DevSecOps
/
Assessor_2.0
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Assessor_2.0/src/assessment-context/context-catalog.ts

3299 lines
319 KiB
TypeScript
Raw Blame History

/**
* Curated, versioned knowledge base of the context engine (Phase 13E, user decision 2026-09-30).
* Every entry is backed by a cited, offline-stored source. A setting that is not listed here stays
* `not semantically mapped` and is never guessed. Conditions are defined by explicit value sets;
* every other value is `unknown`. Nothing here is a compliance verdict or an effective host state.
*/
export const ASSESSMENT_CONTEXT_CATALOG = { id: 'assessment-context-catalog', version: '1.12.0' } as const;
export interface ContextSource {
title: string;
/** Public documentation link, stored as text; the application never loads it. */
url: string;
publisher: 'Microsoft' | 'MITRE' | 'CIS' | 'CISA' | 'Maester' | 'Netwrix' | 'Semperis';
}
export interface ContextText {
de: string;
en: string;
}
/** Exact technical target of a GPO setting as resolved by ASSESSOR's identity resolver. */
export type ContextSettingTarget =
| { mechanism: 'security-template'; scope: 'computer' | 'user'; section: string; key: string }
| { mechanism: 'registry-policy'; scope: 'computer' | 'user'; key: string; valueName: string };
export interface ContextCondition {
id: string;
label: ContextText;
/** Declared integer values that fulfil the condition. */
satisfiedValues: number[];
/** Declared integer values that prove the condition is not fulfilled. */
notSatisfiedValues: number[];
}
export interface ContextSemanticDefinition {
id: string;
label: ContextText;
/** Established English setting name as shown in Group Policy. */
settingName: string;
targets: ContextSettingTarget[];
valueMeaning: Record<string, string>;
conditions: ContextCondition[];
sources: ContextSource[];
}
export interface ContextRelationship {
conditionId: string;
role: 'prerequisite' | 'mitigation';
techniqueIds: string[];
/** Always phrased as `favours`/`begünstigt`, never as a confirmed or exploitable attack. */
statement: ContextText;
sources: ContextSource[];
}
export interface ContextClusterRule {
id: string;
label: ContextText;
description: ContextText;
conditionIds: string[];
/** Number of satisfied conditions from which several declared settings favour the same path. */
minimumSatisfied: number;
sources: ContextSource[];
}
/**
* Exact scanner rule linked to a condition. Only `fail-means-met` is supported: the rule states the
* hardened target, so a failing result observes the condition and a passing one refutes it. Other
* outcomes (not run, not applicable, errors) stay unknown. Matching uses the exact tool ID and rule
* ID only; `requiredTitleFragment` is a guard against renumbered benchmarks, never a similarity search.
*/
export interface ContextScannerRule {
tool: 'pingcastle' | 'purple-knight' | 'cis-cat' | 'maester';
ruleId: string;
conditionId: string;
polarity: 'fail-means-met';
/** Native rule text as the scanner states it. */
ruleText: string;
requiredTitleFragment?: string;
/** Optional further reading. The official scan report itself is authoritative (user decision 2026-09-30). */
sources: ContextSource[];
}
/**
* CIS-CAT findings without an exact rule are assigned by the most specific benchmark section title of
* their own scan report (user decision 2026-09-30: every deviation enters the context structure).
*/
export interface ContextSectionRule {
tool: 'cis-cat';
/** Section title exactly as the report's section-score table lists it (letter case and spacing aside). */
sectionTitle: string;
conditionId: string;
}
/**
* A GPO setting whose authoritative baseline verdict ASSESSOR already rolled up (user decision 2026-09-30):
* a deviation meets the condition, a pass refutes it. Registry keys match the key and its subkeys; the most
* specific key wins. The engine never re-derives the verdict.
*/
export type ContextGpoVerdictTarget =
| { mechanism: 'security-template'; scope: 'computer' | 'user'; section: string; key: string }
| { mechanism: 'registry-key'; scope: 'computer' | 'user'; key: string; valueName?: string }
| { mechanism: 'advanced-audit-policy'; scope: 'computer' | 'user' };
export interface ContextGpoVerdictRule {
target: ContextGpoVerdictTarget;
conditionId: string;
}
/** A condition that only scanners observe; it has no GPO setting behind it. */
export interface ContextStandaloneCondition {
id: string;
label: ContextText;
}
export interface AssessmentContextCatalog {
catalog: typeof ASSESSMENT_CONTEXT_CATALOG;
semantics: ContextSemanticDefinition[];
standaloneConditions: ContextStandaloneCondition[];
relationships: ContextRelationship[];
clusters: ContextClusterRule[];
scannerRules: ContextScannerRule[];
cisSectionRules: ContextSectionRule[];
gpoVerdictRules: ContextGpoVerdictRule[];
/** Condition for each source's deviations that no rule or section assigns yet; they stay visible. */
uncataloguedDeviationConditions: Record<ContextScannerRule['tool'] | 'gpo', string>;
/**
* One finding, one cluster (user decision 2026-10-04): a condition several clusters list counts only for the
* cluster whose attack mechanism it names most specifically. Every shared condition must declare it here.
*/
primaryClusters?: Record<string, string>;
}
const SECURITY_POLICY_DOCS = 'https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/';
const T1557_001: ContextSource = {
title: 'MITRE ATT&CK T1557.001 Name Resolution Poisoning and SMB Relay',
url: 'https://attack.mitre.org/techniques/T1557/001/',
publisher: 'MITRE'
};
const PINGCASTLE_RULES: ContextSource = { title: 'PingCastle Health Check rules', url: 'https://www.pingcastle.com/PingCastleFiles/ad_hc_rules_list.html', publisher: 'Netwrix' };
const PURPLE_KNIGHT: ContextSource = { title: 'Purple Knight security indicators', url: 'https://www.semperis.com/purple-knight/', publisher: 'Semperis' };
const CIS_WINDOWS_SERVER: ContextSource = { title: 'CIS Microsoft Windows Server Benchmark', url: 'https://www.cisecurity.org/benchmark/microsoft_windows_server', publisher: 'CIS' };
const EMAIL_AUTHENTICATION: ContextSource = { title: 'Email authentication in Microsoft 365 (SPF, DKIM, DMARC)', url: 'https://learn.microsoft.com/en-us/defender-office-365/email-authentication-about', publisher: 'Microsoft' };
const SCUBA_EXO: ContextSource = { title: 'CISA ScubaGear Exchange Online secure configuration baseline', url: 'https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md', publisher: 'CISA' };
const SCUBA_DEFENDER: ContextSource = { title: 'CISA ScubaGear Microsoft Defender secure configuration baseline', url: 'https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/defender.md', publisher: 'CISA' };
const SCUBA_AAD: ContextSource = { title: 'CISA ScubaGear Microsoft Entra ID secure configuration baseline', url: 'https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md', publisher: 'CISA' };
const CIS_M365: ContextSource = { title: 'CIS Microsoft 365 Foundations Benchmark', url: 'https://www.cisecurity.org/benchmark/microsoft_365', publisher: 'CIS' };
const maesterTest = (id: string): ContextSource => ({ title: `Maester test ${id}`, url: `https://maester.dev/docs/tests/${id}`, publisher: 'Maester' });
const PROTECTED_USERS: ContextSource = { title: 'Protected Users Security Group in Windows Server', url: 'https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/protected-users-security-group', publisher: 'Microsoft' };
const T1078_004: ContextSource = { title: 'MITRE ATT&CK T1078.004 Valid Accounts: Cloud Accounts', url: 'https://attack.mitre.org/techniques/T1078/004/', publisher: 'MITRE' };
const T1110_003: ContextSource = { title: 'MITRE ATT&CK T1110.003 Brute Force: Password Spraying', url: 'https://attack.mitre.org/techniques/T1110/003/', publisher: 'MITRE' };
const T1078_002: ContextSource = { title: 'MITRE ATT&CK T1078.002 Valid Accounts: Domain Accounts', url: 'https://attack.mitre.org/techniques/T1078/002/', publisher: 'MITRE' };
const T1558_003: ContextSource = { title: 'MITRE ATT&CK T1558.003 Kerberoasting', url: 'https://attack.mitre.org/techniques/T1558/003/', publisher: 'MITRE' };
const KCD_OVERVIEW: ContextSource = { title: 'Kerberos Constrained Delegation Overview in Windows Server', url: 'https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-constrained-delegation-overview', publisher: 'Microsoft' };
const T1187: ContextSource = { title: 'MITRE ATT&CK T1187 Forced Authentication', url: 'https://attack.mitre.org/techniques/T1187/', publisher: 'MITRE' };
const T1649: ContextSource = { title: 'MITRE ATT&CK T1649 Steal or Forge Authentication Certificates', url: 'https://attack.mitre.org/techniques/T1649/', publisher: 'MITRE' };
const mitre = (id: string, name: string): ContextSource =>
({ title: `MITRE ATT&CK ${id} ${name}`, url: `https://attack.mitre.org/techniques/${id.replace('.', '/')}/`, publisher: 'MITRE' });
const T1021 = mitre('T1021', 'Remote Services');
const T1021_001 = mitre('T1021.001', 'Remote Services: Remote Desktop Protocol');
const T1021_002 = mitre('T1021.002', 'Remote Services: SMB/Windows Admin Shares');
const T1021_006 = mitre('T1021.006', 'Remote Services: Windows Remote Management');
const T1555_004 = mitre('T1555.004', 'Credentials from Password Stores: Windows Credential Manager');
const T1547_005 = mitre('T1547.005', 'Boot or Logon Autostart Execution: Security Support Provider');
const T1548_002 = mitre('T1548.002', 'Abuse Elevation Control Mechanism: Bypass User Account Control');
const T1110_001 = mitre('T1110.001', 'Brute Force: Password Guessing');
const T1110_002 = mitre('T1110.002', 'Brute Force: Password Cracking');
const EIDSCA_PASSWORD_RULES: ContextSource = { title: 'Maester EIDSCA password rule settings', url: 'https://maester.dev/docs/tests/eidsca/', publisher: 'Maester' };
const accountPolicy = (key: string): ContextSettingTarget =>
({ mechanism: 'security-template', scope: 'computer', section: 'System Access', key });
/** Inclusive integer range for the explicit value sets of account policy settings. */
const range = (from: number, to: number) => Array.from({ length: to - from + 1 }, (_value, index) => index + from);
const T1557 = mitre('T1557', 'Adversary-in-the-Middle');
const T1087_002 = mitre('T1087.002', 'Account Discovery: Domain Account');
const T1204_002 = mitre('T1204.002', 'User Execution: Malicious file');
const T1059 = mitre('T1059', 'Command and Scripting Interpreter');
const T1091 = mitre('T1091', 'Replication Through Removable Media');
const T1550_002 = mitre('T1550.002', 'Use Alternate Authentication Material: Pass the Hash');
const T1563_002 = mitre('T1563.002', 'Remote Service Session Hijacking: RDP Hijacking');
const T1098 = mitre('T1098', 'Account Manipulation');
const T1098_001 = mitre('T1098.001', 'Account Manipulation: Additional Cloud Credentials');
const T1098_005 = mitre('T1098.005', 'Account Manipulation: Device Registration');
const T1528 = mitre('T1528', 'Steal Application Access Token');
const T1621 = mitre('T1621', 'Multi-Factor Authentication Request Generation');
const T1539 = mitre('T1539', 'Steal Web Session Cookie');
const T1490 = mitre('T1490', 'Inhibit System Recovery');
const T1485 = mitre('T1485', 'Data Destruction');
const T1566 = mitre('T1566', 'Phishing');
const T1068 = mitre('T1068', 'Exploitation for Privilege Escalation');
const T1003 = mitre('T1003', 'OS Credential Dumping');
const T1056_002 = mitre('T1056.002', 'Input Capture: GUI Input Capture');
const T1552_002 = mitre('T1552.002', 'Unsecured Credentials: Credentials in Registry');
const T1203 = mitre('T1203', 'Exploitation for Client Execution');
const T1210 = mitre('T1210', 'Exploitation of Remote Services');
const T1200 = mitre('T1200', 'Hardware Additions');
const KERBEROS_ARMORING: ContextSource = { title: 'What\'s New in Kerberos Authentication: Kerberos armoring (FAST)', url: 'https://learn.microsoft.com/en-us/windows-server/security/kerberos/whats-new-in-kerberos-authentication', publisher: 'Microsoft' };
const REMOTE_CREDENTIAL_GUARD: ContextSource = { title: 'Remote Credential Guard', url: 'https://learn.microsoft.com/en-us/windows/security/identity-protection/remote-credential-guard', publisher: 'Microsoft' };
const SCUBA_SHAREPOINT: ContextSource = { title: 'CISA ScubaGear SharePoint Online secure configuration baseline', url: 'https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/sharepoint.md', publisher: 'CISA' };
const EIDSCA_TESTS: ContextSource = { title: 'Maester EIDSCA tests', url: 'https://maester.dev/docs/tests/eidsca/', publisher: 'Maester' };
const securityOption = (key: string): ContextSettingTarget =>
({ mechanism: 'security-template', scope: 'computer', section: 'Registry Values', key });
export const RELEASED_ASSESSMENT_CONTEXT_CATALOG: AssessmentContextCatalog = {
catalog: ASSESSMENT_CONTEXT_CATALOG,
semantics: [
{
id: 'windows.ntlm.lm_compatibility_level',
label: { de: 'LAN Manager authentication level', en: 'LAN Manager authentication level' },
settingName: 'Network security: LAN Manager authentication level',
targets: [securityOption('MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\LmCompatibilityLevel')],
valueMeaning: {
0: 'Send LM & NTLM responses', 1: 'Send LM & NTLM - use NTLMv2 session security if negotiated',
2: 'Send NTLM response only', 3: 'Send NTLMv2 response only',
4: 'Send NTLMv2 response only. Refuse LM', 5: 'Send NTLMv2 response only. Refuse LM & NTLM'
},
conditions: [{
id: 'ntlm-legacy-responses-sent',
label: { de: 'LM- oder NTLMv1-Antworten werden gesendet', en: 'LM or NTLMv1 responses are sent' },
satisfiedValues: [0, 1, 2], notSatisfiedValues: [3, 4, 5]
}, {
id: 'lm-auth-level-below-refuse-lm-ntlm',
label: { de: "Die LAN-Manager-Authentifizierungsebene liegt unter 'Nur NTLMv2-Antworten senden. LM & NTLM verweigern'", en: "The LAN Manager authentication level is below 'Send NTLMv2 response only. Refuse LM & NTLM'" },
satisfiedValues: [0, 1, 2, 3, 4], notSatisfiedValues: [5]
}],
sources: [{ title: 'Network security: LAN Manager authentication level', url: `${SECURITY_POLICY_DOCS}network-security-lan-manager-authentication-level`, publisher: 'Microsoft' }]
},
{
id: 'windows.smb.server.signing_required',
label: { de: 'SMB server signing required', en: 'SMB server signing required' },
settingName: 'Microsoft network server: Digitally sign communications (always)',
targets: [securityOption('MACHINE\\System\\CurrentControlSet\\Services\\LanManServer\\Parameters\\RequireSecuritySignature')],
valueMeaning: { 0: 'Disabled', 1: 'Enabled' },
conditions: [{
id: 'smb-server-signing-not-required',
label: { de: 'SMB-Server verlangt keine Signierung', en: 'SMB server does not require signing' },
satisfiedValues: [0], notSatisfiedValues: [1]
}],
sources: [{ title: 'Microsoft network server: Digitally sign communications (always)', url: `${SECURITY_POLICY_DOCS}microsoft-network-server-digitally-sign-communications-always`, publisher: 'Microsoft' }]
},
{
id: 'windows.smb.client.signing_required',
label: { de: 'SMB client signing required', en: 'SMB client signing required' },
settingName: 'Microsoft network client: Digitally sign communications (always)',
targets: [securityOption('MACHINE\\System\\CurrentControlSet\\Services\\LanmanWorkstation\\Parameters\\RequireSecuritySignature')],
valueMeaning: { 0: 'Disabled', 1: 'Enabled' },
conditions: [{
id: 'smb-client-signing-not-required',
label: { de: 'SMB-Client verlangt keine Signierung', en: 'SMB client does not require signing' },
satisfiedValues: [0], notSatisfiedValues: [1]
}],
