@etcsec-com/etc-collector 1.4.0

package/dist/services/audit/detectors/azure/app-security.detector.js

@@ -0,0 +1,184 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectAppExcessiveGraphPerms = detectAppExcessiveGraphPerms;
+exports.detectAppCredentialExpired = detectAppCredentialExpired;
+exports.detectAppLongLivedCreds = detectAppLongLivedCreds;
+exports.detectAppMultitenantUnverified = detectAppMultitenantUnverified;
+exports.detectAppCredentialExpiring = detectAppCredentialExpiring;
+exports.detectSpDisabledWithCreds = detectSpDisabledWithCreds;
+exports.detectAppNoOwner = detectAppNoOwner;
+exports.detectAppSecurityVulnerabilities = detectAppSecurityVulnerabilities;
+const entity_converter_1 = require("../../../../utils/entity-converter");
+function detectAppExcessiveGraphPerms(apps, includeDetails) {
+    const dangerousPermissionIds = [
+        '1bfefb4e-e0b5-418b-a88f-73c46d1986e9',
+        '19dbc75e-c2e2-444c-a770-ec69d8559fc7',
+        '9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8',
+        '741f803b-c850-494e-b5df-cde7c675a1ca',
+        '62a82d76-70ea-41e2-9197-370581804d09',
+    ];
+    const dangerousPermissionNames = [
+        'Application.ReadWrite.All',
+        'Directory.ReadWrite.All',
+        'RoleManagement.ReadWrite.Directory',
+        'User.ReadWrite.All',
+        'Group.ReadWrite.All',
+    ];
+    const affected = apps.filter((app) => {
+        const permissions = app.requiredResourceAccess || [];
+        return permissions.some((resource) => {
+            if (resource.resourceAppId === '00000003-0000-0000-c000-000000000000') {
+                return resource.resourceAccess?.some((access) => {
+                    if (dangerousPermissionIds.includes(access.id)) {
+                        return true;
+                    }
+                    if (access.value && dangerousPermissionNames.includes(access.value)) {
+                        return true;
+                    }
+                    return false;
+                });
+            }
+            return false;
+        });
+    });
+    return {
+        type: 'AZURE_APP_EXCESSIVE_GRAPH_PERMS',
+        severity: 'critical',
+        category: 'applications',
+        title: 'Excessive Microsoft Graph Permissions',
+        description: 'Application with high-privilege Graph API permissions. Can access sensitive data across tenant.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedAppEntities)(affected) : undefined,
+    };
+}
+function detectAppCredentialExpired(apps, includeDetails) {
+    const now = Date.now();
+    const affected = apps.filter((app) => {
+        const credentials = [
+            ...(app.passwordCredentials || []),
+            ...(app.keyCredentials || []),
+        ];
+        return credentials.some((cred) => {
+            if (!cred.endDateTime)
+                return false;
+            return new Date(cred.endDateTime).getTime() < now;
+        });
+    });
+    return {
+        type: 'AZURE_APP_CREDENTIAL_EXPIRED',
+        severity: 'high',
+        category: 'applications',
+        title: 'Application Credential Expired',
+        description: 'Application with expired secret or certificate. May cause service disruption.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedAppEntities)(affected) : undefined,
+    };
+}
+function detectAppLongLivedCreds(apps, includeDetails) {
+    const now = Date.now();
+    const oneYearFromNow = now + 365 * 24 * 60 * 60 * 1000;
+    const affected = apps.filter((app) => {
+        const credentials = [
+            ...(app.passwordCredentials || []),
+            ...(app.keyCredentials || []),
+        ];
+        return credentials.some((cred) => {
+            if (!cred.endDateTime)
+                return false;
+            return new Date(cred.endDateTime).getTime() > oneYearFromNow;
+        });
+    });
+    return {
+        type: 'AZURE_APP_LONG_LIVED_CREDS',
+        severity: 'high',
+        category: 'applications',
+        title: 'Long-Lived Application Credentials',
+        description: 'Application credential valid for more than 1 year. Increases risk if credential is compromised.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedAppEntities)(affected) : undefined,
+    };
+}
+function detectAppMultitenantUnverified(apps, includeDetails) {
+    const affected = apps.filter((app) => {
+        const isMultiTenant = app.signInAudience === 'AzureADMultipleOrgs' || app.signInAudience === 'AzureADandPersonalMicrosoftAccount';
+        const isVerified = app.publisherDomain && app.verifiedPublisher;
+        return isMultiTenant && !isVerified;
+    });
+    return {
+        type: 'AZURE_APP_MULTITENANT_UNVERIFIED',
+        severity: 'high',
+        category: 'applications',
+        title: 'Unverified Multi-Tenant Application',
+        description: 'Multi-tenant application without verified publisher. Users from other tenants may be at risk.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedAppEntities)(affected) : undefined,
+    };
+}
+function detectAppCredentialExpiring(apps, includeDetails) {
+    const now = Date.now();
+    const thirtyDaysFromNow = now + 30 * 24 * 60 * 60 * 1000;
+    const affected = apps.filter((app) => {
+        const credentials = [
+            ...(app.passwordCredentials || []),
+            ...(app.keyCredentials || []),
+        ];
+        return credentials.some((cred) => {
+            if (!cred.endDateTime)
+                return false;
+            const expiry = new Date(cred.endDateTime).getTime();
+            return expiry > now && expiry < thirtyDaysFromNow;
+        });
+    });
+    return {
+        type: 'AZURE_APP_CREDENTIAL_EXPIRING',
+        severity: 'medium',
+        category: 'applications',
+        title: 'Application Credential Expiring Soon',
+        description: 'Application credential expiring within 30 days. Action required to avoid service disruption.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedAppEntities)(affected) : undefined,
+    };
+}
+function detectSpDisabledWithCreds(apps, includeDetails) {
+    const affected = apps.filter((app) => {
+        const isDisabled = app.accountEnabled === false;
+        const hasCredentials = (app.passwordCredentials?.length > 0) || (app.keyCredentials?.length > 0);
+        return isDisabled && hasCredentials;
+    });
+    return {
+        type: 'AZURE_SP_DISABLED_WITH_CREDS',
+        severity: 'medium',
+        category: 'applications',
+        title: 'Disabled Service Principal with Credentials',
+        description: 'Disabled service principal still has active credentials. Credentials should be removed.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedAppEntities)(affected) : undefined,
+    };
+}
+function detectAppNoOwner(apps, includeDetails) {
+    const affected = apps.filter((app) => {
+        const owners = app.owners || [];
+        return owners.length === 0;
+    });
+    return {
+        type: 'AZURE_APP_NO_OWNER',
+        severity: 'medium',
+        category: 'applications',
+        title: 'Application without Owner',
+        description: 'Application has no assigned owners. Orphaned applications are difficult to manage.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedAppEntities)(affected) : undefined,
+    };
+}
+function detectAppSecurityVulnerabilities(apps, includeDetails) {
+    return [
+        detectAppExcessiveGraphPerms(apps, includeDetails),
+        detectAppCredentialExpired(apps, includeDetails),
+        detectAppLongLivedCreds(apps, includeDetails),
+        detectAppMultitenantUnverified(apps, includeDetails),
+        detectAppCredentialExpiring(apps, includeDetails),
+        detectSpDisabledWithCreds(apps, includeDetails),
+        detectAppNoOwner(apps, includeDetails),
+    ].filter((finding) => finding.count > 0);
+}
+//# sourceMappingURL=app-security.detector.js.map

