KAAK,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;QACpF,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;KAC7D,CAAC;AACJ,CAAC;AAKD,SAAgB,qBAAqB,CAAC,UAAsB,EAAE,cAAuB;IACnF,MAAM,aAAa,GAAG,UAAU,CAAC;IAEjC,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACzC,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC;IAEvC,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,aAAa;QACvB,KAAK,EAAE,kBAAkB;QACzB,WAAW,EAAE,qFAAqF;QAClG,KAAK,EAAE,aAAa,CAAC,MAAM;QAC3B,cAAc,EAAE,cAAc,KAAK,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;QACpF,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;KAC7D,CAAC;AACJ,CAAC;AAKD,SAAgB,4BAA4B,CAAC,UAAsB,EAAE,cAAuB;IAC1F,MAAM,0BAA0B,GAAG,sCAAsC,CAAC;IAE1E,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACzC,OAAO,GAAG,CAAC,UAAU,KAAK,0BAA0B,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC;IAEvC,OAAO;QACL,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,aAAa;QACvB,KAAK,EAAE,2BAA2B;QAClC,WAAW,EAAE,gHAAgH;QAC7H,KAAK,EAAE,aAAa,CAAC,MAAM;QAC3B,cAAc,EAAE,cAAc,KAAK,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;QACpF,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;KAC7D,CAAC;AACJ,CAAC;AAKD,SAAgB,mBAAmB,CAAC,UAAsB,EAAE,cAAuB;IACjF,MAAM,YAAY,GAAG,SAAS,CAAC;IAC/B,MAAM,uBAAuB,GAAG,UAAU,CAAC;IAC3C,MAAM,UAAU,GAAG,UAAU,CAAC;IAE9B,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACzC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,KAAK,YAAY,IAAI,GAAG,CAAC,OAAO,KAAK,uBAAuB,CAAC;QAC3F,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QACrD,OAAO,UAAU,IAAI,QAAQ,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC;IAEvC,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,aAAa;QACvB,KAAK,EAAE,iBAAiB;QACxB,WAAW,EAAE,0FAA0F;QACvG,KAAK,EAAE,aAAa,CAAC,MAAM;QAC3B,cAAc,EAAE,cAAc,KAAK,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;QACpF,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;KAC7D,CAAC;AACJ,CAAC;AAKD,SAAgB,mBAAmB,CAAC,UAAsB,EAAE,cAAuB;IACjF,MAAM,iBAAiB,GAAG,sCAAsC,CAAC;IAEjE,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACzC,OAAO,GAAG,CAAC,UAAU,KAAK,iBAAiB,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC;IAEvC,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,aAAa;QACvB,KAAK,EAAE,iBAAiB;QACxB,WAAW,EAAE,uGAAuG;QACpH,KAAK,EAAE,aAAa,CAAC,MAAM;QAC3B,cAAc,EAAE,cAAc,KAAK,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;QACpF,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;KAC7D,CAAC;AACJ,CAAC;AAKD,SAAgB,sBAAsB,CAAC,UAAsB,EAAE,cAAuB;IACpF,MAAM,aAAa,GAAG,UAAU,CAAC;IACjC,MAAM,WAAW,GAAG,UAAU,CAAC;IAC/B,MAAM,UAAU,GAAG,UAAU,CAAC;IAE9B,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACzC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC;QAC7D,MAAM,sBAAsB,GAC1B,CAAC,GAAG,CAAC,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC;YACpC,CAAC,GAAG,CAAC,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC;YACtC,CAAC,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAEtC,OAAO,KAAK,IAAI,sBAAsB,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC;IAEvC,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,aAAa;QACvB,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EAAE,wFAAwF;QACrG,KAAK,EAAE,aAAa,CAAC,MAAM;QAC3B,cAAc,EAAE,cAAc,KAAK,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;QACpF,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;KAC7D,CAAC;AACJ,CAAC;AAKD,SAAgB,2BAA2B,CAAC,UAAsB,EAAE,cAAuB;IACzF,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACzC,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC;IAEvC,OAAO;QACL,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,aAAa;QACvB,