sources: [{ title: 'Microsoft network client: Digitally sign communications (always)', url: `${SECURITY_POLICY_DOCS}microsoft-network-client-digitally-sign-communications-always`, publisher: 'Microsoft' }]
},
{
id: 'windows.ldap.server.signing_requirement',
label: { de: 'LDAP server signing requirements', en: 'LDAP server signing requirements' },
settingName: 'Domain controller: LDAP server signing requirements',
targets: [securityOption('MACHINE\\System\\CurrentControlSet\\Services\\NTDS\\Parameters\\LDAPServerIntegrity')],
valueMeaning: { 1: 'None', 2: 'Require signature' },
conditions: [{
id: 'ldap-server-signing-not-required',
label: { de: 'Domain Controller verlangt keine LDAP-Signierung', en: 'Domain controller does not require LDAP signing' },
satisfiedValues: [1], notSatisfiedValues: [2]
}],
sources: [{ title: 'Domain controller: LDAP server signing requirements', url: `${SECURITY_POLICY_DOCS}domain-controller-ldap-server-signing-requirements`, publisher: 'Microsoft' }]
},
{
id: 'windows.ldap.client.signing_requirement',
label: { de: 'LDAP client signing requirements', en: 'LDAP client signing requirements' },
settingName: 'Network security: LDAP client signing requirements',
targets: [securityOption('MACHINE\\System\\CurrentControlSet\\Services\\LDAP\\LDAPClientIntegrity')],
valueMeaning: { 0: 'None', 1: 'Negotiate signing', 2: 'Require signing' },
conditions: [{
id: 'ldap-client-signing-none',
label: { de: 'LDAP-Client fordert keine Signierung an', en: 'LDAP client requests no signing' },
satisfiedValues: [0], notSatisfiedValues: [1, 2]
}],
sources: [{ title: 'Network security: LDAP client signing requirements', url: `${SECURITY_POLICY_DOCS}network-security-ldap-client-signing-requirements`, publisher: 'Microsoft' }]
},
{
id: 'windows.ldap.server.channel_binding',
label: { de: 'LDAP server channel binding token requirements', en: 'LDAP server channel binding token requirements' },
settingName: 'Domain controller: LDAP server channel binding token requirements',
targets: [securityOption('MACHINE\\System\\CurrentControlSet\\Services\\NTDS\\Parameters\\LdapEnforceChannelBinding')],
valueMeaning: { 0: 'Never', 1: 'When supported', 2: 'Always' },
conditions: [{
id: 'ldap-channel-binding-not-always',
label: { de: 'LDAP Channel Binding wird nicht immer erzwungen', en: 'LDAP channel binding is not always enforced' },
satisfiedValues: [0, 1], notSatisfiedValues: [2]
}],
sources: [{ title: '2020, 2023, and 2024 LDAP channel binding and LDAP signing requirements for Windows (KB4520412)', url: 'https://support.microsoft.com/help/4520412', publisher: 'Microsoft' }]
},
{
id: 'windows.dns_client.llmnr',
label: { de: 'Link-local multicast name resolution (LLMNR)', en: 'Link-local multicast name resolution (LLMNR)' },
settingName: 'Turn off multicast name resolution',
targets: [{ mechanism: 'registry-policy', scope: 'computer', key: 'Software\\Policies\\Microsoft\\Windows NT\\DNSClient', valueName: 'EnableMulticast' }],
valueMeaning: { 0: 'LLMNR turned off', 1: 'LLMNR explicitly left on' },
conditions: [{
id: 'llmnr-not-turned-off',
label: { de: 'LLMNR ist nicht abgeschaltet', en: 'LLMNR is not turned off' },
satisfiedValues: [1], notSatisfiedValues: [0]
}],
sources: [{ title: 'ADMX_DnsClient Policy CSP: Turn_Off_Multicast', url: 'https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-admx-dnsclient', publisher: 'Microsoft' }]
},
{
id: 'windows.account_policy.minimum_password_length',
label: { de: 'Minimum password length', en: 'Minimum password length' },
settingName: 'Minimum password length',
targets: [accountPolicy('MinimumPasswordLength')],
valueMeaning: { 0: 'No minimum length' },
conditions: [{
id: 'password-length-below-14',
label: { de: 'Die Kennwortrichtlinie erlaubt Kennwörter unter 14 Zeichen', en: 'The password policy allows passwords shorter than 14 characters' },
satisfiedValues: range(0, 13), notSatisfiedValues: range(14, 128)
}, {
id: 'password-length-below-8',
label: { de: 'Die Kennwortrichtlinie erlaubt Kennwörter unter 8 Zeichen', en: 'The password policy allows passwords shorter than 8 characters' },
satisfiedValues: range(0, 7), notSatisfiedValues: range(8, 128)
}],
sources: [{ title: 'Minimum password length', url: `${SECURITY_POLICY_DOCS}minimum-password-length`, publisher: 'Microsoft' }]
},
{
id: 'windows.account_policy.password_complexity',
label: { de: 'Password must meet complexity requirements', en: 'Password must meet complexity requirements' },
settingName: 'Password must meet complexity requirements',
targets: [accountPolicy('PasswordComplexity')],
valueMeaning: { 0: 'Disabled', 1: 'Enabled' },
conditions: [{
id: 'password-complexity-off',
label: { de: 'Kennwörter müssen keine Komplexitätsanforderungen erfüllen', en: 'Passwords do not have to meet complexity requirements' },
satisfiedValues: [0], notSatisfiedValues: [1]
}],
sources: [{ title: 'Password must meet complexity requirements', url: `${SECURITY_POLICY_DOCS}password-must-meet-complexity-requirements`, publisher: 'Microsoft' }]
},
{
id: 'windows.account_policy.lockout_threshold',
label: { de: 'Account lockout threshold', en: 'Account lockout threshold' },
settingName: 'Account lockout threshold',
targets: [accountPolicy('LockoutBadCount')],
valueMeaning: { 0: 'Account never locks out' },
conditions: [{
id: 'account-lockout-threshold-weak',
label: { de: 'Die Kontosperrschwelle ist aus oder liegt über 5 Fehlversuchen', en: 'The account lockout threshold is off or above 5 failed attempts' },
satisfiedValues: [0, ...range(6, 999)], notSatisfiedValues: range(1, 5)
}],
sources: [{ title: 'Account lockout threshold', url: `${SECURITY_POLICY_DOCS}account-lockout-threshold`, publisher: 'Microsoft' }]
}
],
standaloneConditions: [
{ id: 'entra-permanent-privileged-assignments', label: { de: 'Hochprivilegierte Entra-Rollen haben permanente aktive Zuweisungen', en: 'Highly privileged Entra roles have permanent active assignments' } },
{ id: 'entra-external-user-privileged-role', label: { de: 'Ein externer Nutzer hat eine permanente Control-Plane-Rolle', en: 'An external user holds a permanent Control Plane role' } },
{ id: 'entra-client-secret-privileged-role', label: { de: 'Ein Service Principal mit Client Secret hat eine permanente Control-Plane-Rolle', en: 'A service principal with a client secret holds a permanent Control Plane role' } },
{ id: 'entra-admins-not-cloud-only', label: { de: 'Privilegierte Konten sind nicht cloud-only', en: 'Privileged accounts are not cloud-only' } },
{ id: 'entra-privileged-mfa-not-phishing-resistant', label: { de: 'Phishingresistente MFA ist für hochprivilegierte Rollen nicht verlangt', en: 'Phishing-resistant MFA is not required for highly privileged roles' } },
{ id: 'entra-admin-mfa-not-required', label: { de: 'MFA ist für administrative Rollen nicht verlangt', en: 'MFA is not required for administrative roles' } },
{ id: 'entra-legacy-auth-not-blocked', label: { de: 'Legacy-Authentifizierung ist nicht blockiert', en: 'Legacy authentication is not blocked' } },
{ id: 'entra-high-risk-signins-not-blocked', label: { de: 'Als hochriskant erkannte Anmeldungen werden nicht blockiert', en: 'Sign-ins detected as high risk are not blocked' } },
{ id: 'entra-signin-risk-not-covered', label: { de: 'Riskante Anmeldungen sind durch keine Conditional-Access-Richtlinie abgedeckt', en: 'Risky sign-ins are not covered by a Conditional Access policy' } },
{ id: 'entra-mfa-not-phishing-resistant', label: { de: 'Phishingresistente MFA ist nicht für alle Nutzer erzwungen', en: 'Phishing-resistant MFA is not enforced for all users' } },
{ id: 'entra-weak-mfa-methods-enabled', label: { de: 'SMS, Sprachanruf oder E-Mail-OTP sind als Methoden aktiv', en: 'SMS, voice call or email OTP methods are enabled' } },
{ id: 'ad-admins-delegatable', label: { de: 'Admin-Konten sind nicht als nicht delegierbar markiert', en: 'Admin accounts are not marked as sensitive and not delegatable' } },
{ id: 'ad-admins-not-protected-users', label: { de: 'Privilegierte Konten sind nicht in Protected Users', en: 'Privileged accounts are not in Protected Users' } },
{ id: 'ad-builtin-admin-used', label: { de: 'Das eingebaute Administrator-Konto wurde kürzlich verwendet', en: 'The built-in Administrator account was used recently' } },
{ id: 'ad-privileged-spn', label: { de: 'Privilegierte Konten haben einen SPN', en: 'Privileged accounts have an SPN' } },
{ id: 'ad-dc-spooler-coercion', label: { de: 'Der Print Spooler ist auf einem Domain Controller erreichbar', en: 'The print spooler is reachable on a domain controller' } },
{ id: 'adcs-web-enrollment-esc8', label: { de: 'Eine Zertifizierungsstelle bietet Web Enrollment an (ESC8)', en: 'A certificate authority offers web enrollment (ESC8)' } },
{ id: 'adcs-template-requester-san', label: { de: 'Zertifikatvorlagen erlauben dem Antragsteller einen eigenen Subject bzw. subjectAltName', en: 'Certificate templates let the requester supply the subject or subjectAltName' } },
{ id: 'adcs-template-insecure-config', label: { de: 'Zertifikatvorlagen haben mehrere unsichere Einstellungen', en: 'Certificate templates have several insecure configurations' } },
{ id: 'adcs-dangerous-control-paths', label: { de: 'Gefährliche Kontrollpfade erreichen Zertifikatvorlagen oder -container', en: 'Dangerous control paths reach certificate templates or containers' } },
{ id: 'ad-rbcd-write-on-dc', label: { de: 'Nicht privilegierte Principals können RBCD an einem DC setzen', en: 'Non-privileged principals can set RBCD on a domain controller' } },
{ id: 'ad-rbcd-write-on-krbtgt', label: { de: 'Principals können RBCD am krbtgt-Konto setzen', en: 'Principals can set RBCD on the krbtgt account' } },
{ id: 'ad-rbcd-on-dc-or-krbtgt', label: { de: 'RBCD ist an einem DC oder am krbtgt-Konto konfiguriert', en: 'RBCD is configured on a domain controller or the krbtgt account' } },
{ id: 'ad-delegation-to-dc-or-krbtgt', label: { de: 'Constrained Delegation zielt auf einen DC-Dienst oder krbtgt', en: 'Constrained delegation targets a domain controller service or krbtgt' } },
{ id: 'ad-unconstrained-delegation', label: { de: 'Konten mit SPN haben Unconstrained Delegation', en: 'Accounts with an SPN have unconstrained delegation' } },
{ id: 'ad-rbcd-computer-takeover', label: { de: 'Computerkonten können über RBCD übernommen werden', en: 'Computer accounts can be taken over through RBCD' } },
{ id: 'ad-spn-without-aes', label: { de: 'Konten mit SPN unterstützen kein AES', en: 'Accounts with an SPN do not support AES' } },
{ id: 'ad-rc4-des-on-dcs', label: { de: 'Domain Controller unterstützen RC4 oder DES', en: 'Domain controllers support RC4 or DES' } },
{ id: 'ad-privileged-password-never-expires', label: { de: 'Privilegierte Konten haben ein nie ablaufendes Passwort', en: 'Privileged accounts have a password that never expires' } },
{ id: 'ad-password-never-expires', label: { de: 'Konten haben das Flag Password Never Expires', en: 'Accounts have the Password Never Expires flag' } },
{ id: 'ad-smartcard-password-rotation-disabled', label: {
de: 'Kennwortrotation fuer Smartcard-only-Konten ist deaktiviert', en: 'Smart card-only account password rotation is disabled'
} },
{ id: 'ad-shadow-credentials-privileged', label: { de: 'Privilegierte Objekte tragen Shadow Credentials', en: 'Privileged objects carry shadow credentials' } },
{ id: 'mdns-not-disabled', label: { de: 'Multicast DNS (mDNS) ist nicht abgeschaltet', en: 'Multicast DNS (mDNS) is not turned off' } },
{ id: 'netbios-not-disabled', label: { de: 'NetBIOS-Namensauflösung ist nicht abgeschaltet', en: 'NetBIOS name resolution is not turned off' } },
{ id: 'wpad-not-disabled', label: { de: 'WPAD ist nicht abgeschaltet', en: 'WPAD is not turned off' } },
{ id: 'ad-users-can-add-computers', label: { de: 'Normale Nutzer können Computerkonten zur Domäne hinzufügen', en: 'Regular users can add computer accounts to the domain' } },
{ id: 'rdp-without-nla', label: { de: 'RDP verlangt keine Network Level Authentication', en: 'RDP does not require Network Level Authentication' } },
{ id: 'winrm-basic-auth', label: { de: 'WinRM erlaubt Basic-Authentifizierung', en: 'WinRM allows Basic authentication' } },
{ id: 'winrm-unencrypted', label: { de: 'WinRM erlaubt unverschlüsselten Verkehr', en: 'WinRM allows unencrypted traffic' } },
{ id: 'winrm-remote-management-allowed', label: { de: 'Remote-Verwaltung über WinRM ist erlaubt', en: 'Remote server management through WinRM is allowed' } },
{ id: 'smbv1-enabled', label: { de: 'SMBv1 ist aktiv', en: 'SMBv1 is enabled' } },
{ id: 'host-firewall-off', label: { de: 'Die Windows-Firewall ist für ein Profil aus', en: 'The Windows firewall is off for a profile' } },
{ id: 'host-firewall-inbound-allowed', label: { de: 'Die Windows-Firewall blockiert eingehende Verbindungen nicht standardmäßig', en: 'The Windows firewall does not block inbound connections by default' } },
{ id: 'network-logon-rights-broad', label: { de: 'Netzwerk-Anmelderechte sind breiter als empfohlen', en: 'Network logon rights are broader than recommended' } },
{ id: 'network-credentials-stored', label: { de: 'Anmeldedaten für die Netzwerkauthentifizierung dürfen gespeichert werden', en: 'Credentials for network authentication may be stored' } },
{ id: 'lsass-custom-ssp-allowed', label: { de: 'Eigene SSPs und APs dürfen in LSASS geladen werden', en: 'Custom SSPs and APs may be loaded into LSASS' } },
{ id: 'winrm-runas-credentials-stored', label: { de: 'WinRM darf RunAs-Anmeldedaten speichern', en: 'WinRM may store RunAs credentials' } },
{ id: 'uac-weak', label: { de: 'Die Benutzerkontensteuerung (UAC) ist schwächer als empfohlen', en: 'User Account Control is weaker than recommended' } },
{ id: 'powershell-logging-off', label: { de: 'PowerShell-Protokollierung ist nicht vollständig aktiv', en: 'PowerShell logging is not fully enabled' } },
{ id: 'dc-audit-incomplete', label: { de: 'Die Überwachungsrichtlinie auf Domain Controllern erfasst wichtige Ereignisse nicht', en: 'The domain controller audit policy does not collect key events' } },
{ id: 'account-lockout-duration-short', label: { de: 'Gesperrte Konten oder der Fehlversuchszähler werden nach weniger als 15 Minuten freigegeben', en: 'Locked accounts or the failed-attempt counter are released after less than 15 minutes' } },
{ id: 'ad-privileged-weak-password-policy', label: { de: 'Für privilegierte Nutzer gilt keine starke Kennwortrichtlinie', en: 'Privileged users are not covered by a strong password policy' } },
{ id: 'ad-service-accounts-no-strong-policy', label: { de: 'Für Dienstkonten gilt keine Kennwortrichtlinie mit langen Kennwörtern', en: 'Service accounts are not covered by a password policy with long passwords' } },
{ id: 'entra-password-protection-not-enforced', label: { de: 'Der Entra-Kennwortschutz blockiert schwache Kennwörter nicht vollständig', en: 'Entra password protection does not fully block weak passwords' } },
{ id: 'entra-smart-lockout-weak', label: { de: 'Die Entra Smart Lockout ist schwächer als empfohlen', en: 'Entra smart lockout is weaker than recommended' } },
{ id: 'hardened-unc-paths-weakened', label: { de: "Gehärtete UNC-Pfade für SYSVOL oder NETLOGON sind abgeschwächt", en: "Hardened UNC paths for SYSVOL or NETLOGON are weakened" } },
{ id: 'hardened-unc-paths-not-configured', label: { de: "Gehärtete UNC-Pfade verlangen nicht gegenseitige Authentifizierung, Integrität und Vertraulichkeit", en: "Hardened UNC paths do not require mutual authentication, integrity and privacy" } },
{ id: 'smb-insecure-guest-logons', label: { de: "Der SMB-Client erlaubt unsichere Gastanmeldungen", en: "The SMB client allows insecure guest logons" } },