package/dist/services/audit/detectors/azure/app-security.detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-security.detector.js","sourceRoot":"","sources":["../../../../../src/services/audit/detectors/azure/app-security.detector.ts"],"names":[],"mappings":";;AA4BA,oEAgDC;AAKD,gEAwBC;AAKD,0DAyBC;AAKD,wEAiBC;AAKD,kEA0BC;AAKD,8DAiBC;AAKD,4CAeC;AAKD,4EAUC;AA9ND,yEAA2E;AAK3E,SAAgB,4BAA4B,CAAC,IAAgB,EAAE,cAAuB;IAEpF,MAAM,sBAAsB,GAAG;QAC7B,sCAAsC;QACtC,sCAAsC;QACtC,sCAAsC;QACtC,sCAAsC;QACtC,sCAAsC;KACvC,CAAC;IAEF,MAAM,wBAAwB,GAAG;QAC/B,2BAA2B;QAC3B,yBAAyB;QACzB,oCAAoC;QACpC,oBAAoB;QACpB,qBAAqB;KACtB,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACnC,MAAM,WAAW,GAAI,GAAW,CAAC,sBAAsB,IAAI,EAAE,CAAC;QAC9D,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,QAAa,EAAE,EAAE;YACxC,IAAI,QAAQ,CAAC,aAAa,KAAK,sCAAsC,EAAE,CAAC;gBAEtE,OAAO,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,MAAW,EAAE,EAAE;oBAEnD,IAAI,sBAAsB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;wBAC/C,OAAO,IAAI,CAAC;oBACd,CAAC;oBAED,IAAI,MAAM,CAAC,KAAK,IAAI,wBAAwB,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;wBACpE,OAAO,IAAI,CAAC;oBACd,CAAC;oBACD,OAAO,KAAK,CAAC;gBACf,CAAC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,iCAAiC;QACvC,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,cAAc;QACxB,KAAK,EAAE,uCAAuC;QAC9C,WAAW,EAAE,iGAAiG;QAC9G,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,IAAA,wCAAqB,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KAC/E,CAAC;AACJ,CAAC;AAKD,SAAgB,0BAA0B,CAAC,IAAgB,EAAE,cAAuB;IAClF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACnC,MAAM,WAAW,GAAG;YAClB,GAAG,CAAE,GAAW,CAAC,mBAAmB,IAAI,EAAE,CAAC;YAC3C,GAAG,CAAE,GAAW,CAAC,cAAc,IAAI,EAAE,CAAC;SACvC,CAAC;QAEF,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,IAAS,EAAE,EAAE;YACpC,IAAI,CAAC,IAAI,CAAC,WAAW;gBAAE,OAAO,KAAK,CAAC;YACpC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,8BAA8B;QACpC,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,cAAc;QACxB,KAAK,EAAE,gCAAgC;QACvC,WAAW,EAAE,+EAA+E;QAC5F,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,IAAA,wCAAqB,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KAC/E,CAAC;AACJ,CAAC;AAKD,SAAgB,uBAAuB,CAAC,IAAgB,EAAE,cAAuB;IAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,cAAc,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAEvD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACnC,MAAM,WAAW,GAAG;YAClB,GAAG,CAAE,GAAW,CAAC,mBAAmB,IAAI,EAAE,CAAC;YAC3C,GAAG,CAAE,GAAW,CAAC,cAAc,IAAI,EAAE,CAAC;SACvC,CAAC;QAEF,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,IAAS,EAAE,EAAE;YACpC,IAAI,CAAC,IAAI,CAAC,WAAW;gBAAE,OAAO,KAAK,CAAC;YACpC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,cAAc,CAAC;QAC/D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,4BAA4B;QAClC,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,cAAc;QACxB,KAAK,EAAE,oCAAoC;QAC3C,WAAW,EAAE,iGAAiG;QAC9G,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,IAAA,wCAAqB,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KAC/E,CAAC;AACJ,CAAC;AAKD,SAAgB,8BAA8B,CAAC,IAAgB,EAAE,cAAuB;IACtF,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACnC,MAAM,aAAa,GAAG,GAAG,CAAC,cAAc,KAAK,qBAAqB,IAAI,GAAG,CAAC,cAAc,KAAK,oCAAoC,CAAC;QAClI,MAAM,UAAU,GAAI,GAAW,CAAC,eAAe,IAAK,GAAW,CAAC,iBAAiB,CAAC;QAElF,OAAO,aAAa,IAAI,CAAC,UAAU,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,kCAAkC;QACxC,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,cAAc;QACxB,KAAK,EAAE,qCAAqC;QAC5C,WAAW,EAAE,+FAA+F;QAC5G,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,IAAA,wCAAqB,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KAC/E,CAAC;AACJ,CAAC;AAKD,SAAgB,2BAA2B,CAAC,IAAgB,EAAE,cAAuB;IACnF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,iBAAiB,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAEzD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACnC,MAAM,WAAW,GAAG;YAClB,GAAG,CAAE,GAAW,CAAC,mBAAmB,IAAI,EAAE,CAAC;YAC3C,GAAG,CAAE,GAAW,CAAC,cAAc,IAAI,EAAE,CAAC;SACvC,CAAC;QAEF,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,IAAS,EAAE,EAAE;YACpC,IAAI,CAAC,IAAI,CAAC,WAAW;gBAAE,OAAO,KAAK,CAAC;YACpC,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC;YACpD,OAAO,MAAM,GAAG,GAAG,IAAI,MAAM,GAAG,iBAAiB,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,+BAA+B;QACrC,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,cAAc;QACxB,KAAK,EAAE,sCAAsC;QAC7C,WAAW,EAAE,8FAA8F;QAC3G,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,IAAA,wCAAqB,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KAC/E,CAAC;AACJ,CAAC;AAKD,SAAgB,yBAAyB,CAAC,IAAgB,EAAE,cAAuB;IACjF,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACnC,MAAM,UAAU,GAAI,GAAW,CAAC,cAAc,KAAK,KAAK,CAAC;QACzD,MAAM,cAAc,GAAG,CAAE,GAAW,CAAC,mBAAmB,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,CAAE,GAAW,CAAC,cAAc,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;QAEnH,OAAO,UAAU,IAAI,cAAc,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,8BAA8B;QACpC,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,cAAc;QACxB,KAAK,EAAE,6CAA6C;QACpD,WAAW,EAAE,yFAAyF;QACtG,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,IAAA,wCAAqB,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KAC/E,CAAC;AACJ,CAAC;AAKD,SAAgB,gBAAgB,CAAC,IAAgB,EAAE,cAAuB;IACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACnC,MAAM,MAAM,GAAI,GAAW,CAAC,MAAM,IAAI,EAAE,CAAC;QACzC,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,cAAc;QACxB,KAAK,EAAE,2BAA2B;QAClC,WAAW,EAAE,oFAAoF;QACjG,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,IAAA,wCAAqB,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KAC/E,CAAC;AACJ,CAAC;AAKD,SAAgB,gCAAgC,CAAC,IAAgB,EAAE,cAAuB;IACxF,OAAO;QACL,4BAA4B,CAAC,IAAI,EAAE,cAAc,CAAC;QAClD,0BAA0B,CAAC,IAAI,EAAE,cAAc,CAAC;QAChD,uBAAuB,CAAC,IAAI,EAAE,cAAc,CAAC;QAC7C,8BAA8B,CAAC,IAAI,EAAE,cAAc,CAAC;QACpD,2BAA2B,CAAC,IAAI,EAAE,cAAc,CAAC;QACjD,yBAAyB,CAAC,IAAI,EAAE,cAAc,CAAC;QAC/C,gBAAgB,CAAC,IAAI,EAAE,cAAc,CAAC;KACvC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC"}