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EAAE,mFAAmF;QAChG,KAAK,EAAE,aAAa,CAAC,MAAM;QAC3B,cAAc,EAAE,cAAc,KAAK,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;QACpF,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;KAC7D,CAAC;AACJ,CAAC;AAWD,SAAgB,uBAAuB,CAAC,UAAsB,EAAE,cAAuB;IAErF,MAAM,oBAAoB,GAAG,sCAAsC,CAAC;IACpE,MAAM,UAAU,GAAG,GAAG,CAAC;IAEvB,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACzC,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,gBAAgB,GACpB,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,oBAAoB;YACtD,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnD,OAAO,YAAY,IAAI,gBAAgB,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC;IAEvC,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,aAAa;QACvB,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EACT,oDAAoD;YACpD,4EAA4E;QAC9E,KAAK,EAAE,aAAa,CAAC,MAAM;QAC3B,cAAc,EAAE,cAAc,KAAK,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;QACpF,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;KAC7D,CAAC;AACJ,CAAC;AAWD,SAAgB,kBAAkB,CAAC,UAAsB,EAAE,cAAuB;IAEhF,MAAM,WAAW,GAAG,sCAAsC,CAAC;IAC3D,MAAM,cAAc,GAAG,IAAI,CAAC;IAE5B,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACzC,MAAM,gBAAgB,GAAG,CAAC,GAAG,CAAC,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACjE,MAAM,gBAAgB,GAAG,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,WAAW,CAAC;QACvE,OAAO,gBAAgB,IAAI,gBAAgB,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC;IAEvC,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,aAAa;QACvB,KAAK,EAAE,6BAA6B;QACpC,WAAW,EACT,mDAAmD;YACnD,qDAAqD;QACvD,KAAK,EAAE,aAAa,CAAC,MAAM;QAC3B,cAAc,EAAE,cAAc,KAAK,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;QACpF,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;KAC7D,CAAC;AACJ,CAAC;AAWD,SAAgB,8BAA8B,CAC5C,UAAsB,EACtB,cAAuB;IAGvB,MAAM,oBAAoB,GAAG;QAC3B,sCAAsC;QACtC,sCAAsC;QACtC,sCAAsC;QACtC,sCAAsC;KACvC,CAAC;IAEF,MAAM,cAAc,GAAG,IAAI,CAAC;IAE5B,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACzC,MAAM,gBAAgB,GAAG,CAAC,GAAG,CAAC,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACjE,MAAM,mBAAmB,GACvB,GAAG,CAAC,UAAU,IAAI,oBAAoB,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;QAChF,OAAO,gBAAgB,IAAI,mBAAmB,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC;IAEvC,OAAO;QACL,IAAI,EAAE,6BAA6B;QACnC,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,aAAa;QACvB,KAAK,EAAE,gCAAgC;QACvC,WAAW,EACT,4DAA4D;YAC5D,gEAAgE;QAClE,KAAK,EAAE,aAAa,CAAC,MAAM;QAC3B,cAAc,EAAE,cAAc,KAAK,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;QACpF,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;KAC7D,CAAC;AACJ,CAAC;AAWD,SAAgB,gCAAgC,CAC9C,UAAsB,EACtB,cAAuB;IAIvB,MAAM,iBAAiB,GAAG;QACxB,sCAAsC;QACtC,sCAAsC;KACvC,CAAC;IAEF,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACzC,OAAO,CACL,GAAG,CAAC,UAAU,IAAI,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAC3E,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC;IAEvC,OAAO;QACL,IAAI,EAAE,gCAAgC;QACtC,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,aAAa;QACvB,KAAK,EAAE,4CAA4C;QACnD,WAAW,EACT,6DAA6D;YAC7D,wEAAwE;QAC1E,KAAK,EAAE,aAAa,CAAC,MAAM;QAC3B,cAAc,EAAE,cAAc,KAAK,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;QACpF,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;QAC5D,OAAO,EAAE;YACP,IAAI,EAAE,8DAA8D;YACpE,cAAc,EAAE,qDAAqD;SACtE;KACF,CAAC;AACJ,CAAC;AAWD,SAAgB,gCAAgC,CAC9C,UAAsB,EACtB,cAAuB;IAGvB,MAAM,0BAA0B,GAAG,sCAAsC,CAAC;IAE1E,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACzC,OAAO,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,0BAA0B,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC;IAEvC,OAAO;QACL,IAAI,EAAE,gCAAgC;QACtC,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,aAAa;QACvB,KAAK,EAAE,mCAAmC;QAC1C,WAAW,EACT,oEAAoE;YACpE,4CAA4C;QAC9C,KAAK,EAAE,aAAa,CAAC,MAAM;QAC3B,cAAc,EAAE,cAAc,KAAK,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;QACpF,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;KAC7D,CAAC;AACJ,CAAC;AAWD,SAAgB,kCAAkC,CAChD,UAAsB,EACtB,cAAuB;IAGvB,MAAM,kBAAkB,GAAG,sCAAsC,CAAC;IAElE,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACzC,MAAM,gBAAgB,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC7E,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,kBAAkB,CAAC;QACzE,OAAO,gBAAgB,IAAI,WAAW,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC;IAEvC,OAAO;QACL,IAAI,EAAE,kCAAkC;QACxC,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,aAAa;QACvB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EACT,uEAAuE;YACvE,gDAAgD;QAClD,KAAK,EAAE,aAAa,CAAC,MAAM;QAC3B,cAAc,EAAE,cAAc,KAAK,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;QACpF,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;KAC7D,CAAC;AACJ,CAAC;AAUD,SAAgB,2BAA2B,CACzC,UAAsB,EACtB,cAAuB,EACvB,WAAsB;IAGtB,MAAM,WAAW,GAAG,UAAU,CAAC;IAE/B,MAAM,eAAe,GAAG,UAAU,CAAC;IAGnC,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAC7D,CAAC;IAGF,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QAC7C,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAGtC,IAAI,aAAa,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,CAAC;QAID,MAAM,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACxC,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,CACL,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC;YAC3B,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YAC9B,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;YACzB,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CAC7B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QAE3C,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEtD,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,eAAe,CAAC,KAAK,eAAe,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC;IAEvC,OAAO;QACL,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,aAAa;QACvB,KAAK,EAAE,yBAAyB;QAChC,WAAW,EACT,uGAAuG;YACvG,iFAAiF;QACnF,KAAK,EAAE,aAAa,CAAC,MAAM;QAC3B,cAAc,EAAE,cAAc,KAAK,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;QACpF,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;KAC7D,CAAC;AACJ,CAAC;AASD,SAAgB,gCAAgC,CAC9C,UAAsB,EACtB,cAAuB,EACvB,WAAsB;IAEtB,OAAO;QAEL,mBAAmB,CAAC,UAAU,EAAE,cAAc,CAAC;QAC/C,2BAA2B,CAAC,UAAU,EAAE,cAAc,EAAE,WAAW,CAAC;QACpE,kBAAkB,CAAC,UAAU,EAAE,cAAc,CAAC;QAC9C,mBAAmB,CAAC,UAAU,EAAE,cAAc,CAAC;QAE/C,qBAAqB,CAAC,UAAU,EAAE,cAAc,CAAC;QACjD,4BAA4B,CAAC,UAAU,EAAE,cAAc,CAAC;QACxD,mBAAmB,CAAC,UAAU,EAAE,cAAc,CAAC;QAC/C,mBAAmB,CAAC,UAAU,EAAE,cAAc,CAAC;QAC/C,sBAAsB,CAAC,UAAU,EAAE,cAAc,CAAC;QAClD,2BAA2B,CAAC,UAAU,EAAE,cAAc,CAAC;QAEvD,uBAAuB,CAAC,UAAU,EAAE,cAAc,CAAC;QACnD,kBAAkB,CAAC,UAAU,EAAE,cAAc,CAAC;QAC9C,8BAA8B,CAAC,UAAU,EAAE,cAAc,CAAC;QAC1D,gCAAgC,CAAC,UAAU,EAAE,cAAc,CAAC;QAC5D,gCAAgC,CAAC,UAAU,EAAE,cAAc,CAAC;QAC5D,kCAAkC,CAAC,UAAU,EAAE,cAAc,CAAC;KAC/D,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC"}

package/dist/services/audit/detectors/ad/trusts.detector.d.ts

@@ -0,0 +1,11 @@
+import { Finding } from '../../../../types/finding.types';
+import { ADTrustExtended } from '../../../../types/trust.types';
+export declare function detectTrustSidFilteringDisabled(trusts: ADTrustExtended[], includeDetails: boolean): Finding;
+export declare function detectTrustExternalNoSelectiveAuth(trusts: ADTrustExtended[], includeDetails: boolean): Finding;