{ id: 'dns-nonsecure-dynamic-updates', label: { de: "DNS-Zonen erlauben unsichere dynamische Updates", en: "DNS zones allow nonsecure dynamic updates" } },
{ id: 'kerberos-rc4-des-allowed', label: { de: "Kerberos erlaubt RC4- oder DES-Verschlüsselung", en: "Kerberos allows RC4 or DES encryption" } },
{ id: 'kerberos-armoring-off', label: { de: "Kerberos Armoring (FAST) ist nicht aktiviert", en: "Kerberos armoring (FAST) is not enabled" } },
{ id: 'host-audit-policy-incomplete', label: { de: "Die Überwachungsrichtlinie erfasst wichtige Anmelde-, Konto- und Verzeichnisereignisse nicht", en: "The audit policy does not collect key logon, account and directory events" } },
{ id: 'process-creation-not-logged', label: { de: "Prozessstarts oder ihre Befehlszeilen werden nicht aufgezeichnet", en: "Process creation or its command line is not recorded" } },
{ id: 'security-event-log-small', label: { de: "Das Sicherheitsprotokoll ist kleiner als empfohlen oder wird überschrieben", en: "The security event log is smaller than recommended or is overwritten" } },
{ id: 'ntlm-usage-not-audited', label: { de: "Die NTLM-Nutzung wird nicht überwacht", en: "NTLM usage is not audited" } },
{ id: 'ad-default-container-redirected', label: { de: "Der Standardort für neue Benutzer- oder Computerobjekte (wellKnownObjects) wurde geändert", en: "The default location for new user or computer objects (wellKnownObjects) was changed" } },
{ id: 'firewall-logging-off', label: { de: "Die Windows-Firewall protokolliert verworfene oder erfolgreiche Verbindungen nicht", en: "The Windows firewall does not log dropped or successful connections" } },
{ id: 'identity-threat-detection-missing', label: { de: "Defender for Identity ist auf Domain Controllern nicht bereitgestellt", en: "Defender for Identity is not deployed on domain controllers" } },
{ id: 'cloud-security-logs-not-forwarded', label: { de: "Entra-Sicherheitsprotokolle werden nicht an eine Überwachung weitergeleitet", en: "Entra security logs are not sent to a monitoring service" } },
{ id: 'entra-privileged-role-alerts-missing', label: { de: "Aktivierungen hochprivilegierter Entra-Rollen lösen keine Warnung aus", en: "Activations of highly privileged Entra roles do not raise an alert" } },
{ id: 'defender-asr-not-enforced', label: { de: "Defender-ASR-Regeln sind nicht vollständig im Block- oder Warnmodus", en: "Defender ASR rules are not fully in block or warn mode" } },
{ id: 'defender-protection-weakened', label: { de: "Echtzeit-, Verhaltens- oder Skriptschutz von Defender ist nicht vollständig aktiv", en: "Defender real-time, behaviour or script protection is not fully enabled" } },
{ id: 'web-protection-off', label: { de: "Netzwerkschutz oder SmartScreen blockieren gefährliche Inhalte nicht", en: "Network protection or SmartScreen does not block dangerous content" } },
{ id: 'mark-of-the-web-suppressed', label: { de: "Die Markierung Mark of the Web wird für unsicher kopierte Dateien unterdrückt", en: "Mark of the Web is suppressed for files copied from insecure sources" } },
{ id: 'autorun-enabled', label: { de: "AutoRun oder AutoPlay ist nicht vollständig abgeschaltet", en: "AutoRun or AutoPlay is not fully turned off" } },
{ id: 'script-files-run-on-double-click', label: { de: "Skriptdateien, die bei Phishing genutzt werden, starten per Doppelklick", en: "Script files used in phishing run on double-click" } },
{ id: 'script-engines-reach-internet', label: { de: "Skript-Engines können direkt ins Internet verbinden", en: "Script engines can connect directly to the internet" } },
{ id: 'laps-not-deployed', label: { de: "LAPS ist nicht installiert", en: "LAPS is not installed" } },
{ id: 'rdp-sessions-not-timed-out', label: { de: "Leerlaufende oder getrennte RDP-Sitzungen werden nicht rechtzeitig beendet", en: "Idle or disconnected RDP sessions are not ended in time" } },
{ id: 'terminal-services-gpo-incomplete', label: { de: "GPOs setzen die empfohlene Terminal-Services-Konfiguration nicht (Druckerumleitung, Sitzungszeitlimits)", en: "GPOs do not push the recommended Terminal Services configuration (printer redirection, session time limits)" } },
{ id: 'rdp-connection-security-weak', label: { de: "RDP-Verbindungen verlangen nicht SSL, sicheres RPC und hohe Verschlüsselung", en: "RDP connections do not require SSL, secure RPC and high encryption" } },
{ id: 'dangerous-user-rights-granted', label: { de: "Gefährliche Benutzerrechte sind über Administratoren hinaus vergeben", en: "Dangerous user rights are granted beyond administrators" } },
{ id: 'rdp-passwords-saved', label: { de: "RDP-Kennwörter dürfen gespeichert werden oder werden bei der Verbindung nicht abgefragt", en: "RDP passwords may be saved or are not requested on connection" } },
{ id: 'always-install-elevated', label: { de: "Windows Installer ist nicht daran gehindert, immer mit erhöhten Rechten zu installieren", en: "Windows Installer is not prevented from always installing with elevated privileges" } },
{ id: 'remote-credential-delegation-unprotected', label: { de: "Der Host nimmt keine RDP-Verbindungen ohne übertragbare Anmeldedaten an (Restricted Admin, Remote Credential Guard)", en: "The host does not accept RDP connections without exportable credentials (Restricted Admin, Remote Credential Guard)" } },
{ id: 'dnsadmins-unprivileged-members', label: { de: "Nicht privilegierte Konten sind Mitglied von DnsAdmins", en: "Unprivileged principals are members of DnsAdmins" } },
{ id: 'schema-admins-not-empty', label: { de: "Die Gruppe Schema Admins ist nicht leer", en: "The Schema Admins group is not empty" } },
{ id: 'adminsdholder-permissions-changed', label: { de: "Die Berechtigungen des AdminSDHolder-Objekts wurden geändert", en: "The permissions of the AdminSDHolder object were changed" } },
{ id: 'ad-stale-admincount', label: { de: "Konten ohne Adminrechte tragen weiterhin adminCount=1", en: "Accounts without admin rights still carry adminCount=1" } },
{ id: 'anonymous-ldap-bind', label: { de: "Anonyme Bindungen an das rootDSE sind erlaubt", en: "Anonymous binding to the rootDSE is allowed" } },
{ id: 'anonymous-directory-access', label: { de: "Anonymer Zugriff auf Active Directory ist aktiviert", en: "Anonymous access to Active Directory is enabled" } },
{ id: 'anonymous-nspi-access', label: { de: "Anonymer NSPI-Zugriff auf Active Directory ist aktiviert", en: "Anonymous NSPI access to Active Directory is enabled" } },
{ id: 'prewin2000-access-broad', label: { de: "Die Gruppe Pre-Windows 2000 Compatible Access enthält breite Mitglieder", en: "The Pre-Windows 2000 Compatible Access group has broad members" } },
{ id: 'prewin2000-membership-changed', label: { de: "Die Mitgliedschaft in Pre-Windows 2000 Compatible Access wurde geändert", en: "The Pre-Windows 2000 Compatible Access membership was changed" } },
{ id: 'net-session-enumeration-open', label: { de: "Die Abfrage von Netzwerksitzungen (NetCease) ist nicht eingeschränkt", en: "Network session enumeration (NetCease) is not restricted" } },
{ id: 'anonymous-named-pipes', label: { de: "Named Pipes sind anonym über das Empfohlene hinaus erreichbar", en: "Named pipes are anonymously reachable beyond the recommendation" } },
{ id: 'guest-account-enabled', label: { de: "Das integrierte Gastkonto ist aktiviert", en: "The built-in guest account is enabled" } },
{ id: 'ad-backup-outdated', label: { de: "Die letzte AD-Sicherung ist älter als empfohlen", en: "The last AD backup is older than recommended" } },
{ id: 'ad-recycle-bin-disabled', label: { de: "Der AD-Papierkorb ist nicht aktiviert", en: "The AD Recycle Bin is not enabled" } },
{ id: 'ou-deletion-unprotected', label: { de: "OUs sind nicht gegen versehentliches Löschen geschützt", en: "OUs are not protected against accidental deletion" } },
{ id: 'dc-redundancy-missing', label: { de: "Es gibt zu wenige Domain Controller für Redundanz", en: "There are too few domain controllers for redundancy" } },
{ id: 'entra-user-risk-not-covered', label: { de: "Keine Richtlinie schützt alle Nutzer bei erhöhtem Benutzerrisiko", en: "No policy protects all users at elevated user risk" } },
{ id: 'entra-mfa-registration-incomplete', label: { de: "Nicht alle Nutzer können eine Mehrfaktor-Anmeldung abschließen", en: "Not all users can complete multifactor authentication" } },
{ id: 'entra-managed-device-not-required', label: { de: "Die Anmeldung verlangt kein verwaltetes Gerät", en: "Authentication does not require a managed device" } },
{ id: 'entra-mfa-registration-unrestricted', label: { de: "Die MFA-Registrierung ist nicht auf verwaltete Geräte oder vertrauenswürdige Orte beschränkt", en: "MFA registration is not restricted to managed devices or trusted locations" } },
{ id: 'entra-mfa-fatigue-protection-weak', label: { de: "Microsoft Authenticator zeigt keinen Anmeldekontext oder verdächtige Anfragen können nicht gemeldet werden", en: "Microsoft Authenticator shows no sign-in context or suspicious requests cannot be reported" } },
{ id: 'entra-unmanaged-sessions-persistent', label: { de: "Sitzungen auf nicht verwalteten Geräten bleiben dauerhaft bestehen", en: "Sessions on unmanaged devices persist" } },
{ id: 'entra-global-admin-overused', label: { de: "Privilegierte Nutzer arbeiten mit Global Administrator statt feinerer Rollen", en: "Privileged users use Global Administrator instead of finer-grained roles" } },
{ id: 'entra-privileged-user-mailbox', label: { de: "Ein Nutzer mit permanenter Control-Plane-Rolle hat ein Postfach", en: "A user with a permanent Control Plane role has a mailbox" } },
{ id: 'entra-admin-managed-device-not-required', label: { de: "Administratoren müssen sich nicht von konformen oder hybrid verbundenen Geräten anmelden", en: "Administrators are not required to sign in from compliant or hybrid joined devices" } },
{ id: 'azure-root-permanent-access', label: { de: "Eine Person hat permanenten Zugriff auf alle Azure-Abonnements am Root-Scope", en: "A person has permanent access to all Azure subscriptions at the root scope" } },
{ id: 'entra-users-can-consent-apps', label: { de: "Nicht nur Administratoren dürfen Anwendungen Zustimmung erteilen", en: "Not only administrators may consent to applications" } },
{ id: 'entra-users-consent-risky-apps', label: { de: "Nutzer dürfen nicht verifizierten oder riskanten Anwendungen zustimmen", en: "Users may consent to unverified or risky applications" } },
{ id: 'entra-app-credentials-stale', label: { de: "Ungenutzte Anwendungen oder Anmeldedaten von Anwendungen bestehen weiter", en: "Unused applications or application credentials remain" } },
{ id: 'entra-guest-invites-unrestricted', label: { de: "Nicht nur Guest Inviter dürfen Gäste einladen", en: "Not only Guest Inviters may invite guests" } },
{ id: 'entra-guest-invite-domains-unrestricted', label: { de: "Gasteinladungen sind nicht auf freigegebene Domänen beschränkt", en: "Guest invitations are not restricted to approved domains" } },
{ id: 'entra-self-service-signup-allowed', label: { de: "Nutzer können dem Tenant per E-Mail-Bestätigung selbst beitreten", en: "Users can join the tenant themselves through email validation" } },
{ id: 'entra-guest-directory-access-broad', label: { de: "Gäste haben mehr als eingeschränkten Zugriff auf Verzeichnisobjekte", en: "Guests have more than restricted access to directory objects" } },
{ id: 'sharepoint-external-sharing-broad', label: { de: "Externe Freigaben in SharePoint sind breiter als empfohlen", en: "External sharing in SharePoint is broader than recommended" } },
{ id: 'teams-auto-admit-broad', label: { de: "Nicht nur eingeladene Nutzer werden automatisch in Teams-Besprechungen eingelassen", en: "Not only invited users are admitted to Teams meetings automatically" } },
{ id: 'ldap-signing-enforcement-off', label: { de: "Die Durchsetzung der LDAP-Serversignierung ist auf Domain Controllern nicht aktiviert", en: "LDAP server signing enforcement is not enabled on domain controllers" } },
{ id: 'adidns-authenticated-create', label: { de: "Authentifizierte Nutzer dürfen DNS-Einträge anlegen", en: "Authenticated users can create DNS records" } },
{ id: 'dc-ldaps-legacy-tls', label: { de: "Ein Domain Controller nutzt TLS 1.0 oder 1.1", en: "A domain controller uses TLS 1.0 or 1.1" } },
{ id: 'weak-trusted-root-certificate', label: { de: "Ein vertrauenswürdiges Zertifikat hat einen schwachen RSA-Schlüssel", en: "A trusted certificate has a weak RSA key" } },
{ id: 'autoadminlogon-not-disabled', label: { de: "Die automatische Anmeldung ist nicht ausdrücklich abgeschaltet", en: "Automatic logon is not explicitly disabled" } },
{ id: 'entra-global-admin-count-outside-range', label: { de: "Die Anzahl der Global Administrators liegt außerhalb der Empfehlung", en: "The number of Global Administrators is outside the recommendation" } },
{ id: 'entra-emergency-access-not-excluded', label: { de: "Nicht alle Conditional-Access-Richtlinien schließen ein Notfallkonto aus", en: "Not all Conditional Access policies exclude an emergency access account" } },
{ id: 'entra-eligible-roles-unused', label: { de: "Berechtigte Control-Plane-Rollenzuweisungen werden von Administratoren nicht genutzt", en: "Eligible Control Plane role assignments are not in use by administrators" } },
{ id: 'entra-privileged-unusual-signin', label: { de: "Für privilegierte Konten wurde ungewöhnliche Anmeldeaktivität festgestellt", en: "Unusual sign-in activity was detected for privileged accounts" } },
{ id: 'entra-privileged-accounts-inactive', label: { de: "Es gibt inaktive privilegierte Konten", en: "Inactive privileged accounts exist" } },
{ id: 'azure-management-group-creation-open', label: { de: "Neue Management Groups lassen sich ohne Schreibrechte anlegen", en: "New management groups can be created without write permissions" } },
{ id: 'entra-ca-policy-integrity-gaps', label: { de: "Conditional-Access-Richtlinien haben Lücken in Geltungsbereich oder Verweisen", en: "Conditional Access policies have gaps in scope or references" } },
{ id: 'entra-ca-coverage-gaps', label: { de: "Conditional Access deckt Plattformen, Apps oder Risikosignale nicht vollständig ab", en: "Conditional Access does not fully cover platforms, apps or risk signals" } },
{ id: 'entra-fido2-restrictions-off', label: { de: "FIDO2-Sicherheitsschlüssel werden ohne Attestierung oder Schlüsselbeschränkung akzeptiert", en: "FIDO2 security keys are accepted without attestation or key restrictions" } },
{ id: 'entra-authenticator-otp-allowed', label: { de: "Einmalcodes aus Microsoft Authenticator sind erlaubt", en: "One-time codes from Microsoft Authenticator are allowed" } },
{ id: 'intune-device-compliance-gaps', label: { de: "Die Intune-Gerätekonformität ist unvollständig konfiguriert", en: "Intune device compliance is incompletely configured" } },
{ id: 'entra-leaked-credential-detection-limited', label: { de: "Password Hash Sync ist in der Hybridumgebung nicht aktiviert", en: "Password hash sync is not enabled in the hybrid environment" } },
{ id: 'entra-admin-consent-workflow-missing', label: { de: "Für Anwendungen ist kein Admin-Zustimmungsworkflow eingerichtet", en: "No admin consent workflow is configured for applications" } },
{ id: 'entra-app-credentials-expiring', label: { de: "Anmeldedaten von Anwendungen laufen bald ab", en: "Application credentials are about to expire" } },
{ id: 'm365-public-groups-unmanaged', label: { de: "Es gibt nicht verwaltete öffentliche Microsoft-365-Gruppen", en: "Unmanaged public Microsoft 365 groups exist" } },
// Email (catalogue 1.9.0, user decision 2026-10-01): sender authentication, threat protection and forwarding.