package/dist/services/audit/detectors/azure/conditional-access.detector.d.ts

@@ -0,0 +1,10 @@
+import { AzurePolicy } from '../../../../types/azure.types';
+import { Finding } from '../../../../types/finding.types';
+export declare function detectNoMfaCaPolicy(policies: AzurePolicy[], includeDetails: boolean): Finding;
+export declare function detectNoLegacyAuthBlock(policies: AzurePolicy[], includeDetails: boolean): Finding;
+export declare function detectCaPolicyDisabled(policies: AzurePolicy[], includeDetails: boolean): Finding;
+export declare function detectCaPolicyHasExclusions(policies: AzurePolicy[], includeDetails: boolean): Finding;
+export declare function detectNoDeviceComplianceCa(policies: AzurePolicy[], includeDetails: boolean): Finding;
+export declare function detectCaPolicyReportOnly(policies: AzurePolicy[], includeDetails: boolean): Finding;
+export declare function detectConditionalAccessVulnerabilities(policies: AzurePolicy[], includeDetails: boolean): Finding[];
+//# sourceMappingURL=conditional-access.detector.d.ts.map

package/dist/services/audit/detectors/azure/conditional-access.detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conditional-access.detector.d.ts","sourceRoot":"","sources":["../../../../../src/services/audit/detectors/azure/conditional-access.detector.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,iCAAiC,CAAC;AAK1D,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,cAAc,EAAE,OAAO,GAAG,OAAO,CAoB7F;AAKD,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,cAAc,EAAE,OAAO,GAAG,OAAO,CAyBjG;AAKD,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,cAAc,EAAE,OAAO,GAAG,OAAO,CAchG;AAKD,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,cAAc,EAAE,OAAO,GAAG,OAAO,CAwBrG;AAKD,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,cAAc,EAAE,OAAO,GAAG,OAAO,CAoBpG;AAKD,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,cAAc,EAAE,OAAO,GAAG,OAAO,CAclG;AAKD,wBAAgB,sCAAsC,CACpD,QAAQ,EAAE,WAAW,EAAE,EACvB,cAAc,EAAE,OAAO,GACtB,OAAO,EAAE,CASX"}

package/dist/services/audit/detectors/azure/conditional-access.detector.js

@@ -0,0 +1,130 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectNoMfaCaPolicy = detectNoMfaCaPolicy;
+exports.detectNoLegacyAuthBlock = detectNoLegacyAuthBlock;
+exports.detectCaPolicyDisabled = detectCaPolicyDisabled;
+exports.detectCaPolicyHasExclusions = detectCaPolicyHasExclusions;
+exports.detectNoDeviceComplianceCa = detectNoDeviceComplianceCa;
+exports.detectCaPolicyReportOnly = detectCaPolicyReportOnly;
+exports.detectConditionalAccessVulnerabilities = detectConditionalAccessVulnerabilities;
+function detectNoMfaCaPolicy(policies, includeDetails) {
+    const hasMfaPolicy = policies.some((policy) => {
+        if (policy.state !== 'enabled')
+            return false;
+        const grantControls = policy.grantControls;
+        if (!grantControls)
+            return false;
+        const builtInControls = grantControls.builtInControls || [];
+        return builtInControls.includes('mfa');
+    });
+    return {
+        type: 'AZURE_NO_MFA_CA_POLICY',
+        severity: 'critical',
+        category: 'conditionalAccess',
+        title: 'No MFA Enforcement via Conditional Access',
+        description: 'No Conditional Access policy enforcing MFA. Users can authenticate without multi-factor authentication.',
+        count: hasMfaPolicy ? 0 : 1,
+        affectedEntities: includeDetails && !hasMfaPolicy ? ['Tenant-wide'] : undefined,
+    };
+}
+function detectNoLegacyAuthBlock(policies, includeDetails) {
+    const hasLegacyAuthBlock = policies.some((policy) => {
+        if (policy.state !== 'enabled')
+            return false;
+        const conditions = policy.conditions;
+        const clientAppTypes = conditions?.clientAppTypes || [];
+        const blocksLegacyAuth = clientAppTypes.includes('exchangeActiveSync') ||
+            clientAppTypes.includes('other') ||
+            (clientAppTypes.includes('all') && policy.grantControls?.builtInControls?.includes('block'));
+        return blocksLegacyAuth;
+    });
+    return {
+        type: 'AZURE_NO_LEGACY_AUTH_BLOCK',