+export declare function detectTrustBidirectional(trusts: ADTrustExtended[], includeDetails: boolean): Finding;
+export declare function detectTrustForestTransitive(trusts: ADTrustExtended[], includeDetails: boolean): Finding;
+export declare function detectTrustAesDisabled(trusts: ADTrustExtended[], includeDetails: boolean): Finding;
+export declare function detectTrustRc4Only(trusts: ADTrustExtended[], includeDetails: boolean): Finding;
+export declare function detectTrustInactive(trusts: ADTrustExtended[], includeDetails: boolean): Finding;
+export declare function detectTrustVulnerabilities(trusts: ADTrustExtended[], includeDetails: boolean): Finding[];
+//# sourceMappingURL=trusts.detector.d.ts.map

package/dist/services/audit/detectors/ad/trusts.detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusts.detector.d.ts","sourceRoot":"","sources":["../../../../../src/services/audit/detectors/ad/trusts.detector.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,OAAO,EAAE,MAAM,iCAAiC,CAAC;AAC1D,OAAO,EACL,eAAe,EAMhB,MAAM,+BAA+B,CAAC;AAMvC,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,eAAe,EAAE,EACzB,cAAc,EAAE,OAAO,GACtB,OAAO,CA+BT;AAMD,wBAAgB,kCAAkC,CAChD,MAAM,EAAE,eAAe,EAAE,EACzB,cAAc,EAAE,OAAO,GACtB,OAAO,CAkCT;AAMD,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,eAAe,EAAE,EACzB,cAAc,EAAE,OAAO,GACtB,OAAO,CA2BT;AAMD,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,eAAe,EAAE,EACzB,cAAc,EAAE,OAAO,GACtB,OAAO,CAsBT;AAeD,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,eAAe,EAAE,EACzB,cAAc,EAAE,OAAO,GACtB,OAAO,CAyBT;AAMD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,eAAe,EAAE,EACzB,cAAc,EAAE,OAAO,GACtB,OAAO,CA+BT;AAMD,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,eAAe,EAAE,EACzB,cAAc,EAAE,OAAO,GACtB,OAAO,CA4BT;AAKD,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,eAAe,EAAE,EACzB,cAAc,EAAE,OAAO,GACtB,OAAO,EAAE,CAUX"}

package/dist/services/audit/detectors/ad/trusts.detector.js

@@ -0,0 +1,186 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectTrustSidFilteringDisabled = detectTrustSidFilteringDisabled;
+exports.detectTrustExternalNoSelectiveAuth = detectTrustExternalNoSelectiveAuth;
+exports.detectTrustBidirectional = detectTrustBidirectional;
+exports.detectTrustForestTransitive = detectTrustForestTransitive;
+exports.detectTrustAesDisabled = detectTrustAesDisabled;
+exports.detectTrustRc4Only = detectTrustRc4Only;
+exports.detectTrustInactive = detectTrustInactive;
+exports.detectTrustVulnerabilities = detectTrustVulnerabilities;
+const trust_types_1 = require("../../../../types/trust.types");
+function detectTrustSidFilteringDisabled(trusts, includeDetails) {
+    const affected = trusts.filter((t) => {
+        if ((t.trustAttributes & trust_types_1.TRUST_ATTRIBUTE_WITHIN_FOREST) !== 0) {
+            return false;
+        }
+        const sidFilteringDisabled = (t.trustAttributes & trust_types_1.TRUST_ATTRIBUTE_QUARANTINED_DOMAIN) === 0;
+        return sidFilteringDisabled;
+    });
+    return {
+        type: 'TRUST_SID_FILTERING_DISABLED',
+        severity: 'high',
+        category: 'trusts',
+        title: 'SID Filtering Disabled on Trust',
+        description: 'Trust relationships without SID filtering allow SID history injection attacks, enabling attackers to impersonate any user in the trusted domain.',
+        count: affected.length,
+        affectedEntities: includeDetails ? affected.map((t) => t.name) : undefined,
+        details: affected.length > 0
+            ? {
+                recommendation: 'Enable SID filtering (quarantine) on external and forest trusts.',