{ id: 'email-sender-authentication-incomplete', label: { de: 'SPF, DKIM oder DMARC sind nicht vollständig durchgesetzt', en: 'SPF, DKIM or DMARC are not fully enforced' } },
{ id: 'email-threat-protection-weak', label: { de: 'Anti-Phishing, Safe Links, Safe Attachments oder Malware- und Spamfilter sind schwächer als empfohlen', en: 'Anti-phishing, Safe Links, Safe Attachments or malware and spam filtering are weaker than recommended' } },
{ id: 'email-external-forwarding-allowed', label: { de: 'E-Mails können automatisch an externe Empfänger weitergeleitet werden', en: 'Mail can be forwarded automatically to external recipients' } },
{ id: 'domain-admins-password-never-expires', label: { de: "Mindestens zwei Domänen-Admins haben ein nie ablaufendes Kennwort", en: "At least two domain admins have a password that never expires" } },
{ id: 'gmsa-not-used', label: { de: "Group Managed Service Accounts werden nicht genutzt", en: "Group managed service accounts are not in use" } },
{ id: 'dsheuristics-ldap-mitigation-off', label: { de: "Die dsHeuristics-Abschwächung für CVE-2021-42291 ist nicht gesetzt", en: "The dsHeuristics mitigation for CVE-2021-42291 is not set" } },
{ id: 'dc-subnet-declaration-incomplete', label: { de: "Die Subnetzdeklaration für Domain Controller ist unvollständig", en: "The subnet declaration for domain controllers is incomplete" } },
{ id: 'cis-audit-policy-unmet', label: { de: "Empfehlungen des Benchmarks zur Überwachungsrichtlinie sind nicht erfüllt", en: "Benchmark audit policy recommendations are not met" } },
{ id: 'cis-event-log-unmet', label: { de: "Empfehlungen des Benchmarks zu Ereignisprotokollen sind nicht erfüllt", en: "Benchmark event log recommendations are not met" } },
{ id: 'cis-defender-unmet', label: { de: "Empfehlungen des Benchmarks zu Microsoft Defender sind nicht erfüllt", en: "Benchmark Microsoft Defender recommendations are not met" } },
{ id: 'cis-software-installation-unmet', label: { de: "Empfehlungen des Benchmarks zur Softwareinstallation sind nicht erfüllt", en: "Benchmark software installation recommendations are not met" } },
{ id: 'cis-exploit-mitigations-unmet', label: { de: "Empfehlungen des Benchmarks zu Exploit-Schutzmaßnahmen sind nicht erfüllt", en: "Benchmark exploit mitigation recommendations are not met" } },
{ id: 'cis-remote-desktop-unmet', label: { de: "Empfehlungen des Benchmarks zu Remote Desktop und Remoteunterstützung sind nicht erfüllt", en: "Benchmark Remote Desktop and Remote Assistance recommendations are not met" } },
{ id: 'cis-remote-management-unmet', label: { de: "Empfehlungen des Benchmarks zu WinRM und Remote Shell sind nicht erfüllt", en: "Benchmark WinRM and Remote Shell recommendations are not met" } },
{ id: 'cis-firewall-profile-unmet', label: { de: "Empfehlungen des Benchmarks zu Firewall-Profilen sind nicht erfüllt", en: "Benchmark firewall profile recommendations are not met" } },
{ id: 'cis-network-stack-unmet', label: { de: "Empfehlungen des Benchmarks zum Netzwerkstapel sind nicht erfüllt", en: "Benchmark network stack recommendations are not met" } },
{ id: 'cis-smb-hardening-unmet', label: { de: "Empfehlungen des Benchmarks zu SMB-Server und -Client sind nicht erfüllt", en: "Benchmark SMB server and client recommendations are not met" } },
{ id: 'cis-name-resolution-unmet', label: { de: "Empfehlungen des Benchmarks zur Namensauflösung und Proxy-Erkennung sind nicht erfüllt", en: "Benchmark name resolution and proxy discovery recommendations are not met" } },
{ id: 'cis-authentication-hardening-unmet', label: { de: "Empfehlungen des Benchmarks zur Netzwerkauthentifizierung sind nicht erfüllt", en: "Benchmark network authentication recommendations are not met" } },
{ id: 'cis-print-hardening-unmet', label: { de: "Empfehlungen des Benchmarks zu Druckern sind nicht erfüllt", en: "Benchmark printer recommendations are not met" } },
{ id: 'cis-user-rights-unmet', label: { de: "Empfehlungen des Benchmarks zur Zuweisung von Benutzerrechten sind nicht erfüllt", en: "Benchmark user rights assignment recommendations are not met" } },
{ id: 'cis-credential-handling-unmet', label: { de: "Empfehlungen des Benchmarks zur Weitergabe von Anmeldedaten sind nicht erfüllt", en: "Benchmark credential delegation recommendations are not met" } },
{ id: 'cis-domain-controller-options-unmet', label: { de: "Empfehlungen des Benchmarks für Domain Controller sind nicht erfüllt", en: "Benchmark domain controller recommendations are not met" } },
{ id: 'cis-builtin-accounts-unmet', label: { de: "Empfehlungen des Benchmarks zu integrierten Konten sind nicht erfüllt", en: "Benchmark built-in account recommendations are not met" } },
{ id: 'cis-account-database-unmet', label: { de: "Empfehlungen des Benchmarks zur Kontendatenbank sind nicht erfüllt", en: "Benchmark account database recommendations are not met" } },
{ id: 'cis-sign-in-screen-unmet', label: { de: "Empfehlungen des Benchmarks zu Anmeldebildschirm und Sperrbildschirm sind nicht erfüllt", en: "Benchmark sign-in and lock screen recommendations are not met" } },
{ id: 'cis-device-access-unmet', label: { de: "Empfehlungen des Benchmarks zu Geräten und physischem Zugriff sind nicht erfüllt", en: "Benchmark device and physical access recommendations are not met" } },
{ id: 'cis-telemetry-unmet', label: { de: "Empfehlungen des Benchmarks zu Telemetrie und Diagnose sind nicht erfüllt", en: "Benchmark telemetry and diagnostics recommendations are not met" } },
{ id: 'cis-cloud-sync-unmet', label: { de: "Empfehlungen des Benchmarks zu Cloud-Inhalten und Synchronisierung sind nicht erfüllt", en: "Benchmark cloud content and synchronisation recommendations are not met" } },
{ id: 'cis-internet-communication-unmet', label: { de: "Empfehlungen des Benchmarks zur Internetkommunikation sind nicht erfüllt", en: "Benchmark internet communication recommendations are not met" } },
{ id: 'cis-windows-update-unmet', label: { de: "Empfehlungen des Benchmarks zu Windows Update sind nicht erfüllt", en: "Benchmark Windows Update recommendations are not met" } },
{ id: 'cis-policy-processing-unmet', label: { de: "Empfehlungen des Benchmarks zur Gruppenrichtlinienverarbeitung sind nicht erfüllt", en: "Benchmark Group Policy processing recommendations are not met" } },
{ id: 'cis-time-sync-unmet', label: { de: "Empfehlungen des Benchmarks zur Zeitsynchronisierung sind nicht erfüllt", en: "Benchmark time synchronisation recommendations are not met" } },
{ id: 'uncatalogued-deviations-pingcastle', label: { de: "PingCastle meldet eine Abweichung, die noch keinem Angriffsweg zugeordnet ist", en: "PingCastle reports a deviation that is not yet assigned to an attack path" } },
{ id: 'uncatalogued-deviations-purple-knight', label: { de: "Purple Knight meldet eine Abweichung, die noch keinem Angriffsweg zugeordnet ist", en: "Purple Knight reports a deviation that is not yet assigned to an attack path" } },
{ id: 'uncatalogued-deviations-cis-cat', label: { de: "CIS-CAT meldet eine Abweichung, die noch keinem Angriffsweg zugeordnet ist", en: "CIS-CAT reports a deviation that is not yet assigned to an attack path" } },
{ id: 'uncatalogued-deviations-maester', label: { de: "Maester meldet eine Abweichung, die noch keinem Angriffsweg zugeordnet ist", en: "Maester reports a deviation that is not yet assigned to an attack path" } },
{ id: 'gpo-privileged-rights-deviate', label: { de: "Die GPO-Zuweisung privilegierter Benutzerrechte weicht von der Microsoft-Baseline ab", en: "The GPO assignment of privileged user rights deviates from the Microsoft baseline" } },
{ id: 'gpo-delegation-right-deviates', label: { de: "Die GPO-Zuweisung des Rechts, Delegierung zu vertrauen, weicht von der Microsoft-Baseline ab", en: "The GPO assignment of the right to enable delegation deviates from the Microsoft baseline" } },
{ id: 'gpo-network-logon-right-deviates', label: { de: "Die GPO-Zuweisung von Netzwerk- oder Remote-Anmelderechten weicht von der Microsoft-Baseline ab", en: "The GPO assignment of network or remote logon rights deviates from the Microsoft baseline" } },
{ id: 'gpo-local-logon-right-deviates', label: { de: "Die GPO-Zuweisung lokaler Anmelderechte weicht von der Microsoft-Baseline ab", en: "The GPO assignment of local logon rights deviates from the Microsoft baseline" } },
{ id: 'gpo-audit-policy-deviates', label: { de: "Die GPO-Überwachungsrichtlinie weicht von der Microsoft-Baseline ab", en: "The GPO audit policy deviates from the Microsoft baseline" } },
{ id: 'gpo-firewall-logging-deviates', label: { de: "Die GPO-Einstellungen zur Firewall-Protokollierung weichen von der Microsoft-Baseline ab", en: "The GPO firewall logging settings deviate from the Microsoft baseline" } },
{ id: 'gpo-firewall-profile-deviates', label: { de: "Die GPO-Einstellungen eines Firewall-Profils weichen von der Microsoft-Baseline ab", en: "The GPO settings of a firewall profile deviate from the Microsoft baseline" } },
{ id: 'gpo-dns-client-policy-deviates', label: { de: "Die GPO-Einstellungen des DNS-Clients weichen von der Microsoft-Baseline ab", en: "The GPO DNS client settings deviate from the Microsoft baseline" } },
{ id: 'gpo-application-control-deviates', label: { de: "Die GPO-Anwendungssteuerung (Softwareeinschränkung, AppLocker) weicht von der Microsoft-Baseline ab", en: "The GPO application control (software restriction, AppLocker) deviates from the Microsoft baseline" } },
{ id: 'gpo-lockout-timing-deviates', label: { de: "Sperrdauer oder Zurücksetzen des Fehlversuchszählers weichen in der GPO von der Microsoft-Baseline ab", en: "Lockout duration or failed-attempt counter reset deviate from the Microsoft baseline in the GPO" } },
{ id: 'gpo-password-lifetime-deviates', label: { de: "Kennwortalter oder Kennwortchronik weichen in der GPO von der Microsoft-Baseline ab", en: "Password age or password history deviate from the Microsoft baseline in the GPO" } },
{ id: 'gpo-reversible-password-storage-deviates', label: { de: "Die Speicherung von Kennwörtern mit umkehrbarer Verschlüsselung weicht in der GPO von der Microsoft-Baseline ab", en: "Storing passwords with reversible encryption deviates from the Microsoft baseline in the GPO" } },
{ id: 'gpo-logon-hours-enforcement-deviates', label: { de: "Das Abmelden nach Ablauf der Anmeldezeiten weicht in der GPO von der Microsoft-Baseline ab", en: "Forcing logoff when logon hours expire deviates from the Microsoft baseline in the GPO" } },
{ id: 'gpo-office-forms-auth-hosts-deviate', label: { de: "Die Office-Hosts für formularbasierte Anmeldung weichen von der Microsoft-Baseline ab", en: "The Office hosts allowed for forms-based sign-in deviate from the Microsoft baseline" } },
{ id: 'gpo-convenience-pin-sign-in-deviates', label: { de: "Die Anmeldung mit Komfort-PIN weicht in der GPO von der Microsoft-Baseline ab", en: "Convenience PIN sign-in deviates from the Microsoft baseline in the GPO" } },
{ id: 'ad-dcshadow-evidence', label: { de: "Es gibt Hinweise auf einen DCShadow-Angriff", en: "There is evidence of a DCShadow attack" } },
{ id: 'ad-primary-group-anomaly', label: { de: "Benutzer oder Computer haben eine abweichende oder nicht lesbare primäre Gruppe", en: "Users or computers have a non-default or unreadable primary group" } },
{ id: 'krbtgt-password-old', label: { de: "Das Kennwort des KRBTGT-Kontos ist alt", en: "The KRBTGT account password is old" } },
{ id: 'ad-sidhistory-abuse', label: { de: "SIDHistory enthält privilegierte SIDs oder wurde kürzlich geändert", en: "SIDHistory contains privileged SIDs or was changed recently" } },
{ id: 'ad-recent-sensitive-changes', label: { de: "Kürzliche Änderungen an privilegierten Gruppen, Standardrichtlinien, Schema oder SYSVOL wurden festgestellt", en: "Recent changes to privileged groups, default policies, schema or SYSVOL were recorded" } },
{ id: 'ad-dangerous-acl-delegation', label: { de: "Nicht standardmäßige Prinzipale haben gefährliche Rechte oder Besitz an sensiblen AD-Objekten", en: "Non-default principals hold dangerous rights on, or own, sensitive AD objects" } },
{ id: 'rodc-credential-caching-risky', label: { de: "Read-Only Domain Controller speichern Anmeldedaten privilegierter oder zu vieler Konten", en: "Read-only domain controllers cache credentials of privileged or too many accounts" } },
{ id: 'gpo-link-delegation-broad', label: { de: "Das Verknüpfen von GPOs auf Domäne, Domain-Controller-OU oder Standort ist delegiert", en: "Linking GPOs at the domain, domain controller OU or site level is delegated" } },
{ id: 'ad-privileged-membership-hygiene', label: { de: "Privilegierte Gruppen enthalten inaktive, deaktivierte, unerwartete oder zu viele Mitglieder", en: "Privileged groups contain inactive, disabled, unexpected or too many members" } },
{ id: 'ad-asrep-roastable', label: { de: "Benutzerkonten benötigen keine Kerberos-Vorauthentifizierung", en: "User accounts do not require Kerberos pre-authentication" } },
{ id: 'ad-user-spn', label: { de: "Benutzerkonten haben einen Service Principal Name", en: "User accounts have a service principal name defined" } },
{ id: 'ad-passwords-old', label: { de: "Kennwörter von Benutzer-, Admin-, Computer-, Vertrauens- oder Dienstkonten sind älter als empfohlen", en: "Passwords of user, admin, computer, trust or service accounts are older than recommended" } },
{ id: 'ad-password-not-required', label: { de: "Benutzerkonten benötigen kein Kennwort", en: "User accounts do not require a password" } },
{ id: 'ad-recoverable-passwords', label: { de: "Kennwörter werden umkehrbar oder schwach gespeichert (GPO, umkehrbare Verschlüsselung, userPassword, LM-Hash)", en: "Passwords are stored in a recoverable or weak form (GPO, reversible encryption, userPassword, LM hash)" } },
{ id: 'ad-obsolete-components', label: { de: "Veraltete Funktionsebenen, Betriebssysteme oder SYSVOL-Replikation (NTFRS) sind im Einsatz", en: "Obsolete functional levels, operating systems or SYSVOL replication (NTFRS) are in use" } },
{ id: 'ad-constrained-delegation-risky', label: { de: "Eingeschränkte Delegation, Protokollübergang oder Delegation an verwaiste SPNs ist konfiguriert", en: "Constrained delegation, protocol transition or delegation to ghost SPNs is configured" } },
{ id: 'dc-health-inconsistent', label: { de: "Domain Controller sind in inkonsistentem Zustand oder haben sich lange nicht authentifiziert", en: "Domain controllers are in an inconsistent state or have not authenticated for a long time" } },
{ id: 'ad-trust-configuration-weak', label: { de: "Vertrauensstellungen erlauben SIDHistory, haben keine Quarantäne, gefährliche Attribute oder alte Kennwörter", en: "Trusts allow SID history, lack quarantine, carry dangerous attributes or have old passwords" } },
{ id: 'ad-explicit-certificate-mapping', label: { de: "Konten haben explizite Zertifikatszuordnungen (altSecurityIdentities)", en: "Accounts have explicit certificate mappings (altSecurityIdentities)" } },
{ id: 'gpo-dangerous-execution-paths', label: { de: "GPOs verweisen auf beschreibbare Verknüpfungen oder gefährliche Anmeldeskriptpfade", en: "GPOs reference writable shortcuts or dangerous logon script paths" } },
{ id: 'weak-certificate-cipher', label: { de: "Ein Zertifikat verwendet ein schwaches Verschlüsselungsverfahren", en: "A certificate uses a weak cipher" } },
{ id: 'entra-app-creation-unrestricted', label: { de: "Das Registrieren oder Verwalten von Anwendungen ist nicht eingeschränkt", en: "Registering or managing applications is not restricted" } },