+        severity: 'critical',
+        category: 'conditionalAccess',
+        title: 'No Policy Blocking Legacy Authentication',
+        description: 'No Conditional Access policy blocking legacy authentication protocols. Legacy auth bypasses MFA.',
+        count: hasLegacyAuthBlock ? 0 : 1,
+        affectedEntities: includeDetails && !hasLegacyAuthBlock ? ['Tenant-wide'] : undefined,
+    };
+}
+function detectCaPolicyDisabled(policies, includeDetails) {
+    const affected = policies.filter((policy) => {
+        return policy.state === 'disabled';
+    });
+    return {
+        type: 'AZURE_CA_POLICY_DISABLED',
+        severity: 'medium',
+        category: 'conditionalAccess',
+        title: 'Disabled Conditional Access Policy',
+        description: 'Conditional Access policy is disabled. Security controls are not being enforced.',
+        count: affected.length,
+        affectedEntities: includeDetails ? affected.map((p) => p.displayName) : undefined,
+    };
+}
+function detectCaPolicyHasExclusions(policies, includeDetails) {
+    const affected = policies.filter((policy) => {
+        if (policy.state !== 'enabled')
+            return false;
+        const conditions = policy.conditions;
+        const users = conditions?.users;
+        const hasExclusions = (users?.excludeUsers && users.excludeUsers.length > 0) ||
+            (users?.excludeGroups && users.excludeGroups.length > 0) ||
+            (users?.excludeRoles && users.excludeRoles.length > 0);
+        return hasExclusions;
+    });
+    return {
+        type: 'AZURE_CA_POLICY_HAS_EXCLUSIONS',
+        severity: 'medium',
+        category: 'conditionalAccess',
+        title: 'Conditional Access Policy with Exclusions',
+        description: 'CA policy has user, group, or role exclusions. Excluded identities bypass security controls.',
+        count: affected.length,
+        affectedEntities: includeDetails ? affected.map((p) => p.displayName) : undefined,
+    };
+}
+function detectNoDeviceComplianceCa(policies, includeDetails) {
+    const hasDeviceCompliancePolicy = policies.some((policy) => {
+        if (policy.state !== 'enabled')
+            return false;
+        const grantControls = policy.grantControls;
+        if (!grantControls)
+            return false;
+        const builtInControls = grantControls.builtInControls || [];
+        return builtInControls.includes('compliantDevice') || builtInControls.includes('domainJoinedDevice');
+    });
+    return {
+        type: 'AZURE_NO_DEVICE_COMPLIANCE_CA',
+        severity: 'medium',
+        category: 'conditionalAccess',
+        title: 'No Device Compliance Requirement',
+        description: 'No Conditional Access policy requiring compliant devices. Unmanaged devices can access resources.',
+        count: hasDeviceCompliancePolicy ? 0 : 1,
+        affectedEntities: includeDetails && !hasDeviceCompliancePolicy ? ['Tenant-wide'] : undefined,
+    };
+}
+function detectCaPolicyReportOnly(policies, includeDetails) {
+    const affected = policies.filter((policy) => {
+        return policy.state === 'enabledForReportingButNotEnforced';
+    });
+    return {
+        type: 'AZURE_CA_POLICY_REPORT_ONLY',
+        severity: 'low',
+        category: 'conditionalAccess',
+        title: 'Conditional Access Policy in Report-Only Mode',
+        description: 'CA policy in report-only mode. Security controls are not being enforced, only logged.',
+        count: affected.length,
+        affectedEntities: includeDetails ? affected.map((p) => p.displayName) : undefined,
+    };
+}
+function detectConditionalAccessVulnerabilities(policies, includeDetails) {
+    return [
+        detectNoMfaCaPolicy(policies, includeDetails),
+        detectNoLegacyAuthBlock(policies, includeDetails),
+        detectCaPolicyDisabled(policies, includeDetails),
+        detectCaPolicyHasExclusions(policies, includeDetails),
+        detectNoDeviceComplianceCa(policies, includeDetails),
+        detectCaPolicyReportOnly(policies, includeDetails),
+    ].filter((finding) => finding.count > 0);
+}
+//# sourceMappingURL=conditional-access.detector.js.map