+            }
+            : undefined,
+    };
+}
+function detectTrustExternalNoSelectiveAuth(trusts, includeDetails) {
+    const affected = trusts.filter((t) => {
+        const isExternal = (t.trustAttributes & trust_types_1.TRUST_ATTRIBUTE_FOREST_TRANSITIVE) === 0 &&
+            (t.trustAttributes & trust_types_1.TRUST_ATTRIBUTE_WITHIN_FOREST) === 0;
+        if (!isExternal)
+            return false;
+        const selectiveAuthDisabled = (t.trustAttributes & trust_types_1.TRUST_ATTRIBUTE_CROSS_ORGANIZATION) === 0;
+        return selectiveAuthDisabled;
+    });
+    return {
+        type: 'TRUST_EXTERNAL_NO_SELECTIVE_AUTH',
+        severity: 'high',
+        category: 'trusts',
+        title: 'External Trust Without Selective Authentication',
+        description: 'External trust without selective authentication allows any user from the trusted domain to authenticate to any resource in this domain.',
+        count: affected.length,
+        affectedEntities: includeDetails ? affected.map((t) => t.name) : undefined,
+        details: affected.length > 0
+            ? {
+                recommendation: 'Enable selective authentication and explicitly grant access only to required resources.',
+            }
+            : undefined,
+    };
+}
+function detectTrustBidirectional(trusts, includeDetails) {
+    const affected = trusts.filter((t) => {
+        if ((t.trustAttributes & trust_types_1.TRUST_ATTRIBUTE_WITHIN_FOREST) !== 0) {
+            return false;
+        }
+        return t.trustDirection === trust_types_1.TRUST_DIRECTION_BIDIRECTIONAL;
+    });
+    return {
+        type: 'TRUST_BIDIRECTIONAL',
+        severity: 'medium',
+        category: 'trusts',
+        title: 'Bidirectional Trust Relationship',
+        description: 'Two-way trust allows authentication in both directions, increasing the attack surface. A compromise in either domain can lead to lateral movement to the other.',
+        count: affected.length,
+        affectedEntities: includeDetails ? affected.map((t) => t.name) : undefined,
+        details: affected.length > 0
+            ? {
+                recommendation: 'Consider using one-way trusts where possible. Implement selective authentication.',
+            }
+            : undefined,
+    };
+}
+function detectTrustForestTransitive(trusts, includeDetails) {
+    const affected = trusts.filter((t) => {
+        return (t.trustAttributes & trust_types_1.TRUST_ATTRIBUTE_FOREST_TRANSITIVE) !== 0;
+    });
+    return {
+        type: 'TRUST_FOREST_TRANSITIVE',
+        severity: 'medium',
+        category: 'trusts',
+        title: 'Transitive Forest Trust',
+        description: 'Forest trust is transitive, meaning all domains in the trusted forest can access this domain. This significantly increases the trust boundary.',
+        count: affected.length,
+        affectedEntities: includeDetails ? affected.map((t) => t.name) : undefined,
+        details: affected.length > 0
+            ? {
+                recommendation: 'Review necessity of forest trust. Consider selective authentication and SID filtering.',
+            }
+            : undefined,
+    };
+}
+const ENC_TYPE_DES_CBC_CRC = 0x1;
+const ENC_TYPE_DES_CBC_MD5 = 0x2;
+const ENC_TYPE_RC4_HMAC = 0x4;
+const ENC_TYPE_AES128 = 0x8;
+const ENC_TYPE_AES256 = 0x10;
+const ENC_WEAK_ONLY = ENC_TYPE_DES_CBC_CRC | ENC_TYPE_DES_CBC_MD5 | ENC_TYPE_RC4_HMAC;
+const ENC_AES_TYPES = ENC_TYPE_AES128 | ENC_TYPE_AES256;
+function detectTrustAesDisabled(trusts, includeDetails) {