{ id: 'entra-pim-controls-weak', label: { de: "Privilegierte Entra-Rollen werden nicht nur über PIM mit Genehmigung vergeben oder aktiviert", en: "Privileged Entra roles are not only assigned or activated through PIM with approval" } },
{ id: 'entra-password-expiry-enabled', label: { de: "Kennwörter in Entra laufen ab", en: "Passwords in Entra expire" } },
{ id: 'cis-password-policy-unmet', label: { de: "Empfehlungen des Benchmarks zu Kennwort- und Kontosperrungsrichtlinie sind nicht erfüllt", en: "Benchmark password and account lockout policy recommendations are not met" } },
{ id: 'cis-anonymous-access-unmet', label: { de: "Empfehlungen des Benchmarks zum anonymen Netzwerkzugriff sind nicht erfüllt", en: "Benchmark anonymous network access recommendations are not met" } },
{ id: 'cis-local-privilege-hardening-unmet', label: { de: "Empfehlungen des Benchmarks zu Benutzerkontensteuerung und Systemobjekten sind nicht erfüllt", en: "Benchmark User Account Control and system object recommendations are not met" } },
{ id: 'gpo-powershell-logging-deviates', label: { de: "Die GPO-Einstellungen zur PowerShell-Protokollierung weichen von der Microsoft-Baseline ab", en: "The GPO PowerShell logging settings deviate from the Microsoft baseline" } },
{ id: 'gpo-event-logging-deviates', label: { de: "Die GPO-Einstellungen zu Ereignisprotokollen oder zur Befehlszeilenaufzeichnung weichen von der Microsoft-Baseline ab", en: "The GPO event log or command-line recording settings deviate from the Microsoft baseline" } },
{ id: 'gpo-remote-desktop-deviates', label: { de: "Die GPO-Einstellungen zu Remotedesktop und Remoteunterstützung weichen von der Microsoft-Baseline ab", en: "The GPO Remote Desktop and Remote Assistance settings deviate from the Microsoft baseline" } },
{ id: 'gpo-remote-management-deviates', label: { de: "Die GPO-Einstellungen zu WinRM weichen von der Microsoft-Baseline ab", en: "The GPO WinRM settings deviate from the Microsoft baseline" } },
{ id: 'gpo-smb-hardening-deviates', label: { de: "Die GPO-Einstellungen zur SMB-Härtung weichen von der Microsoft-Baseline ab", en: "The GPO SMB hardening settings deviate from the Microsoft baseline" } },
{ id: 'gpo-secure-channel-deviates', label: { de: "Die GPO-Einstellungen zum sicheren Kanal (Netlogon) weichen von der Microsoft-Baseline ab", en: "The GPO secure channel (Netlogon) settings deviate from the Microsoft baseline" } },
{ id: 'gpo-ntlm-hardening-deviates', label: { de: "Die GPO-Einstellungen zur NTLM-Sitzungssicherheit weichen von der Microsoft-Baseline ab", en: "The GPO NTLM session security settings deviate from the Microsoft baseline" } },
{ id: 'gpo-anonymous-access-deviates', label: { de: "Die GPO-Einstellungen zu anonymem Zugriff oder Gastzugang weichen von der Microsoft-Baseline ab", en: "The GPO anonymous or guest access settings deviate from the Microsoft baseline" } },
{ id: 'gpo-lm-hash-storage-deviates', label: { de: "Die GPO-Einstellung zur Speicherung von LM-Hashes weicht von der Microsoft-Baseline ab", en: "The GPO setting for storing LM hashes deviates from the Microsoft baseline" } },
{ id: 'gpo-kerberos-encryption-deviates', label: { de: "Die GPO-Einstellung zu Kerberos-Verschlüsselungstypen weicht von der Microsoft-Baseline ab", en: "The GPO Kerberos encryption types setting deviates from the Microsoft baseline" } },
{ id: 'gpo-local-privilege-hardening-deviates', label: { de: "Die GPO-Einstellungen zu Benutzerkontensteuerung, Systemobjekten oder erhöhter Installation weichen von der Microsoft-Baseline ab", en: "The GPO User Account Control, system object or elevated installation settings deviate from the Microsoft baseline" } },
{ id: 'gpo-credential-protection-deviates', label: { de: "Die GPO-Einstellungen zum Schutz von Anmeldedaten weichen von der Microsoft-Baseline ab", en: "The GPO credential protection settings deviate from the Microsoft baseline" } },
{ id: 'gpo-print-hardening-deviates', label: { de: "Die GPO-Einstellungen zur Druckerhärtung weichen von der Microsoft-Baseline ab", en: "The GPO printer hardening settings deviate from the Microsoft baseline" } },
{ id: 'gpo-malware-protection-deviates', label: { de: "Die GPO-Einstellungen zu Defender, SmartScreen, Browser oder AutoPlay weichen von der Microsoft-Baseline ab", en: "The GPO Defender, SmartScreen, browser or AutoPlay settings deviate from the Microsoft baseline" } },
{ id: 'gpo-office-hardening-deviates', label: { de: "Die GPO-Einstellungen zur Office-Härtung (Makros, DDE, OLE) weichen von der Microsoft-Baseline ab", en: "The GPO Office hardening settings (macros, DDE, OLE) deviate from the Microsoft baseline" } },
{ id: 'gpo-local-device-access-deviates', label: { de: "Die GPO-Einstellungen zu Anmeldebildschirm, Geräteinstallation, Laufwerksverschlüsselung oder DMA-Schutz weichen von der Microsoft-Baseline ab", en: "The GPO sign-in screen, device installation, drive encryption or DMA protection settings deviate from the Microsoft baseline" } },
{ id: 'ad-tombstone-reanimation-right', label: { de: "Objekte haben das erweiterte Recht Reanimate-Tombstones", en: "Objects hold the Reanimate-Tombstones extended right" } },
{ id: 'ad-sdprop-protection-inconsistent', label: { de: "Privilegierte Objekte oder Operator-Gruppen werden nicht einheitlich durch AdminSDHolder und SDProp geschützt", en: "Privileged objects or operator groups are not consistently protected by AdminSDHolder and SDProp" } },
{ id: 'dcom-perflog-groups-populated', label: { de: "Die Gruppen Distributed COM Users oder Performance Log Users haben Mitglieder", en: "The Distributed COM Users or Performance Log Users groups have members" } },
{ id: 'entra-ca-groups-unprotected', label: { de: "In Conditional Access genutzte Sicherheitsgruppen sind nicht durch RMAU geschützt", en: "Security groups used in Conditional Access are not protected by restricted management administrative units" } },
{ id: 'uncatalogued-deviations-gpo', label: { de: "Eine GPO-Einstellung weicht von der Microsoft-Baseline ab und ist noch keinem Angriffsweg zugeordnet", en: "A GPO setting deviates from the Microsoft baseline and is not yet assigned to an attack path" } }
],
relationships: [
{
conditionId: 'llmnr-not-turned-off', role: 'prerequisite', techniqueIds: ['T1557.001'],
statement: {
de: 'Nicht abgeschaltetes LLMNR begünstigt die Umleitung von Namensauflösungen und damit das Abgreifen von NTLM-Anmeldungen.',
en: 'LLMNR not being turned off favours name resolution poisoning and thereby the capture of NTLM authentications.'
},
sources: [T1557_001]
},
{
conditionId: 'ntlm-legacy-responses-sent', role: 'prerequisite', techniqueIds: ['T1557.001'],
statement: {
de: 'Gesendete LM- oder NTLMv1-Antworten begünstigen die Verwertung abgegriffener Anmeldungen.',
en: 'Sending LM or NTLMv1 responses favours the use of captured authentications.'
},
sources: [{ title: 'Network security: LAN Manager authentication level', url: `${SECURITY_POLICY_DOCS}network-security-lan-manager-authentication-level`, publisher: 'Microsoft' }, T1557_001]
},
{
conditionId: 'smb-server-signing-not-required', role: 'prerequisite', techniqueIds: ['T1557.001'],
statement: {
de: 'Nicht verlangte SMB-Server-Signierung begünstigt das Weiterleiten (Relay) von NTLM-Anmeldungen an diesen SMB-Server.',
en: 'SMB server signing not being required favours relaying NTLM authentications to that SMB server.'
},
sources: [{ title: 'Microsoft network server: Digitally sign communications (always)', url: `${SECURITY_POLICY_DOCS}microsoft-network-server-digitally-sign-communications-always`, publisher: 'Microsoft' }, T1557_001]
},
{
conditionId: 'smb-client-signing-not-required', role: 'prerequisite', techniqueIds: ['T1557.001'],
statement: {
de: 'Nicht verlangte SMB-Client-Signierung begünstigt Man-in-the-Middle-Eingriffe in SMB-Sitzungen.',
en: 'SMB client signing not being required favours man-in-the-middle tampering with SMB sessions.'
},
sources: [{ title: 'Microsoft network client: Digitally sign communications (always)', url: `${SECURITY_POLICY_DOCS}microsoft-network-client-digitally-sign-communications-always`, publisher: 'Microsoft' }]
},
{
conditionId: 'ldap-server-signing-not-required', role: 'prerequisite', techniqueIds: ['T1557.001'],
statement: {
de: 'Nicht verlangte LDAP-Signierung am Domain Controller begünstigt Man-in-the-Middle-Eingriffe und das Weiterleiten von Anmeldungen an LDAP.',
en: 'LDAP signing not being required on the domain controller favours man-in-the-middle tampering and relaying authentications to LDAP.'
},
sources: [{ title: 'Domain controller: LDAP server signing requirements', url: `${SECURITY_POLICY_DOCS}domain-controller-ldap-server-signing-requirements`, publisher: 'Microsoft' }, T1557_001]
},
{
conditionId: 'ldap-client-signing-none', role: 'prerequisite', techniqueIds: ['T1557.001'],
statement: {
de: 'Ein LDAP-Client ohne angeforderte Signierung begünstigt Man-in-the-Middle-Eingriffe in LDAP-Abfragen.',
en: 'An LDAP client requesting no signing favours man-in-the-middle tampering with LDAP queries.'
},
sources: [{ title: 'Network security: LDAP client signing requirements', url: `${SECURITY_POLICY_DOCS}network-security-ldap-client-signing-requirements`, publisher: 'Microsoft' }]
},
{
conditionId: 'ldap-channel-binding-not-always', role: 'prerequisite', techniqueIds: ['T1557.001'],
statement: {
de: 'Nicht immer erzwungenes LDAP Channel Binding begünstigt das Weiterleiten von Anmeldungen an LDAPS.',
en: 'LDAP channel binding not always being enforced favours relaying authentications to LDAPS.'
},
sources: [{ title: '2020, 2023, and 2024 LDAP channel binding and LDAP signing requirements for Windows (KB4520412)', url: 'https://support.microsoft.com/help/4520412', publisher: 'Microsoft' }]
},
{
conditionId: 'entra-permanent-privileged-assignments', role: 'prerequisite', techniqueIds: ['T1078.004'],
statement: { de: 'Permanente Zuweisungen hochprivilegierter Rollen begünstigen die dauerhafte Nutzung übernommener Admin-Konten.', en: 'Permanent assignments of highly privileged roles favour lasting use of taken-over admin accounts.' },
sources: [SCUBA_AAD, T1078_004]
},
{
conditionId: 'entra-external-user-privileged-role', role: 'prerequisite', techniqueIds: ['T1078.004'],
statement: { de: 'Eine Control-Plane-Rolle bei einem externen Konto begünstigt privilegierten Zugriff außerhalb der eigenen Identitätskontrolle.', en: 'A Control Plane role held by an external account favours privileged access outside your own identity control.' },
sources: [maesterTest('MT.1025'), T1078_004]
},
{
conditionId: 'entra-client-secret-privileged-role', role: 'prerequisite', techniqueIds: ['T1078.004'],
statement: { de: 'Ein Client Secret mit permanenter Control-Plane-Rolle begünstigt privilegierten Zugriff mit einem einzelnen gestohlenen Geheimnis.', en: 'A client secret with a permanent Control Plane role favours privileged access with a single stolen secret.' },
sources: [maesterTest('MT.1027'), T1078_004]
},
{
conditionId: 'entra-admins-not-cloud-only', role: 'prerequisite', techniqueIds: ['T1078.004'],
statement: { de: 'Nicht cloud-only privilegierte Konten begünstigen den Übergang einer On-Premises-Kompromittierung in die Cloud.', en: 'Privileged accounts that are not cloud-only favour an on-premises compromise reaching the cloud.' },
sources: [SCUBA_AAD, CIS_M365, T1078_004]
},
{
conditionId: 'entra-privileged-mfa-not-phishing-resistant', role: 'prerequisite', techniqueIds: ['T1078.004'],
statement: { de: 'Fehlende phishingresistente MFA für privilegierte Rollen begünstigt die Übernahme von Admin-Konten durch Phishing.', en: 'Missing phishing-resistant MFA for privileged roles favours taking over admin accounts through phishing.' },
sources: [SCUBA_AAD, T1078_004]
},
{
conditionId: 'entra-admin-mfa-not-required', role: 'prerequisite', techniqueIds: ['T1078.004'],
statement: { de: 'Nicht verlangte MFA für administrative Rollen begünstigt die Anmeldung mit einem gestohlenen Admin-Passwort.', en: 'MFA not being required for administrative roles favours signing in with a stolen admin password.' },
sources: [maesterTest('MT.1024'), T1078_004]
},
{
conditionId: 'entra-legacy-auth-not-blocked', role: 'prerequisite', techniqueIds: ['T1110.003', 'T1078.004'],
statement: { de: 'Nicht blockierte Legacy-Authentifizierung begünstigt Password Spraying ohne MFA.', en: 'Legacy authentication not being blocked favours password spraying without MFA.' },
sources: [SCUBA_AAD, T1110_003]
},
{
conditionId: 'entra-high-risk-signins-not-blocked', role: 'prerequisite', techniqueIds: ['T1078.004'],
statement: { de: 'Nicht blockierte Hochrisiko-Anmeldungen begünstigen, dass Anmeldungen mit gestohlenen Zugangsdaten gelingen.', en: 'High-risk sign-ins not being blocked favours sign-ins with stolen credentials succeeding.' },
sources: [SCUBA_AAD, T1078_004]
},
{
conditionId: 'entra-signin-risk-not-covered', role: 'prerequisite', techniqueIds: ['T1078.004'],
statement: { de: 'Riskante Anmeldungen ohne Conditional-Access-Richtlinie begünstigen, dass Anmeldungen mit gestohlenen Zugangsdaten gelingen.', en: 'Risky sign-ins without a Conditional Access policy favour sign-ins with stolen credentials succeeding.' },
sources: [maesterTest('MT.1012'), T1078_004]
},
{
conditionId: 'entra-mfa-not-phishing-resistant', role: 'prerequisite', techniqueIds: ['T1078.004'],
statement: { de: 'Nicht erzwungene phishingresistente MFA begünstigt die Übernahme von Konten durch Phishing.', en: 'Phishing-resistant MFA not being enforced favours taking over accounts through phishing.' },
sources: [SCUBA_AAD, T1078_004]
},
{
conditionId: 'entra-weak-mfa-methods-enabled', role: 'prerequisite', techniqueIds: ['T1078.004'],
statement: { de: 'Aktive SMS-, Sprach- oder E-Mail-OTP-Methoden begünstigen das Umgehen der MFA.', en: 'Enabled SMS, voice or email OTP methods favour bypassing MFA.' },
sources: [SCUBA_AAD, T1078_004]
},
{
conditionId: 'ad-admins-delegatable', role: 'prerequisite', techniqueIds: ['T1078.002'],
statement: { de: 'Delegierbare Admin-Konten begünstigen die Wiederverwendung von Admin-Anmeldungen über Kerberos-Delegation.', en: 'Delegatable admin accounts favour reuse of admin authentications through Kerberos delegation.' },
sources: [PROTECTED_USERS, T1078_002]
},
{
conditionId: 'ad-admins-not-protected-users', role: 'prerequisite', techniqueIds: ['T1078.002'],
statement: { de: 'Privilegierte Konten außerhalb von Protected Users begünstigen das Zwischenspeichern und Wiederverwenden ihrer Anmeldedaten.', en: 'Privileged accounts outside Protected Users favour caching and reuse of their credentials.' },
sources: [PROTECTED_USERS, T1078_002]
},
{
conditionId: 'ad-builtin-admin-used', role: 'prerequisite', techniqueIds: ['T1078.002'],
statement: { de: 'Die Nutzung des eingebauten Administrator-Kontos begünstigt, dass dessen Anmeldedaten auf Systemen anfallen.', en: 'Using the built-in Administrator account favours its credentials being exposed on systems.' },
sources: [T1078_002]
},
{
conditionId: 'ad-privileged-spn', role: 'prerequisite', techniqueIds: ['T1558.003'],
statement: { de: 'Ein SPN an einem privilegierten Konto begünstigt Kerberoasting gegen dieses Konto.', en: 'An SPN on a privileged account favours Kerberoasting against that account.' },
sources: [T1558_003]
},
{
conditionId: 'ad-dc-spooler-coercion', role: 'prerequisite', techniqueIds: ['T1187'],