package/dist/services/audit/detectors/azure/conditional-access.detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conditional-access.detector.js","sourceRoot":"","sources":["../../../../../src/services/audit/detectors/azure/conditional-access.detector.ts"],"names":[],"mappings":";;AA0BA,kDAoBC;AAKD,0DAyBC;AAKD,wDAcC;AAKD,kEAwBC;AAKD,gEAoBC;AAKD,4DAcC;AAKD,wFAYC;AA/JD,SAAgB,mBAAmB,CAAC,QAAuB,EAAE,cAAuB;IAClF,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QAC5C,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAE7C,MAAM,aAAa,GAAI,MAAc,CAAC,aAAa,CAAC;QACpD,IAAI,CAAC,aAAa;YAAE,OAAO,KAAK,CAAC;QAEjC,MAAM,eAAe,GAAG,aAAa,CAAC,eAAe,IAAI,EAAE,CAAC;QAC5D,OAAO,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,mBAAmB;QAC7B,KAAK,EAAE,2CAA2C;QAClD,WAAW,EAAE,yGAAyG;QACtH,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,gBAAgB,EAAE,cAAc,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS;KAChF,CAAC;AACJ,CAAC;AAKD,SAAgB,uBAAuB,CAAC,QAAuB,EAAE,cAAuB;IACtF,MAAM,kBAAkB,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QAClD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAE7C,MAAM,UAAU,GAAI,MAAc,CAAC,UAAU,CAAC;QAC9C,MAAM,cAAc,GAAG,UAAU,EAAE,cAAc,IAAI,EAAE,CAAC;QAGxD,MAAM,gBAAgB,GACpB,cAAc,CAAC,QAAQ,CAAC,oBAAoB,CAAC;YAC7C,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC;YAChC,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAK,MAAc,CAAC,aAAa,EAAE,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAExG,OAAO,gBAAgB,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,4BAA4B;QAClC,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,mBAAmB;QAC7B,KAAK,EAAE,0CAA0C;QACjD,WAAW,EAAE,kGAAkG;QAC/G,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,gBAAgB,EAAE,cAAc,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS;KACtF,CAAC;AACJ,CAAC;AAKD,SAAgB,sBAAsB,CAAC,QAAuB,EAAE,cAAuB;IACrF,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;QAC1C,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,mBAAmB;QAC7B,KAAK,EAAE,oCAAoC;QAC3C,WAAW,EAAE,kFAAkF;QAC/F,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;KAClF,CAAC;AACJ,CAAC;AAKD,SAAgB,2BAA2B,CAAC,QAAuB,EAAE,cAAuB;IAC1F,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;QAC1C,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAE7C,MAAM,UAAU,GAAI,MAAc,CAAC,UAAU,CAAC;QAC9C,MAAM,KAAK,GAAG,UAAU,EAAE,KAAK,CAAC;QAEhC,MAAM,aAAa,GACjB,CAAC,KAAK,EAAE,YAAY,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;YACtD,CAAC,KAAK,EAAE,aAAa,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;YACxD,CAAC,KAAK,EAAE,YAAY,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEzD,OAAO,aAAa,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,gCAAgC;QACtC,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,mBAAmB;QAC7B,KAAK,EAAE,2CAA2C;QAClD,WAAW,EAAE,8FAA8F;QAC3G,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;KAClF,CAAC;AACJ,CAAC;AAKD,SAAgB,0BAA0B,CAAC,QAAuB,EAAE,cAAuB;IACzF,MAAM,yBAAyB,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QACzD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAE7C,MAAM,aAAa,GAAI,MAAc,CAAC,aAAa,CAAC;QACpD,IAAI,CAAC,aAAa;YAAE,OAAO,KAAK,CAAC;QAEjC,MAAM,eAAe,GAAG,aAAa,CAAC,eAAe,IAAI,EAAE,CAAC;QAC5D,OAAO,eAAe,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,+BAA+B;QACrC,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,mBAAmB;QAC7B,KAAK,EAAE,kCAAkC;QACzC,WAAW,EAAE,mGAAmG;QAChH,KAAK,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,gBAAgB,EAAE,cAAc,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS;KAC7F,CAAC;AACJ,CAAC;AAKD,SAAgB,wBAAwB,CAAC,QAAuB,EAAE,cAAuB;IACvF,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;QAC1C,OAAO,MAAM,CAAC,KAAK,KAAK,mCAAmC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,6BAA6B;QACnC,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,mBAAmB;QAC7B,KAAK,EAAE,+CAA+C;QACtD,WAAW,EAAE,uFAAuF;QACpG,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;KAClF,CAAC;AACJ,CAAC;AAKD,SAAgB,sCAAsC,CACpD,QAAuB,EACvB,cAAuB;IAEvB,OAAO;QACL,mBAAmB,CAAC,QAAQ,EAAE,cAAc,CAAC;QAC7C,uBAAuB,CAAC,QAAQ,EAAE,cAAc,CAAC;QACjD,sBAAsB,CAAC,QAAQ,EAAE,cAAc,CAAC;QAChD,2BAA2B,CAAC,QAAQ,EAAE,cAAc,CAAC;QACrD,0BAA0B,CAAC,QAAQ,EAAE,cAAc,CAAC;QACpD,wBAAwB,CAAC,QAAQ,EAAE,cAAc,CAAC;KACnD,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC"}