+    const affected = trusts.filter((t) => {
+        if (t.supportedEncryptionTypes === undefined)
+            return false;
+        return (t.supportedEncryptionTypes & ENC_AES_TYPES) === 0;
+    });
+    return {
+        type: 'TRUST_AES_DISABLED',
+        severity: 'high',
+        category: 'trusts',
+        title: 'AES Encryption Disabled on Trust',
+        description: 'Trust relationship does not support AES encryption. This forces the use of weaker encryption algorithms (RC4/DES) which are more vulnerable to offline cracking.',
+        count: affected.length,
+        affectedEntities: includeDetails ? affected.map((t) => t.name) : undefined,
+        details: affected.length > 0
+            ? {
+                recommendation: 'Enable AES128 and AES256 encryption on trust relationship. Ensure both domains support AES.',
+            }
+            : undefined,
+    };
+}
+function detectTrustRc4Only(trusts, includeDetails) {
+    const affected = trusts.filter((t) => {
+        if (t.supportedEncryptionTypes === undefined)
+            return false;
+        const hasOnlyWeak = (t.supportedEncryptionTypes & ENC_WEAK_ONLY) !== 0 &&
+            (t.supportedEncryptionTypes & ENC_AES_TYPES) === 0;
+        const isRc4Only = hasOnlyWeak && (t.supportedEncryptionTypes & ENC_TYPE_RC4_HMAC) !== 0;
+        return isRc4Only;
+    });
+    return {
+        type: 'TRUST_RC4_ONLY',
+        severity: 'high',
+        category: 'trusts',
+        title: 'Trust Only Supports RC4 Encryption',
+        description: 'Trust relationship only supports RC4 encryption (no AES). RC4 is deprecated and Kerberos tickets encrypted with RC4 are vulnerable to offline cracking attacks.',
+        count: affected.length,
+        affectedEntities: includeDetails ? affected.map((t) => t.name) : undefined,
+        details: affected.length > 0
+            ? {
+                recommendation: 'Enable AES encryption on trust. If the partner domain does not support AES, plan an upgrade path.',
+            }
+            : undefined,
+    };
+}
+function detectTrustInactive(trusts, includeDetails) {
+    const now = Date.now();
+    const sixMonthsAgo = now - 180 * 24 * 60 * 60 * 1000;
+    const affected = trusts.filter((t) => {
+        if (!t.whenChanged)
+            return false;
+        return t.whenChanged.getTime() < sixMonthsAgo;
+    });
+    return {
+        type: 'TRUST_INACTIVE',
+        severity: 'medium',
+        category: 'trusts',
+        title: 'Inactive Trust Relationship',
+        description: 'Trust relationship has not been modified in over 180 days. May indicate an abandoned or forgotten trust that should be reviewed for necessity.',
+        count: affected.length,
+        affectedEntities: includeDetails ? affected.map((t) => t.name) : undefined,
+        details: affected.length > 0
+            ? {
+                recommendation: 'Review necessity of inactive trusts. Remove trusts that are no longer needed to reduce attack surface.',
+            }
+            : undefined,
+    };
+}
+function detectTrustVulnerabilities(trusts, includeDetails) {
+    return [
+        detectTrustSidFilteringDisabled(trusts, includeDetails),
+        detectTrustExternalNoSelectiveAuth(trusts, includeDetails),
+        detectTrustBidirectional(trusts, includeDetails),
+        detectTrustForestTransitive(trusts, includeDetails),
+        detectTrustAesDisabled(trusts, includeDetails),
+        detectTrustRc4Only(trusts, includeDetails),
+        detectTrustInactive(trusts, includeDetails),
+    ].filter((finding) => finding.count > 0);