statement: { de: 'Ein erreichbarer Print Spooler auf einem DC begünstigt, dass der DC zu einer Anmeldung gegenüber einem Angreifer gezwungen wird.', en: 'A reachable print spooler on a domain controller favours forcing the domain controller to authenticate to an attacker.' },
sources: [T1187]
},
{
conditionId: 'adcs-web-enrollment-esc8', role: 'prerequisite', techniqueIds: ['T1649'],
statement: { de: 'Web Enrollment an einer Zertifizierungsstelle begünstigt, dass weitergeleitete Anmeldungen in Zertifikate umgewandelt werden (ESC8).', en: 'Web enrollment on a certificate authority favours turning relayed authentications into certificates (ESC8).' },
sources: [T1649]
},
{
conditionId: 'adcs-template-requester-san', role: 'prerequisite', techniqueIds: ['T1649'],
statement: { de: 'Ein vom Antragsteller gewählter subjectAltName begünstigt Zertifikate im Namen anderer, auch privilegierter Konten.', en: 'A requester-supplied subjectAltName favours certificates in the name of other, including privileged, accounts.' },
sources: [T1649]
},
{
conditionId: 'adcs-template-insecure-config', role: 'prerequisite', techniqueIds: ['T1649'],
statement: { de: 'Mehrere unsichere Einstellungen an Zertifikatvorlagen begünstigen den Missbrauch zur Anmeldung als andere Konten.', en: 'Several insecure settings on certificate templates favour misuse for authenticating as other accounts.' },
sources: [T1649]
},
{
conditionId: 'adcs-dangerous-control-paths', role: 'prerequisite', techniqueIds: ['T1649'],
statement: { de: 'Gefährliche Kontrollpfade auf Zertifikatvorlagen oder -container begünstigen, dass Vorlagen missbräuchlich verändert werden.', en: 'Dangerous control paths to certificate templates or containers favour templates being altered for misuse.' },
sources: [T1649]
},
{
conditionId: 'ad-rbcd-write-on-dc', role: 'prerequisite', techniqueIds: [],
statement: { de: 'Schreibrechte auf RBCD an einem DC begünstigen, dass ein kontrollierter Dienst sich gegenüber dem DC als beliebiger Nutzer ausgibt.', en: 'Write access to RBCD on a domain controller favours a controlled service impersonating any user to the domain controller.' },
sources: [KCD_OVERVIEW, PURPLE_KNIGHT]
},
{
conditionId: 'ad-rbcd-write-on-krbtgt', role: 'prerequisite', techniqueIds: [],
statement: { de: 'Schreibrechte auf RBCD am krbtgt-Konto begünstigen die Ausstellung von Tickets im Namen beliebiger Nutzer.', en: 'Write access to RBCD on the krbtgt account favours tickets being issued on behalf of any user.' },
sources: [KCD_OVERVIEW, PURPLE_KNIGHT]
},
{
conditionId: 'ad-rbcd-on-dc-or-krbtgt', role: 'prerequisite', techniqueIds: [],
statement: { de: 'RBCD an einem DC oder am krbtgt-Konto begünstigt Identitätswechsel gegenüber zentralen Domänendiensten.', en: 'RBCD on a domain controller or the krbtgt account favours impersonation towards central domain services.' },
sources: [KCD_OVERVIEW, PURPLE_KNIGHT]
},
{
conditionId: 'ad-delegation-to-dc-or-krbtgt', role: 'prerequisite', techniqueIds: [],
statement: { de: 'Delegation zu einem DC-Dienst oder krbtgt begünstigt, dass ein übernommener Dienst im Namen von Nutzern auf den DC zugreift.', en: 'Delegation to a domain controller service or krbtgt favours a taken-over service accessing the domain controller on behalf of users.' },
sources: [KCD_OVERVIEW, PURPLE_KNIGHT]
},
{
conditionId: 'ad-unconstrained-delegation', role: 'prerequisite', techniqueIds: [],
statement: { de: 'Unconstrained Delegation begünstigt, dass auf dem delegierenden System Tickets anmeldender Nutzer abgegriffen werden.', en: 'Unconstrained delegation favours capturing tickets of authenticating users on the delegating system.' },
sources: [KCD_OVERVIEW, PURPLE_KNIGHT]
},
{
conditionId: 'ad-rbcd-computer-takeover', role: 'prerequisite', techniqueIds: [],
statement: { de: 'Übernehmbare RBCD-Konfigurationen begünstigen die Übernahme von Computerkonten.', en: 'RBCD configurations that can be taken over favour computer account takeover.' },
sources: [KCD_OVERVIEW, PURPLE_KNIGHT]
},
{
conditionId: 'ad-spn-without-aes', role: 'prerequisite', techniqueIds: ['T1558.003'],
statement: { de: 'SPN-Konten ohne AES begünstigen das Offline-Knacken ihrer Service-Tickets.', en: 'SPN accounts without AES favour cracking their service tickets offline.' },
sources: [T1558_003]
},
{
conditionId: 'ad-rc4-des-on-dcs', role: 'prerequisite', techniqueIds: ['T1558.003'],
statement: { de: 'RC4 oder DES auf Domain Controllern begünstigen leichter knackbare Kerberos-Tickets.', en: 'RC4 or DES on domain controllers favour Kerberos tickets that are easier to crack.' },
sources: [T1558_003]
},
{
conditionId: 'ad-privileged-password-never-expires', role: 'prerequisite', techniqueIds: ['T1558.003'],
statement: { de: 'Nie ablaufende Passwörter privilegierter Konten begünstigen, dass geknackte Passwörter dauerhaft gültig bleiben.', en: 'Never-expiring passwords on privileged accounts favour cracked passwords staying valid indefinitely.' },
sources: [T1558_003]
},
{
conditionId: 'ad-password-never-expires', role: 'prerequisite', techniqueIds: ['T1558.003'],
statement: { de: 'Nie ablaufende Passwörter begünstigen, dass geknackte Passwörter dauerhaft gültig bleiben.', en: 'Never-expiring passwords favour cracked passwords staying valid indefinitely.' },
sources: [T1558_003]
},
{
conditionId: 'ad-smartcard-password-rotation-disabled', role: 'prerequisite', techniqueIds: [],
statement: {
de: 'Deaktivierte Kennwortrotation für Smartcard-only-Konten begünstigt die dauerhafte Nutzung übernommener Zugangsdaten und seitliche Bewegung.',
en: 'Disabled password rotation for smart card-only accounts favours lasting use of compromised credentials and lateral movement.'
},
sources: [PURPLE_KNIGHT]
},
{
conditionId: 'ad-shadow-credentials-privileged', role: 'prerequisite', techniqueIds: [],
statement: { de: 'Shadow Credentials an privilegierten Objekten begünstigen die Anmeldung als dieses Objekt ohne sein Passwort.', en: 'Shadow credentials on privileged objects favour authenticating as that object without its password.' },
sources: [PURPLE_KNIGHT]
},
{
conditionId: 'mdns-not-disabled', role: 'prerequisite', techniqueIds: ['T1557.001'],
statement: { de: 'Nicht abgeschaltetes mDNS begünstigt die Umleitung von Namensauflösungen und damit das Abgreifen von Anmeldungen.', en: 'mDNS not being turned off favours name resolution poisoning and thereby the capture of authentications.' },
sources: [T1557_001]
},
{
conditionId: 'netbios-not-disabled', role: 'prerequisite', techniqueIds: ['T1557.001'],
statement: { de: 'Nicht abgeschaltete NetBIOS-Namensauflösung begünstigt die Umleitung von Namensauflösungen und damit das Abgreifen von Anmeldungen.', en: 'NetBIOS name resolution not being turned off favours name resolution poisoning and thereby the capture of authentications.' },
sources: [T1557_001]
},
{
conditionId: 'wpad-not-disabled', role: 'prerequisite', techniqueIds: [],
statement: { de: 'Nicht abgeschaltetes WPAD begünstigt, dass die Proxy-Erkennung umgeleitet und Anmeldungen abgegriffen werden.', en: 'WPAD not being turned off favours redirected proxy discovery and captured authentications.' },
sources: [CIS_WINDOWS_SERVER]
},
{
conditionId: 'ad-users-can-add-computers', role: 'prerequisite', techniqueIds: [],
statement: { de: 'Wenn normale Nutzer Computerkonten anlegen dürfen, begünstigt das den Missbrauch neuer Konten für RBCD-Angriffe.', en: 'Regular users being able to add computer accounts favours misusing new accounts for RBCD attacks.' },
sources: [KCD_OVERVIEW, PURPLE_KNIGHT]
},
{
conditionId: 'rdp-without-nla', role: 'prerequisite', techniqueIds: ['T1021.001'],
statement: { de: 'RDP ohne Network Level Authentication begünstigt Angriffe auf die Anmeldung, bevor eine Sitzung aufgebaut ist.', en: 'RDP without Network Level Authentication favours attacks on sign-in before a session is established.' },
sources: [T1021_001]
},
{
conditionId: 'winrm-basic-auth', role: 'prerequisite', techniqueIds: ['T1021.006'],
statement: { de: 'Basic-Authentifizierung bei WinRM begünstigt, dass Anmeldedaten im Klartext übertragen werden.', en: 'Basic authentication for WinRM favours credentials being sent in clear text.' },
sources: [T1021_006]
},
{
conditionId: 'winrm-unencrypted', role: 'prerequisite', techniqueIds: ['T1021.006'],
statement: { de: 'Unverschlüsselter WinRM-Verkehr begünstigt das Mitlesen von Remote-Verwaltungssitzungen.', en: 'Unencrypted WinRM traffic favours eavesdropping on remote management sessions.' },
sources: [T1021_006]
},
{
conditionId: 'winrm-remote-management-allowed', role: 'prerequisite', techniqueIds: ['T1021.006'],
statement: { de: 'Erlaubte Remote-Verwaltung über WinRM begünstigt Lateral Movement mit gültigen Anmeldedaten.', en: 'Allowed remote management through WinRM favours lateral movement with valid credentials.' },
sources: [T1021_006]
},
{
conditionId: 'smbv1-enabled', role: 'prerequisite', techniqueIds: ['T1021.002'],
statement: { de: 'Aktives SMBv1 begünstigt Angriffe über ein veraltetes Protokoll ohne moderne Schutzmechanismen.', en: 'Enabled SMBv1 favours attacks through an outdated protocol without modern protections.' },
sources: [T1021_002]
},
{
conditionId: 'host-firewall-off', role: 'prerequisite', techniqueIds: ['T1021'],
statement: { de: 'Eine ausgeschaltete Host-Firewall begünstigt, dass Remote-Dienste aus dem Netz erreichbar sind.', en: 'A host firewall that is off favours remote services being reachable from the network.' },
sources: [T1021]
},
{
conditionId: 'host-firewall-inbound-allowed', role: 'prerequisite', techniqueIds: ['T1021'],
statement: { de: 'Nicht standardmäßig blockierter Eingang begünstigt, dass Remote-Dienste aus dem Netz erreichbar sind.', en: 'Inbound connections not being blocked by default favours remote services being reachable from the network.' },
sources: [T1021]
},
{
conditionId: 'network-logon-rights-broad', role: 'prerequisite', techniqueIds: ['T1021'],
statement: { de: 'Zu breite Netzwerk-Anmelderechte begünstigen Anmeldungen über das Netz mit mehr Konten als nötig.', en: 'Network logon rights broader than recommended favour network sign-ins with more accounts than needed.' },
sources: [T1021]
},
{
conditionId: 'network-credentials-stored', role: 'prerequisite', techniqueIds: ['T1555.004'],
statement: { de: 'Gespeicherte Anmeldedaten für die Netzwerkauthentifizierung begünstigen, dass sie aus dem Credential Manager ausgelesen werden.', en: 'Stored credentials for network authentication favour reading them from the Credential Manager.' },
sources: [T1555_004]
},
{
conditionId: 'lsass-custom-ssp-allowed', role: 'prerequisite', techniqueIds: ['T1547.005'],
statement: { de: 'Erlaubte eigene SSPs in LSASS begünstigen, dass Anmeldedaten beim Anmelden abgegriffen werden.', en: 'Allowed custom SSPs in LSASS favour capturing credentials during sign-in.' },
sources: [T1547_005]
},
{
conditionId: 'winrm-runas-credentials-stored', role: 'prerequisite', techniqueIds: [],
statement: { de: 'Gespeicherte WinRM-RunAs-Anmeldedaten begünstigen, dass sie vom Host ausgelesen werden.', en: 'Stored WinRM RunAs credentials favour reading them from the host.' },
sources: [CIS_WINDOWS_SERVER]
},
{
conditionId: 'uac-weak', role: 'prerequisite', techniqueIds: ['T1548.002'],
statement: { de: 'Eine schwächere Benutzerkontensteuerung begünstigt das Umgehen der Rechteerhöhung.', en: 'Weaker User Account Control favours bypassing elevation.' },
sources: [T1548_002]
},
{
conditionId: 'powershell-logging-off', role: 'prerequisite', techniqueIds: [],
statement: { de: 'Unvollständige PowerShell-Protokollierung begünstigt, dass PowerShell-Aktivität nicht aufgezeichnet wird.', en: 'Incomplete PowerShell logging favours PowerShell activity going unrecorded.' },
sources: [CIS_WINDOWS_SERVER, PINGCASTLE_RULES]
},
{
conditionId: 'dc-audit-incomplete', role: 'prerequisite', techniqueIds: [],
statement: { de: 'Eine unvollständige Überwachung auf Domain Controllern begünstigt, dass wichtige Ereignisse nicht aufgezeichnet werden.', en: 'Incomplete auditing on domain controllers favours key events going unrecorded.' },
sources: [PINGCASTLE_RULES]
},
{
conditionId: 'password-length-below-14', role: 'prerequisite', techniqueIds: ['T1110.001', 'T1110.002'],
statement: { de: 'Kennwörter unter 14 Zeichen begünstigen, dass sie erraten oder geknackt werden.', en: 'Passwords shorter than 14 characters favour guessing or cracking them.' },
sources: [T1110_001, T1110_002]
},
{
conditionId: 'password-length-below-8', role: 'prerequisite', techniqueIds: ['T1110.001', 'T1110.002'],
statement: { de: 'Kennwörter unter 8 Zeichen begünstigen, dass sie erraten oder geknackt werden.', en: 'Passwords shorter than 8 characters favour guessing or cracking them.' },
sources: [T1110_001, T1110_002]
},
{
conditionId: 'password-complexity-off', role: 'prerequisite', techniqueIds: ['T1110.001', 'T1110.002'],
statement: { de: 'Fehlende Komplexitätsanforderungen begünstigen einfache Kennwörter, die erraten oder geknackt werden.', en: 'Missing complexity requirements favour simple passwords that are guessed or cracked.' },
sources: [T1110_001, T1110_002]
},
{
conditionId: 'account-lockout-threshold-weak', role: 'prerequisite', techniqueIds: ['T1110.001', 'T1110.003'],
statement: { de: 'Eine abgeschaltete oder hohe Sperrschwelle begünstigt das Erraten von Kennwörtern durch wiederholte Anmeldeversuche.', en: 'A lockout threshold that is off or high favours guessing passwords through repeated sign-in attempts.' },
sources: [T1110_001, T1110_003]
},
{
conditionId: 'account-lockout-duration-short', role: 'prerequisite', techniqueIds: ['T1110.001'],
statement: { de: 'Kurze Sperr- und Zurücksetzzeiten begünstigen, dass Rateversuche schnell fortgesetzt werden.', en: 'Short lockout and counter reset times favour resuming guessing attempts quickly.' },
sources: [T1110_001, CIS_WINDOWS_SERVER]
},
{
conditionId: 'ad-privileged-weak-password-policy', role: 'prerequisite', techniqueIds: ['T1110.001', 'T1110.002'],
statement: { de: 'Eine schwache Kennwortrichtlinie für privilegierte Nutzer begünstigt, dass ihre Kennwörter erraten oder geknackt werden.', en: 'A weak password policy for privileged users favours guessing or cracking their passwords.' },
sources: [PURPLE_KNIGHT, T1110_002]
},
{
conditionId: 'ad-service-accounts-no-strong-policy', role: 'prerequisite', techniqueIds: ['T1558.003', 'T1110.002'],
statement: { de: 'Ohne Richtlinie für lange Dienstkonto-Kennwörter begünstigen abgegriffene Diensttickets das Offline-Knacken dieser Kennwörter.', en: 'Without a policy for long service account passwords, captured service tickets favour cracking those passwords offline.' },
sources: [PINGCASTLE_RULES, T1558_003]
},
{
conditionId: 'entra-password-protection-not-enforced', role: 'prerequisite', techniqueIds: ['T1110.003'],
statement: { de: 'Ein nicht erzwungener Kennwortschutz begünstigt schwache Kennwörter, die bei Password Spraying erraten werden.', en: 'Password protection that is not enforced favours weak passwords that password spraying guesses.' },
sources: [EIDSCA_PASSWORD_RULES, T1110_003]
},
{
conditionId: 'entra-smart-lockout-weak', role: 'prerequisite', techniqueIds: ['T1110.003'],
statement: { de: 'Eine schwächere Smart Lockout begünstigt mehr Anmeldeversuche beim Password Spraying.', en: 'Weaker smart lockout favours more sign-in attempts during password spraying.' },
sources: [EIDSCA_PASSWORD_RULES, T1110_003]