package/dist/services/audit/detectors/azure/privilege-security.detector.d.ts

@@ -0,0 +1,8 @@
+import { AzureUser, AzureGroup } from '../../../../types/azure.types';
+import { Finding } from '../../../../types/finding.types';
+export declare function detectGuestPrivilegedAccess(users: AzureUser[], roles: Map<string, string[]>, includeDetails: boolean): Finding;
+export declare function detectServiceAccountPrivileged(users: AzureUser[], roles: Map<string, string[]>, includeDetails: boolean): Finding;
+export declare function detectTooManyGlobalAdmins(users: AzureUser[], roles: Map<string, string[]>, includeDetails: boolean): Finding;
+export declare function detectGroupDynamicRiskyRule(groups: AzureGroup[], includeDetails: boolean): Finding;
+export declare function detectPrivilegeSecurityVulnerabilities(users: AzureUser[], groups: AzureGroup[], roles: Map<string, string[]>, includeDetails: boolean): Finding[];
+//# sourceMappingURL=privilege-security.detector.d.ts.map

package/dist/services/audit/detectors/azure/privilege-security.detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"privilege-security.detector.d.ts","sourceRoot":"","sources":["../../../../../src/services/audit/detectors/azure/privilege-security.detector.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,iCAAiC,CAAC;AAM1D,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,SAAS,EAAE,EAClB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAC5B,cAAc,EAAE,OAAO,GACtB,OAAO,CA4BT;AAKD,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,SAAS,EAAE,EAClB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAC5B,cAAc,EAAE,OAAO,GACtB,OAAO,CA+BT;AAKD,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,SAAS,EAAE,EAClB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAC5B,cAAc,EAAE,OAAO,GACtB,OAAO,CAoBT;AAKD,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,cAAc,EAAE,OAAO,GAAG,OAAO,CA6BlG;AAKD,wBAAgB,sCAAsC,CACpD,KAAK,EAAE,SAAS,EAAE,EAClB,MAAM,EAAE,UAAU,EAAE,EACpB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAC5B,cAAc,EAAE,OAAO,GACtB,OAAO,EAAE,CAOX"}