+}
+//# sourceMappingURL=trusts.detector.js.map

package/dist/services/audit/detectors/ad/trusts.detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusts.detector.js","sourceRoot":"","sources":["../../../../../src/services/audit/detectors/ad/trusts.detector.ts"],"names":[],"mappings":";;AAgCA,0EAkCC;AAMD,gFAqCC;AAMD,4DA8BC;AAMD,kEAyBC;AAeD,wDA4BC;AAMD,gDAkCC;AAMD,kDA+BC;AAKD,gEAaC;AAvSD,+DAOuC;AAMvC,SAAgB,+BAA+B,CAC7C,MAAyB,EACzB,cAAuB;IAIvB,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAEnC,IAAI,CAAC,CAAC,CAAC,eAAe,GAAG,2CAA6B,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9D,OAAO,KAAK,CAAC;QACf,CAAC;QAGD,MAAM,oBAAoB,GAAG,CAAC,CAAC,CAAC,eAAe,GAAG,gDAAkC,CAAC,KAAK,CAAC,CAAC;QAE5F,OAAO,oBAAoB,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,8BAA8B;QACpC,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,iCAAiC;QACxC,WAAW,EACT,kJAAkJ;QACpJ,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;QAC1E,OAAO,EACL,QAAQ,CAAC,MAAM,GAAG,CAAC;YACjB,CAAC,CAAC;gBACE,cAAc,EAAE,kEAAkE;aACnF;YACH,CAAC,CAAC,SAAS;KAChB,CAAC;AACJ,CAAC;AAMD,SAAgB,kCAAkC,CAChD,MAAyB,EACzB,cAAuB;IAIvB,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAEnC,MAAM,UAAU,GACd,CAAC,CAAC,CAAC,eAAe,GAAG,+CAAiC,CAAC,KAAK,CAAC;YAC7D,CAAC,CAAC,CAAC,eAAe,GAAG,2CAA6B,CAAC,KAAK,CAAC,CAAC;QAE5D,IAAI,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC;QAG9B,MAAM,qBAAqB,GAAG,CAAC,CAAC,CAAC,eAAe,GAAG,gDAAkC,CAAC,KAAK,CAAC,CAAC;QAE7F,OAAO,qBAAqB,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,kCAAkC;QACxC,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,iDAAiD;QACxD,WAAW,EACT,yIAAyI;QAC3I,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;QAC1E,OAAO,EACL,QAAQ,CAAC,MAAM,GAAG,CAAC;YACjB,CAAC,CAAC;gBACE,cAAc,EACZ,yFAAyF;aAC5F;YACH,CAAC,CAAC,SAAS;KAChB,CAAC;AACJ,CAAC;AAMD,SAAgB,wBAAwB,CACtC,MAAyB,EACzB,cAAuB;IAEvB,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAEnC,IAAI,CAAC,CAAC,CAAC,eAAe,GAAG,2CAA6B,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CAAC,CAAC,cAAc,KAAK,2CAA6B,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EACT,iKAAiK;QACnK,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;QAC1E,OAAO,EACL,QAAQ,CAAC,MAAM,GAAG,CAAC;YACjB,CAAC,CAAC;gBACE,cAAc,EACZ,mFAAmF;aACtF;YACH,CAAC,CAAC,SAAS;KAChB,CAAC;AACJ,CAAC;AAMD,SAAgB,2BAA2B,CACzC,MAAyB,EACzB,cAAuB;IAEvB,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACnC,OAAO,CAAC,CAAC,CAAC,eAAe,GAAG,+CAAiC,CAAC,KAAK,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,yBAAyB;QAChC,WAAW,EACT,gJAAgJ;QAClJ,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;QAC1E,OAAO,EACL,QAAQ,CAAC,MAAM,GAAG,CAAC;YACjB,CAAC,CAAC;gBACE,cAAc,EACZ,wFAAwF;aAC3F;YACH,CAAC,CAAC,SAAS;KAChB,CAAC;AACJ,CAAC;AAGD,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,MAAM,eAAe,GAAG,IAAI,CAAC;AAC7B,MAAM,aAAa,GAAG,oBAAoB,GAAG,oBAAoB,GAAG,iBAAiB,CAAC;AACtF,MAAM,aAAa,GAAG,eAAe,GAAG,eAAe,CAAC;AAMxD,SAAgB,sBAAsB,CACpC,MAAyB,EACzB,cAAuB;IAEvB,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAEnC,IAAI,CAAC,CAAC,wBAAwB,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAE3D,OAAO,CAAC,CAAC,CAAC,wBAAwB,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EACT,kKAAkK;QACpK,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;QAC1E,OAAO,EACL,QAAQ,CAAC,MAAM,GAAG,CAAC;YACjB,CAAC,CAAC;gBACE,cAAc,EACZ,6FAA6F;aAChG;YACH,CAAC,CAAC,SAAS;KAChB,CAAC;AACJ,CAAC;AAMD,SAAgB,kBAAkB,CAChC,MAAyB,EACzB,cAAuB;IAEvB,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAEnC,IAAI,CAAC,CAAC,wBAAwB,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAE3D,MAAM,WAAW,GACf,CAAC,CAAC,CAAC,wBAAwB,GAAG,aAAa,CAAC,KAAK,CAAC;YAClD,CAAC,CAAC,CAAC,wBAAwB,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAErD,MAAM,SAAS,GACb,WAAW,IAAI,CAAC,CAAC,CAAC,wBAAwB,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACxE,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,oCAAoC;QAC3C,WAAW,EACT,iKAAiK;QACnK,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;QAC1E,OAAO,EACL,QAAQ,CAAC,MAAM,GAAG,CAAC;YACjB,CAAC,CAAC;gBACE,cAAc,EACZ,mGAAmG;aACtG;YACH,CAAC,CAAC,SAAS;KAChB,CAAC;AACJ,CAAC;AAMD,SAAgB,mBAAmB,CACjC,MAAyB,EACzB,cAAuB;IAEvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,YAAY,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAErD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAEnC,IAAI,CAAC,CAAC,CAAC,WAAW;YAAE,OAAO,KAAK,CAAC;QAEjC,OAAO,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,YAAY,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,6BAA6B;QACpC,WAAW,EACT,gJAAgJ;QAClJ,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;QAC1E,OAAO,EACL,QAAQ,CAAC,MAAM,GAAG,CAAC;YACjB,CAAC,CAAC;gBACE,cAAc,EACZ,wGAAwG;aAC3G;YACH,CAAC,CAAC,SAAS;KAChB,CAAC;AACJ,CAAC;AAKD,SAAgB,0BAA0B,CACxC,MAAyB,EACzB,cAAuB;IAEvB,OAAO;QACL,+BAA+B,CAAC,MAAM,EAAE,cAAc,CAAC;QACvD,kCAAkC,CAAC,MAAM,EAAE,cAAc,CAAC;QAC1D,wBAAwB,CAAC,MAAM,EAAE,cAAc,CAAC;QAChD,2BAA2B,CAAC,MAAM,EAAE,cAAc,CAAC;QACnD,sBAAsB,CAAC,MAAM,EAAE,cAAc,CAAC;QAC9C,kBAAkB,CAAC,MAAM,EAAE,cAAc,CAAC;QAC1C,mBAAmB,CAAC,MAAM,EAAE,cAAc,CAAC;KAC5C,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC"}

package/dist/services/audit/detectors/azure/app-security.detector.d.ts

@@ -0,0 +1,11 @@
+import { AzureApp } from '../../../../types/azure.types';
+import { Finding } from '../../../../types/finding.types';
+export declare function detectAppExcessiveGraphPerms(apps: AzureApp[], includeDetails: boolean): Finding;
+export declare function detectAppCredentialExpired(apps: AzureApp[], includeDetails: boolean): Finding;
+export declare function detectAppLongLivedCreds(apps: AzureApp[], includeDetails: boolean): Finding;
+export declare function detectAppMultitenantUnverified(apps: AzureApp[], includeDetails: boolean): Finding;
+export declare function detectAppCredentialExpiring(apps: AzureApp[], includeDetails: boolean): Finding;
+export declare function detectSpDisabledWithCreds(apps: AzureApp[], includeDetails: boolean): Finding;
+export declare function detectAppNoOwner(apps: AzureApp[], includeDetails: boolean): Finding;
+export declare function detectAppSecurityVulnerabilities(apps: AzureApp[], includeDetails: boolean): Finding[];
+//# sourceMappingURL=app-security.detector.d.ts.map

package/dist/services/audit/detectors/azure/app-security.detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-security.detector.d.ts","sourceRoot":"","sources":["../../../../../src/services/audit/detectors/azure/app-security.detector.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,iCAAiC,CAAC;AAM1D,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,cAAc,EAAE,OAAO,GAAG,OAAO,CAgD/F;AAKD,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,cAAc,EAAE,OAAO,GAAG,OAAO,CAwB7F;AAKD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,cAAc,EAAE,OAAO,GAAG,OAAO,CAyB1F;AAKD,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,cAAc,EAAE,OAAO,GAAG,OAAO,CAiBjG;AAKD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,cAAc,EAAE,OAAO,GAAG,OAAO,CA0B9F;AAKD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,cAAc,EAAE,OAAO,GAAG,OAAO,CAiB5F;AAKD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,cAAc,EAAE,OAAO,GAAG,OAAO,CAenF;AAKD,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,cAAc,EAAE,OAAO,GAAG,OAAO,EAAE,CAUrG"}