},
{
conditionId: 'hardened-unc-paths-weakened', role: 'prerequisite', techniqueIds: ['T1557'],
statement: { de: "Abgeschwächte gehärtete UNC-Pfade begünstigen, dass SYSVOL- und NETLOGON-Verkehr abgefangen oder verändert wird.", en: "Weakened hardened UNC paths favour intercepting or tampering with SYSVOL and NETLOGON traffic." },
sources: [T1557, PINGCASTLE_RULES]
},
{
conditionId: 'hardened-unc-paths-not-configured', role: 'prerequisite', techniqueIds: ['T1557'],
statement: { de: "Nicht vollständig gehärtete UNC-Pfade begünstigen, dass SYSVOL- und NETLOGON-Verkehr abgefangen oder verändert wird.", en: "Incompletely hardened UNC paths favour intercepting or tampering with SYSVOL and NETLOGON traffic." },
sources: [T1557, CIS_WINDOWS_SERVER]
},
{
conditionId: 'smb-insecure-guest-logons', role: 'prerequisite', techniqueIds: ['T1557'],
statement: { de: "Unsichere SMB-Gastanmeldungen begünstigen Verbindungen zu fremden Freigaben ohne Authentifizierung.", en: "Insecure SMB guest logons favour connecting to foreign shares without authentication." },
sources: [T1557, CIS_WINDOWS_SERVER]
},
{
conditionId: 'dns-nonsecure-dynamic-updates', role: 'prerequisite', techniqueIds: ['T1557'],
statement: { de: "Unsichere dynamische DNS-Updates begünstigen gefälschte DNS-Einträge, über die Anmeldungen umgeleitet werden.", en: "Nonsecure dynamic DNS updates favour spoofed DNS records that redirect authentications." },
sources: [T1557, PURPLE_KNIGHT]
},
{
conditionId: 'kerberos-rc4-des-allowed', role: 'prerequisite', techniqueIds: ['T1558.003'],
statement: { de: "Erlaubtes RC4 oder DES begünstigt Diensttickets, die sich offline leichter knacken lassen.", en: "Allowed RC4 or DES favours service tickets that are easier to crack offline." },
sources: [T1558_003, CIS_WINDOWS_SERVER]
},
{
conditionId: 'kerberos-armoring-off', role: 'prerequisite', techniqueIds: ['T1110.002'],
statement: { de: "Fehlendes Kerberos Armoring begünstigt, dass Vorauthentifizierungsdaten für das Offline-Knacken von Kennwörtern abgegriffen werden.", en: "Missing Kerberos armoring favours capturing pre-authentication data for offline password cracking." },
sources: [KERBEROS_ARMORING, PINGCASTLE_RULES]
},
{
conditionId: 'host-audit-policy-incomplete', role: 'prerequisite', techniqueIds: [],
statement: { de: "Eine unvollständige Überwachungsrichtlinie begünstigt, dass Anmeldungen und Kontoänderungen nicht aufgezeichnet werden.", en: "An incomplete audit policy favours sign-ins and account changes going unrecorded." },
sources: [CIS_WINDOWS_SERVER]
},
{
conditionId: 'process-creation-not-logged', role: 'prerequisite', techniqueIds: [],
statement: { de: "Nicht aufgezeichnete Prozessstarts begünstigen, dass ausgeführte Befehle unbemerkt bleiben.", en: "Unrecorded process creation favours executed commands going unnoticed." },
sources: [CIS_WINDOWS_SERVER]
},
{
conditionId: 'security-event-log-small', role: 'prerequisite', techniqueIds: [],
statement: { de: "Ein kleines oder überschriebenes Sicherheitsprotokoll begünstigt, dass Ereignisse verloren gehen, bevor sie ausgewertet werden.", en: "A small or overwritten security log favours events being lost before they are analysed." },
sources: [CIS_WINDOWS_SERVER]
},
{
conditionId: 'ntlm-usage-not-audited', role: 'prerequisite', techniqueIds: [],
statement: { de: "Nicht überwachte NTLM-Nutzung begünstigt, dass Relay- und Pass-the-Hash-Aktivität unbemerkt bleibt.", en: "Unaudited NTLM usage favours relay and pass-the-hash activity going unnoticed." },
sources: [CIS_WINDOWS_SERVER]
},
{
conditionId: 'firewall-logging-off', role: 'prerequisite', techniqueIds: [],
statement: { de: "Fehlende Firewall-Protokolle begünstigen, dass Netzwerkverbindungen nicht nachvollzogen werden können.", en: "Missing firewall logs favour network connections that cannot be traced." },
sources: [CIS_WINDOWS_SERVER]
},
{
conditionId: 'identity-threat-detection-missing', role: 'prerequisite', techniqueIds: [],
statement: { de: "Fehlende Identity-Sensoren begünstigen, dass Angriffe auf Active Directory unerkannt bleiben.", en: "Missing identity sensors favour attacks on Active Directory going undetected." },
sources: [maesterTest('MT.1024')]
},
{
conditionId: 'cloud-security-logs-not-forwarded', role: 'prerequisite', techniqueIds: [],
statement: { de: "Nicht weitergeleitete Entra-Protokolle begünstigen, dass verdächtige Cloud-Anmeldungen unbemerkt bleiben.", en: "Entra logs that are not forwarded favour suspicious cloud sign-ins going unnoticed." },
sources: [SCUBA_AAD]
},
{
conditionId: 'entra-privileged-role-alerts-missing', role: 'prerequisite', techniqueIds: [],
statement: { de: "Fehlende Warnungen bei privilegierten Rollen begünstigen, dass Missbrauch privilegierter Konten unbemerkt bleibt.", en: "Missing privileged role alerts favour misuse of privileged accounts going unnoticed." },
sources: [SCUBA_AAD]
},
{
conditionId: 'defender-asr-not-enforced', role: 'prerequisite', techniqueIds: ['T1204.002'],
statement: { de: "Nicht erzwungene ASR-Regeln begünstigen, dass schädliche Dateien und Makros ausgeführt werden.", en: "ASR rules that are not enforced favour malicious files and macros being executed." },
sources: [T1204_002, PINGCASTLE_RULES, CIS_WINDOWS_SERVER]
},
{
conditionId: 'defender-protection-weakened', role: 'prerequisite', techniqueIds: ['T1204.002', 'T1059'],
statement: { de: "Ein abgeschwächter Defender-Schutz begünstigt, dass Schadcode und Skripte unerkannt laufen.", en: "Weakened Defender protection favours malicious code and scripts running undetected." },
sources: [T1204_002, T1059, CIS_WINDOWS_SERVER]
},
{
conditionId: 'web-protection-off', role: 'prerequisite', techniqueIds: ['T1204.002'],
statement: { de: "Fehlender Web-Schutz begünstigt, dass schädliche Downloads und Websites erreicht werden.", en: "Missing web protection favours reaching malicious downloads and websites." },
sources: [T1204_002, CIS_WINDOWS_SERVER]
},
{
conditionId: 'mark-of-the-web-suppressed', role: 'prerequisite', techniqueIds: ['T1204.002'],
statement: { de: "Unterdrücktes Mark of the Web begünstigt, dass heruntergeladene Dateien ohne Schutzprüfung geöffnet werden.", en: "Suppressed Mark of the Web favours downloaded files being opened without protection checks." },
sources: [T1204_002, CIS_WINDOWS_SERVER]
},
{
conditionId: 'autorun-enabled', role: 'prerequisite', techniqueIds: ['T1091'],
statement: { de: "Nicht abgeschaltetes AutoRun begünstigt, dass Code von Wechselmedien automatisch startet.", en: "AutoRun not being turned off favours code from removable media starting automatically." },
sources: [T1091, CIS_WINDOWS_SERVER]
},
{
conditionId: 'script-files-run-on-double-click', role: 'prerequisite', techniqueIds: ['T1204.002', 'T1059'],
statement: { de: "Per Doppelklick ausführbare Skriptdateien begünstigen die Ausführung von Phishing-Anhängen.", en: "Script files that run on double-click favour executing phishing attachments." },
sources: [T1204_002, PINGCASTLE_RULES]
},
{
conditionId: 'script-engines-reach-internet', role: 'prerequisite', techniqueIds: ['T1059'],
statement: { de: "Skript-Engines mit direktem Internetzugang begünstigen das Nachladen von Schadcode.", en: "Script engines with direct internet access favour downloading further malicious code." },
sources: [T1059, PINGCASTLE_RULES]
},
{
conditionId: 'laps-not-deployed', role: 'prerequisite', techniqueIds: ['T1550.002'],
statement: { de: "Ohne LAPS begünstigen gleiche lokale Administratorkennwörter, dass ein abgegriffenes Kennwort auf vielen Hosts wiederverwendet wird.", en: "Without LAPS, shared local administrator passwords favour reusing one captured credential on many hosts." },
sources: [T1550_002, PINGCASTLE_RULES]
},
{
conditionId: 'rdp-sessions-not-timed-out', role: 'prerequisite', techniqueIds: ['T1563.002'],
statement: { de: "Offen bleibende RDP-Sitzungen begünstigen, dass sie übernommen werden.", en: "RDP sessions that stay open favour them being taken over." },
sources: [T1563_002, CIS_WINDOWS_SERVER]
},
{
conditionId: 'terminal-services-gpo-incomplete', role: 'prerequisite', techniqueIds: ['T1563.002'],
statement: { de: "Fehlende Sitzungszeitlimits und Umleitungsvorgaben für Terminal Services begünstigen, dass offene Sitzungen übernommen werden.", en: "Missing session time limits and redirection settings for Terminal Services favour open sessions being taken over." },
sources: [T1563_002, PINGCASTLE_RULES]
},
{
conditionId: 'rdp-connection-security-weak', role: 'prerequisite', techniqueIds: ['T1557'],
statement: { de: "Schwächer gesicherte RDP-Verbindungen begünstigen, dass RDP-Sitzungen abgefangen werden.", en: "Weaker RDP connection security favours RDP sessions being intercepted." },
sources: [T1557, CIS_WINDOWS_SERVER]
},
{
conditionId: 'dangerous-user-rights-granted', role: 'prerequisite', techniqueIds: ['T1068'],
statement: { de: "Gefährliche Rechte wie Sichern, Wiederherstellen oder Treiberladen für Nicht-Administratoren begünstigen das Umgehen von Dateiberechtigungen und Rechteerhöhung.", en: "Dangerous rights such as backup, restore or driver loading for non-administrators favour bypassing file permissions and raising privileges." },
sources: [T1068, PURPLE_KNIGHT, CIS_WINDOWS_SERVER]
},
{
conditionId: 'rdp-passwords-saved', role: 'prerequisite', techniqueIds: ['T1555.004'],
statement: { de: "Gespeicherte RDP-Kennwörter begünstigen, dass sie aus dem Credential Manager ausgelesen werden.", en: "Saved RDP passwords favour reading them from the Credential Manager." },
sources: [T1555_004, CIS_WINDOWS_SERVER]
},
{
conditionId: 'always-install-elevated', role: 'prerequisite', techniqueIds: [],
statement: { de: "Installationen mit immer erhöhten Rechten begünstigen, dass normale Nutzer Code als SYSTEM ausführen.", en: "Always elevated installations favour regular users running code as SYSTEM." },
sources: [CIS_WINDOWS_SERVER]
},
{
conditionId: 'remote-credential-delegation-unprotected', role: 'prerequisite', techniqueIds: [],
statement: { de: "Ohne Restricted Admin oder Remote Credential Guard begünstigen RDP-Anmeldungen, dass wiederverwendbare Anmeldedaten auf dem Zielhost bleiben.", en: "Without Restricted Admin or Remote Credential Guard, RDP sign-ins favour reusable credentials being left on the target host." },
sources: [REMOTE_CREDENTIAL_GUARD, CIS_WINDOWS_SERVER]
},
{
conditionId: 'dnsadmins-unprivileged-members', role: 'prerequisite', techniqueIds: ['T1068'],
statement: { de: "Nicht privilegierte DnsAdmins-Mitglieder begünstigen, dass Code als SYSTEM auf einem Domain Controller geladen wird.", en: "Unprivileged DnsAdmins members favour loading code as SYSTEM on a domain controller." },
sources: [T1068, PURPLE_KNIGHT]
},
{
conditionId: 'schema-admins-not-empty', role: 'prerequisite', techniqueIds: ['T1078.002'],
statement: { de: "Dauerhafte Mitglieder in Schema Admins begünstigen den Missbrauch forestweiter Schemaänderungen mit einem gestohlenen Konto.", en: "Permanent Schema Admins members favour misusing forest-wide schema changes with a stolen account." },
sources: [T1078_002, PINGCASTLE_RULES]
},
{
conditionId: 'adminsdholder-permissions-changed', role: 'prerequisite', techniqueIds: ['T1098'],
statement: { de: "Geänderte AdminSDHolder-Berechtigungen begünstigen, dass fremde Rechte regelmäßig auf alle geschützten Konten übertragen werden.", en: "Changed AdminSDHolder permissions favour foreign rights being reapplied to every protected account." },
sources: [T1098, PURPLE_KNIGHT]
},
{
conditionId: 'ad-stale-admincount', role: 'prerequisite', techniqueIds: ['T1098'],
statement: { de: "Verbliebenes adminCount=1 begünstigt, dass frühere Privilegien und mögliche Hintertüren unbemerkt bleiben.", en: "A remaining adminCount=1 favours former privileges and possible backdoors going unnoticed." },
sources: [T1098, PURPLE_KNIGHT, PINGCASTLE_RULES]
},
{
conditionId: 'anonymous-ldap-bind', role: 'prerequisite', techniqueIds: ['T1087.002'],
statement: { de: "Anonyme LDAP-Bindungen begünstigen, dass die Domäne ohne Anmeldung erkundet wird.", en: "Anonymous LDAP binds favour exploring the domain without signing in." },
sources: [T1087_002, PINGCASTLE_RULES]
},
{
conditionId: 'anonymous-directory-access', role: 'prerequisite', techniqueIds: ['T1087.002'],
statement: { de: "Anonymer Verzeichniszugriff begünstigt, dass Konten und Gruppen ohne Anmeldung abgefragt werden.", en: "Anonymous directory access favours querying accounts and groups without signing in." },
sources: [T1087_002, PURPLE_KNIGHT]
},
{
conditionId: 'anonymous-nspi-access', role: 'prerequisite', techniqueIds: ['T1087.002'],
statement: { de: "Anonymer NSPI-Zugriff begünstigt, dass das Verzeichnis ohne Anmeldung über RPC abgefragt wird.", en: "Anonymous NSPI access favours querying the directory over RPC without signing in." },
sources: [T1087_002, PURPLE_KNIGHT]
},
{
conditionId: 'prewin2000-access-broad', role: 'prerequisite', techniqueIds: ['T1087.002'],
statement: { de: "Breite Mitglieder in Pre-Windows 2000 Compatible Access begünstigen umfassende Leserechte für die Erkundung des Verzeichnisses.", en: "Broad Pre-Windows 2000 Compatible Access membership favours wide read access for exploring the directory." },
sources: [T1087_002, PINGCASTLE_RULES]
},
{
conditionId: 'prewin2000-membership-changed', role: 'prerequisite', techniqueIds: ['T1087.002'],
statement: { de: "Änderungen an Pre-Windows 2000 Compatible Access begünstigen unbemerkt erweiterte Leserechte im Verzeichnis.", en: "Changes to Pre-Windows 2000 Compatible Access favour unnoticed wider read access to the directory." },
sources: [T1087_002, PURPLE_KNIGHT]
},
{
conditionId: 'net-session-enumeration-open', role: 'prerequisite', techniqueIds: ['T1087.002'],
statement: { de: "Nicht eingeschränkte Sitzungsabfragen begünstigen, dass Werkzeuge wie BloodHound angemeldete Administratoren finden.", en: "Unrestricted session enumeration favours tools such as BloodHound finding signed-in administrators." },
sources: [T1087_002, PINGCASTLE_RULES]
},
{
conditionId: 'anonymous-named-pipes', role: 'prerequisite', techniqueIds: [],
statement: { de: "Anonym erreichbare Named Pipes begünstigen Abfragen ohne Anmeldung.", en: "Anonymously reachable named pipes favour queries without signing in." },
sources: [CIS_WINDOWS_SERVER]
},
{
conditionId: 'guest-account-enabled', role: 'prerequisite', techniqueIds: [],
statement: { de: "Ein aktiviertes Gastkonto begünstigt Zugriffe auf die Domäne ohne Kennwort.", en: "An enabled guest account favours access to the domain without a password." },
sources: [PURPLE_KNIGHT]
},
{
conditionId: 'ad-backup-outdated', role: 'prerequisite', techniqueIds: ['T1490'],
statement: { de: "Eine veraltete AD-Sicherung begünstigt eine längere oder unvollständige Wiederherstellung nach einer Zerstörung.", en: "An outdated AD backup favours a longer or incomplete recovery after destruction." },
sources: [T1490, PINGCASTLE_RULES]
},
{
conditionId: 'ad-recycle-bin-disabled', role: 'prerequisite', techniqueIds: ['T1485'],
statement: { de: "Ein fehlender AD-Papierkorb begünstigt, dass gelöschte Objekte nur aufwendig wiederhergestellt werden.", en: "A missing AD Recycle Bin favours deleted objects being hard to restore." },
sources: [T1485, PINGCASTLE_RULES]
},
{
conditionId: 'ou-deletion-unprotected', role: 'prerequisite', techniqueIds: ['T1485'],
statement: { de: "Ungeschützte OUs begünstigen, dass ganze Teilbäume auf einmal gelöscht werden.", en: "Unprotected OUs favour whole subtrees being deleted at once." },