package/dist/services/audit/detectors/azure/privilege-security.detector.js

@@ -0,0 +1,113 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectGuestPrivilegedAccess = detectGuestPrivilegedAccess;
+exports.detectServiceAccountPrivileged = detectServiceAccountPrivileged;
+exports.detectTooManyGlobalAdmins = detectTooManyGlobalAdmins;
+exports.detectGroupDynamicRiskyRule = detectGroupDynamicRiskyRule;
+exports.detectPrivilegeSecurityVulnerabilities = detectPrivilegeSecurityVulnerabilities;
+const entity_converter_1 = require("../../../../utils/entity-converter");
+function detectGuestPrivilegedAccess(users, roles, includeDetails) {
+    const privilegedRoleIds = [
+        '62e90394-69f5-4237-9190-012177145e10',
+        'e8611ab8-c189-46e8-94e1-60213ab1f814',
+        '194ae4cb-b126-40b2-bd5b-6091b380977d',
+        '29232cdf-9323-42fd-ade2-1d097af3e4de',
+        'f28a1f50-f6e7-4571-818b-6a12f2af6b6c',
+        '729827e3-9c14-49f7-bb1b-9608f156bbb8',
+        'b0f54661-2d74-4c50-afa3-1ec803f12efe',
+    ];
+    const affected = users.filter((u) => {
+        const isGuest = u.userType === 'Guest';
+        const userRoles = roles.get(u.id) || [];
+        const hasPrivilegedRole = userRoles.some((r) => privilegedRoleIds.includes(r));
+        return isGuest && hasPrivilegedRole;
+    });
+    return {
+        type: 'AZURE_GUEST_PRIVILEGED_ACCESS',
+        severity: 'critical',
+        category: 'privilegedAccess',
+        title: 'Guest User with Privileged Role',
+        description: 'Guest user from external domain assigned privileged role. High risk from external account compromise.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedAzureUserEntities)(affected) : undefined,
+    };
+}
+function detectServiceAccountPrivileged(users, roles, includeDetails) {
+    const privilegedRoleIds = [
+        '62e90394-69f5-4237-9190-012177145e10',
+        'e8611ab8-c189-46e8-94e1-60213ab1f814',
+        '194ae4cb-b126-40b2-bd5b-6091b380977d',
+    ];
+    const affected = users.filter((u) => {
+        const isServiceAccount = !u.lastSignInDateTime ||
+            u.userPrincipalName?.toLowerCase().includes('svc') ||
+            u.userPrincipalName?.toLowerCase().includes('service') ||
+            u.displayName?.toLowerCase().includes('service') ||
+            u.userType === 'Application';
+        const userRoles = roles.get(u.id) || [];
+        const hasPrivilegedRole = userRoles.some((r) => privilegedRoleIds.includes(r));
+        return isServiceAccount && hasPrivilegedRole;
+    });
+    return {
+        type: 'AZURE_SERVICE_ACCOUNT_PRIVILEGED',
+        severity: 'critical',
+        category: 'privilegedAccess',
+        title: 'Service Account with Privileged Role',
+        description: 'Service/application account with privileged role. Service accounts should use managed identities.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedAzureUserEntities)(affected) : undefined,
+    };
+}
+function detectTooManyGlobalAdmins(users, roles, includeDetails) {
+    const globalAdminRoleId = '62e90394-69f5-4237-9190-012177145e10';
+    const affected = users.filter((u) => {
+        const userRoles = roles.get(u.id) || [];
+        return userRoles.includes(globalAdminRoleId);
+    });
+    const threshold = 5;
+    const count = affected.length > threshold ? 1 : 0;
+    return {
+        type: 'AZURE_TOO_MANY_GLOBAL_ADMINS',
+        severity: 'high',
+        category: 'privilegedAccess',
+        title: 'Too Many Global Administrators',
+        description: `Tenant has ${affected.length} Global Administrators (recommended: ≤${threshold}). Excessive admin accounts increase attack surface.`,
+        count,
+        affectedEntities: includeDetails && count > 0 ? [`${affected.length} Global Admins`] : undefined,
+    };
+}
+function detectGroupDynamicRiskyRule(groups, includeDetails) {
+    const riskyPatterns = [
+        'accountEnabled eq true',
+        'userType eq "Member"',
+        'userType eq "Guest"',
+        'objectId ne null',
+        'mail contains "@"',
+    ];
+    const affected = groups.filter((g) => {
+        const membershipRule = g.membershipRule;
+        if (!membershipRule || g.groupTypes?.includes('DynamicMembership') === false) {
+            return false;
+        }
+        const lowerRule = membershipRule.toLowerCase();
+        return riskyPatterns.some((pattern) => lowerRule.includes(pattern.toLowerCase()));
+    });
+    return {
+        type: 'AZURE_GROUP_DYNAMIC_RISKY_RULE',
+        severity: 'high',
+        category: 'privilegedAccess',
+        title: 'Dynamic Group with Risky Membership Rule',
+        description: 'Dynamic group with overly permissive membership rule. May grant unintended access.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedAzureGroupEntities)(affected) : undefined,
+    };
+}
+function detectPrivilegeSecurityVulnerabilities(users, groups, roles, includeDetails) {
+    return [
+        detectGuestPrivilegedAccess(users, roles, includeDetails),
+        detectServiceAccountPrivileged(users, roles, includeDetails),
+        detectTooManyGlobalAdmins(users, roles, includeDetails),
+        detectGroupDynamicRiskyRule(groups, includeDetails),
+    ].filter((finding) => finding.count > 0);
+}
+//# sourceMappingURL=privilege-security.detector.js.map

package/dist/services/audit/detectors/azure/privilege-security.detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privilege-security.detector.js","sourceRoot":"","sources":["../../../../../src/services/audit/detectors/azure/privilege-security.detector.ts"],"names":[],"mappings":";;AAuBA,kEAgCC;AAKD,wEAmCC;AAKD,8DAwBC;AAKD,kEA6BC;AAKD,wFAYC;AA7JD,yEAA+G;AAK/G,SAAgB,2BAA2B,CACzC,KAAkB,EAClB,KAA4B,EAC5B,cAAuB;IAEvB,MAAM,iBAAiB,GAAG;QACxB,sCAAsC;QACtC,sCAAsC;QACtC,sCAAsC;QACtC,sCAAsC;QACtC,sCAAsC;QACtC,sCAAsC;QACtC,sCAAsC;KACvC,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,MAAM,OAAO,GAAI,CAAS,CAAC,QAAQ,KAAK,OAAO,CAAC;QAChD,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,iBAAiB,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAE/E,OAAO,OAAO,IAAI,iBAAiB,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,+BAA+B;QACrC,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,kBAAkB;QAC5B,KAAK,EAAE,iCAAiC;QACxC,WAAW,EAAE,uGAAuG;QACpH,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,IAAA,8CAA2B,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KACrF,CAAC;AACJ,CAAC;AAKD,SAAgB,8BAA8B,CAC5C,KAAkB,EAClB,KAA4B,EAC5B,cAAuB;IAEvB,MAAM,iBAAiB,GAAG;QACxB,sCAAsC;QACtC,sCAAsC;QACtC,sCAAsC;KACvC,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAElC,MAAM,gBAAgB,GACpB,CAAC,CAAC,CAAC,kBAAkB;YACrB,CAAC,CAAC,iBAAiB,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;YAClD,CAAC,CAAC,iBAAiB,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YACtD,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC/C,CAAS,CAAC,QAAQ,KAAK,aAAa,CAAC;QAExC,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,iBAAiB,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAE/E,OAAO,gBAAgB,IAAI,iBAAiB,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,kCAAkC;QACxC,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,kBAAkB;QAC5B,KAAK,EAAE,sCAAsC;QAC7C,WAAW,EAAE,mGAAmG;QAChH,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,IAAA,8CAA2B,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KACrF,CAAC;AACJ,CAAC;AAKD,SAAgB,yBAAyB,CACvC,KAAkB,EAClB,KAA4B,EAC5B,cAAuB;IAEvB,MAAM,iBAAiB,GAAG,sCAAsC,CAAC;IAEjE,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QACxC,OAAO,SAAS,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,CAAC,CAAC;IACpB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAElD,OAAO;QACL,IAAI,EAAE,8BAA8B;QACpC,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,kBAAkB;QAC5B,KAAK,EAAE,gCAAgC;QACvC,WAAW,EAAE,cAAc,QAAQ,CAAC,MAAM,yCAAyC,SAAS,sDAAsD;QAClJ,KAAK;QACL,gBAAgB,EAAE,cAAc,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS;KACjG,CAAC;AACJ,CAAC;AAKD,SAAgB,2BAA2B,CAAC,MAAoB,EAAE,cAAuB;IACvF,MAAM,aAAa,GAAG;QACpB,wBAAwB;QACxB,sBAAsB;QACtB,qBAAqB;QACrB,kBAAkB;QAClB,mBAAmB;KACpB,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACnC,MAAM,cAAc,GAAI,CAAS,CAAC,cAAc,CAAC;QACjD,IAAI,CAAC,cAAc,IAAK,CAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,mBAAmB,CAAC,KAAK,KAAK,EAAE,CAAC;YACtF,OAAO,KAAK,CAAC;QACf,CAAC;QAGD,MAAM,SAAS,GAAG,cAAc,CAAC,WAAW,EAAE,CAAC;QAC/C,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,gCAAgC;QACtC,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,kBAAkB;QAC5B,KAAK,EAAE,0CAA0C;QACjD,WAAW,EAAE,oFAAoF;QACjG,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,IAAA,+CAA4B,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KACtF,CAAC;AACJ,CAAC;AAKD,SAAgB,sCAAsC,CACpD,KAAkB,EAClB,MAAoB,EACpB,KAA4B,EAC5B,cAAuB;IAEvB,OAAO;QACL,2BAA2B,CAAC,KAAK,EAAE,KAAK,EAAE,cAAc,CAAC;QACzD,8BAA8B,CAAC,KAAK,EAAE,KAAK,EAAE,cAAc,CAAC;QAC5D,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,cAAc,CAAC;QACvD,2BAA2B,CAAC,MAAM,EAAE,cAAc,CAAC;KACpD,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC"}

package/dist/services/audit/detectors/azure/user-security.detector.d.ts

@@ -0,0 +1,14 @@
+import { AzureUser } from '../../../../types/azure.types';
+import { Finding } from '../../../../types/finding.types';
+export declare function detectGlobalAdminNoMfa(users: AzureUser[], roles: Map<string, string[]>, includeDetails: boolean): Finding;
+export declare function detectPrivilegedUserNoMfa(users: AzureUser[], roles: Map<string, string[]>, includeDetails: boolean): Finding;
+export declare function detectRiskyUserHigh(users: AzureUser[], includeDetails: boolean): Finding;
+export declare function detectUserInactive(users: AzureUser[], includeDetails: boolean): Finding;
+export declare function detectPasswordNeverExpires(users: AzureUser[], includeDetails: boolean): Finding;
+export declare function detectRiskyUserMedium(users: AzureUser[], includeDetails: boolean): Finding;
+export declare function detectPasswordOld(users: AzureUser[], includeDetails: boolean): Finding;
+export declare function detectUserNeverSignedIn(users: AzureUser[], includeDetails: boolean): Finding;
+export declare function detectUserUnlicensed(users: AzureUser[], includeDetails: boolean): Finding;
+export declare function detectUserExternalMember(users: AzureUser[], includeDetails: boolean): Finding;
+export declare function detectUserSecurityVulnerabilities(users: AzureUser[], roles: Map<string, string[]>, includeDetails: boolean): Finding[];
+//# sourceMappingURL=user-security.detector.d.ts.map

package/dist/services/audit/detectors/azure/user-security.detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-security.detector.d.ts","sourceRoot":"","sources":["../../../../../src/services/audit/detectors/azure/user-security.detector.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,iCAAiC,CAAC;AAM1D,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,SAAS,EAAE,EAClB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAC5B,cAAc,EAAE,OAAO,GACtB,OAAO,CAoBT;AAKD,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,SAAS,EAAE,EAClB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAC5B,cAAc,EAAE,OAAO,GACtB,OAAO,CA0BT;AAKD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,cAAc,EAAE,OAAO,GAAG,OAAO,CAexF;AAKD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,cAAc,EAAE,OAAO,GAAG,OAAO,CAmBvF;AAKD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,cAAc,EAAE,OAAO,GAAG,OAAO,CAc/F;AAKD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,cAAc,EAAE,OAAO,GAAG,OAAO,CAe1F;AAKD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,cAAc,EAAE,OAAO,GAAG,OAAO,CAmBtF;AAKD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,cAAc,EAAE,OAAO,GAAG,OAAO,CAc5F;AAKD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,cAAc,EAAE,OAAO,GAAG,OAAO,CAezF;AAKD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,cAAc,EAAE,OAAO,GAAG,OAAO,CAgB7F;AAKD,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,SAAS,EAAE,EAClB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAC5B,cAAc,EAAE,OAAO,GACtB,OAAO,EAAE,CAaX"}