sources: [T1485, PINGCASTLE_RULES]
},
{
conditionId: 'dc-redundancy-missing', role: 'prerequisite', techniqueIds: ['T1490'],
statement: { de: "Fehlende DC-Redundanz begünstigt, dass der Ausfall eines Domain Controllers die Domäne lahmlegt.", en: "Missing DC redundancy favours the loss of one domain controller stopping the domain." },
sources: [T1490, PINGCASTLE_RULES]
},
{
conditionId: 'entra-user-risk-not-covered', role: 'prerequisite', techniqueIds: ['T1078.004'],
statement: { de: "Fehlender Schutz bei Benutzerrisiko begünstigt, dass als riskant eingestufte Konten weiter angemeldet bleiben.", en: "Missing user-risk protection favours accounts flagged as at risk staying signed in." },
sources: [T1078_004, SCUBA_AAD]
},
{
conditionId: 'entra-mfa-registration-incomplete', role: 'prerequisite', techniqueIds: ['T1078.004'],
statement: { de: "Nutzer ohne nutzbare MFA begünstigen Anmeldungen allein mit einem gestohlenen Kennwort.", en: "Users without usable MFA favour sign-ins with a stolen password alone." },
sources: [T1078_004, SCUBA_AAD]
},
{
conditionId: 'entra-managed-device-not-required', role: 'prerequisite', techniqueIds: ['T1078.004'],
statement: { de: "Anmeldungen ohne verwaltetes Gerät begünstigen die Nutzung gestohlener Zugangsdaten von fremden Geräten.", en: "Sign-ins without a managed device favour using stolen credentials from foreign devices." },
sources: [T1078_004, SCUBA_AAD]
},
{
conditionId: 'entra-mfa-registration-unrestricted', role: 'prerequisite', techniqueIds: ['T1098.005'],
statement: { de: "Eine unbeschränkte MFA-Registrierung begünstigt, dass mit einem gestohlenen Kennwort ein eigener zweiter Faktor registriert wird.", en: "Unrestricted MFA registration favours registering an own second factor with a stolen password." },
sources: [T1098_005, SCUBA_AAD]
},
{
conditionId: 'entra-mfa-fatigue-protection-weak', role: 'prerequisite', techniqueIds: ['T1621'],
statement: { de: "Fehlender Anmeldekontext in MFA-Anfragen begünstigt, dass Nutzer ungewollte Anfragen bestätigen.", en: "Missing sign-in context in MFA requests favours users approving unwanted requests." },
sources: [T1621, SCUBA_AAD, EIDSCA_TESTS]
},
{
conditionId: 'entra-unmanaged-sessions-persistent', role: 'prerequisite', techniqueIds: ['T1539'],
statement: { de: "Dauerhafte Sitzungen auf nicht verwalteten Geräten begünstigen den Diebstahl von Sitzungscookies.", en: "Persistent sessions on unmanaged devices favour stealing session cookies." },
sources: [T1539, maesterTest('MT.1017')]
},
{
conditionId: 'entra-global-admin-overused', role: 'prerequisite', techniqueIds: ['T1078.004'],
statement: { de: "Unnötige Global-Administrator-Zuweisungen begünstigen, dass ein gestohlenes Konto den ganzen Tenant steuert.", en: "Unneeded Global Administrator assignments favour one stolen account controlling the whole tenant." },
sources: [T1078_004, SCUBA_AAD]
},
{
conditionId: 'entra-privileged-user-mailbox', role: 'prerequisite', techniqueIds: ['T1566'],
statement: { de: "Ein Postfach an einem privilegierten Konto begünstigt, dass Phishing direkt ein Konto mit Control-Plane-Rechten erreicht.", en: "A mailbox on a privileged account favours phishing reaching an account with Control Plane rights directly." },
sources: [T1566, maesterTest('MT.1028')]
},
{
conditionId: 'entra-admin-managed-device-not-required', role: 'prerequisite', techniqueIds: ['T1078.004'],
statement: { de: "Admin-Anmeldungen von beliebigen Geräten begünstigen die Nutzung gestohlener Admin-Zugangsdaten.", en: "Admin sign-ins from any device favour using stolen admin credentials." },
sources: [T1078_004, maesterTest('MT.1014')]
},
{
conditionId: 'azure-root-permanent-access', role: 'prerequisite', techniqueIds: ['T1078.004'],
statement: { de: "Permanenter Root-Zugriff begünstigt, dass ein gestohlenes Konto alle Azure-Abonnements steuert.", en: "Permanent root access favours one stolen account controlling every Azure subscription." },
sources: [T1078_004, maesterTest('MT.1056')]
},
{
conditionId: 'entra-users-can-consent-apps', role: 'prerequisite', techniqueIds: ['T1528'],
statement: { de: "Nutzerzustimmung zu Anwendungen begünstigt Consent-Phishing, das dauerhaften Zugriff auf Daten verschafft.", en: "User consent to applications favours consent phishing that grants lasting access to data." },
sources: [T1528, SCUBA_AAD]
},
{
conditionId: 'entra-users-consent-risky-apps', role: 'prerequisite', techniqueIds: ['T1528'],
statement: { de: "Zustimmung zu riskanten Anwendungen begünstigt, dass bösartige Apps Zugriffstoken erhalten.", en: "Consent to risky applications favours malicious apps obtaining access tokens." },
sources: [T1528, EIDSCA_TESTS]
},
{
conditionId: 'entra-app-credentials-stale', role: 'prerequisite', techniqueIds: ['T1098.001'],
statement: { de: "Ungenutzte App-Anmeldedaten begünstigen, dass sie unbemerkt für Zugriffe missbraucht werden.", en: "Unused application credentials favour their unnoticed misuse for access." },
sources: [T1098_001, maesterTest('MT.1024')]
},
{
conditionId: 'entra-guest-invites-unrestricted', role: 'prerequisite', techniqueIds: ['T1078.004'],
statement: { de: "Unbeschränkte Gasteinladungen begünstigen, dass externe Identitäten ohne Kontrolle Zugang erhalten.", en: "Unrestricted guest invitations favour external identities gaining access without control." },
sources: [T1078_004, SCUBA_AAD]
},
{
conditionId: 'entra-guest-invite-domains-unrestricted', role: 'prerequisite', techniqueIds: ['T1078.004'],
statement: { de: "Nicht beschränkte Einladungsdomänen begünstigen Gastkonten aus beliebigen Organisationen.", en: "Unrestricted invitation domains favour guest accounts from any organisation." },
sources: [T1078_004, SCUBA_AAD]
},
{
conditionId: 'entra-self-service-signup-allowed', role: 'prerequisite', techniqueIds: ['T1078.004'],
statement: { de: "Selbstregistrierung per E-Mail begünstigt Konten im Tenant ohne Einladung.", en: "Self-service sign-up by email favours accounts in the tenant without an invitation." },
sources: [T1078_004, EIDSCA_TESTS]
},
{
conditionId: 'entra-guest-directory-access-broad', role: 'prerequisite', techniqueIds: ['T1087.004'],
statement: { de: "Breiter Verzeichniszugriff für Gäste begünstigt, dass Externe den Tenant erkunden.", en: "Broad directory access for guests favours external users exploring the tenant." },
sources: [SCUBA_AAD, EIDSCA_TESTS]
},
{
conditionId: 'sharepoint-external-sharing-broad', role: 'prerequisite', techniqueIds: [],
statement: { de: "Breite externe Freigaben begünstigen, dass Daten ohne Kontrolle nach außen gelangen.", en: "Broad external sharing favours data reaching outside parties without control." },
sources: [SCUBA_SHAREPOINT]
},
{
conditionId: 'teams-auto-admit-broad', role: 'prerequisite', techniqueIds: [],
statement: { de: "Automatischer Einlass Nicht-Eingeladener begünstigt, dass Unbefugte an Besprechungen teilnehmen.", en: "Automatic admission of uninvited users favours unauthorised people joining meetings." },
sources: [maesterTest('MT.1045')]
},
{
conditionId: 'lm-auth-level-below-refuse-lm-ntlm', role: 'prerequisite', techniqueIds: ['T1557.001'],
statement: { de: "Eine LAN-Manager-Ebene unter dem Verweigern von LM und NTLM begünstigt NTLM-Anmeldungen, die abgegriffen und weitergeleitet werden.", en: "A LAN Manager level below refusing LM and NTLM favours NTLM authentications that can be captured and relayed." },
sources: [T1557_001, CIS_WINDOWS_SERVER]
},
{
conditionId: 'ldap-signing-enforcement-off', role: 'prerequisite', techniqueIds: ['T1557'],
statement: { de: "Eine nicht durchgesetzte LDAP-Signierung begünstigt, dass LDAP-Anmeldungen weitergeleitet werden.", en: "LDAP signing that is not enforced favours LDAP authentications being relayed." },
sources: [T1557, CIS_WINDOWS_SERVER]
},
{
conditionId: 'adidns-authenticated-create', role: 'prerequisite', techniqueIds: ['T1557'],
statement: { de: "Von allen Nutzern anlegbare DNS-Einträge begünstigen Einträge, die Anmeldungen umleiten.", en: "DNS records that every user can create favour records that redirect authentications." },
sources: [T1557, PINGCASTLE_RULES]
},
{
conditionId: 'dc-ldaps-legacy-tls', role: 'prerequisite', techniqueIds: ['T1557'],
statement: { de: "Veraltetes TLS auf Domain Controllern begünstigt das Abfangen von LDAPS-Verbindungen.", en: "Outdated TLS on domain controllers favours intercepting LDAPS connections." },
sources: [T1557, PINGCASTLE_RULES]
},
{
conditionId: 'weak-trusted-root-certificate', role: 'prerequisite', techniqueIds: ['T1557'],
statement: { de: "Schwache Schlüssel in vertrauenswürdigen Zertifikaten begünstigen gefälschte Zertifikate zum Abfangen von Verbindungen.", en: "Weak keys in trusted certificates favour forged certificates for intercepting connections." },
sources: [T1557, PINGCASTLE_RULES]
},
{
conditionId: 'autoadminlogon-not-disabled', role: 'prerequisite', techniqueIds: ['T1552.002'],
statement: { de: "Nicht ausdrücklich abgeschaltete automatische Anmeldung begünstigt ein in der Registry gespeichertes Anmeldekennwort.", en: "Automatic logon that is not explicitly disabled favours a logon password stored in the registry." },
sources: [T1552_002, CIS_WINDOWS_SERVER]
},
{
conditionId: 'entra-global-admin-count-outside-range', role: 'prerequisite', techniqueIds: ['T1078.004'],
statement: { de: "Eine Global-Admin-Anzahl außerhalb der Empfehlung begünstigt zu viele Übernahmeziele oder fehlenden Notfallzugang.", en: "A Global Administrator count outside the recommendation favours too many takeover targets or missing emergency access." },
sources: [T1078_004, SCUBA_AAD]
},
{
conditionId: 'entra-emergency-access-not-excluded', role: 'prerequisite', techniqueIds: [],
statement: { de: "Fehlende Notfallausnahmen begünstigen, dass Administratoren bei Fehlkonfiguration ausgesperrt werden.", en: "Missing emergency exclusions favour administrators being locked out after a misconfiguration." },
sources: [maesterTest('MT.1005')]
},
{
conditionId: 'entra-eligible-roles-unused', role: 'prerequisite', techniqueIds: ['T1078.004'],
statement: { de: "Nicht genutzte berechtigte Zuweisungen begünstigen dauerhaft aktive privilegierte Rechte.", en: "Unused eligible assignments favour permanently active privileged rights." },
sources: [T1078_004, maesterTest('MT.1030')]
},
{
conditionId: 'entra-privileged-unusual-signin', role: 'prerequisite', techniqueIds: ['T1078.004'],
statement: { de: "Ungewöhnliche Anmeldungen privilegierter Konten begünstigen, dass eine Übernahme unbemerkt fortbesteht.", en: "Unusual sign-ins of privileged accounts favour a takeover persisting unnoticed." },
sources: [T1078_004, maesterTest('MT.INV.001')]
},
{
conditionId: 'entra-privileged-accounts-inactive', role: 'prerequisite', techniqueIds: ['T1078.004'],
statement: { de: "Inaktive privilegierte Konten begünstigen eine unbemerkte Übernahme.", en: "Inactive privileged accounts favour an unnoticed takeover." },
sources: [T1078_004, maesterTest('MT.INV.003')]
},
{
conditionId: 'azure-management-group-creation-open', role: 'prerequisite', techniqueIds: [],
statement: { de: "Ohne Schreibrechte anlegbare Management Groups begünstigen unkontrollierte Strukturen mit eigenen Berechtigungen.", en: "Management groups that can be created without write permissions favour uncontrolled structures with their own permissions." },
sources: [maesterTest('MT.1064')]
},
{
conditionId: 'entra-ca-policy-integrity-gaps', role: 'prerequisite', techniqueIds: ['T1078.004'],
statement: { de: "Lücken in Geltungsbereich oder Verweisen begünstigen Anmeldungen, für die keine Richtlinie greift.", en: "Gaps in scope or references favour sign-ins that no policy covers." },
sources: [T1078_004, maesterTest('MT.1036')]
},
{
conditionId: 'entra-ca-coverage-gaps', role: 'prerequisite', techniqueIds: ['T1078.004'],
statement: { de: "Nicht abgedeckte Plattformen, Apps oder Risikosignale begünstigen Anmeldungen am Schutz vorbei.", en: "Uncovered platforms, apps or risk signals favour sign-ins that bypass protection." },
sources: [T1078_004, maesterTest('MT.1015')]
},
{
conditionId: 'entra-fido2-restrictions-off', role: 'prerequisite', techniqueIds: ['T1098.005'],
statement: { de: "Nicht beschränkte FIDO2-Schlüssel begünstigen die Registrierung nicht vertrauenswürdiger Authentifikatoren.", en: "Unrestricted FIDO2 keys favour registering untrusted authenticators." },
sources: [T1098_005, EIDSCA_TESTS]
},
{
conditionId: 'entra-authenticator-otp-allowed', role: 'prerequisite', techniqueIds: ['T1621'],
statement: { de: "Erlaubte Einmalcodes begünstigen phishbare zweite Faktoren.", en: "Allowed one-time codes favour phishable second factors." },
sources: [T1621, EIDSCA_TESTS]
},
{
conditionId: 'intune-device-compliance-gaps', role: 'prerequisite', techniqueIds: ['T1078.004'],
statement: { de: "Unvollständige Gerätekonformität begünstigt, dass nicht geprüfte Geräte als konform gelten.", en: "Incomplete device compliance favours unchecked devices counting as compliant." },
sources: [T1078_004, maesterTest('MT.1054')]
},
{
conditionId: 'entra-leaked-credential-detection-limited', role: 'prerequisite', techniqueIds: [],
statement: { de: "Ohne Password Hash Sync begünstigt die fehlende Erkennung geleakter Kennwörter, dass gestohlene Zugangsdaten unbemerkt bleiben.", en: "Without password hash sync, missing leaked-credential detection favours stolen credentials going unnoticed." },
sources: [maesterTest('MT.1024')]
},
{
conditionId: 'entra-admin-consent-workflow-missing', role: 'prerequisite', techniqueIds: ['T1528'],
statement: { de: "Ein fehlender Zustimmungsworkflow begünstigt ungeprüfte Wege zu Anwendungszugriffen.", en: "A missing consent workflow favours unreviewed paths to application access." },
sources: [T1528, SCUBA_AAD]
},
{
conditionId: 'entra-app-credentials-expiring', role: 'prerequisite', techniqueIds: ['T1098.001'],
statement: { de: "Unverwaltete Laufzeiten von App-Anmeldedaten begünstigen hastig erneuerte oder dauerhaft gültige Geheimnisse.", en: "Unmanaged application credential lifetimes favour hastily renewed or long-lived secrets." },
sources: [T1098_001, maesterTest('MT.1024')]
},
{
conditionId: 'm365-public-groups-unmanaged', role: 'prerequisite', techniqueIds: [],
statement: { de: "Nicht verwaltete öffentliche Gruppen begünstigen, dass Inhalte breiter zugänglich sind als beabsichtigt.", en: "Unmanaged public groups favour content being more widely accessible than intended." },
sources: [CIS_M365]
},
{
conditionId: 'domain-admins-password-never-expires', role: 'prerequisite', techniqueIds: ['T1110.002'],
statement: { de: "Nie ablaufende Kennwörter von Domänen-Admins begünstigen unbegrenzte Zeit zum Erraten oder Knacken.", en: "Never-expiring domain admin passwords favour unlimited time for guessing or cracking." },
sources: [T1110_002, PINGCASTLE_RULES]
},
{
conditionId: 'gmsa-not-used', role: 'prerequisite', techniqueIds: ['T1558.003'],
statement: { de: "Ohne gMSA begünstigen manuell verwaltete Dienstkonto-Kennwörter das Knacken von Diensttickets.", en: "Without gMSA, manually managed service account passwords favour cracking service tickets." },
sources: [T1558_003, PURPLE_KNIGHT]
},
{
conditionId: 'dsheuristics-ldap-mitigation-off', role: 'prerequisite', techniqueIds: ['T1068'],
statement: { de: "Die fehlende Abschwächung begünstigt, dass Nutzer an selbst angelegten Computerobjekten sicherheitsrelevante Attribute setzen.", en: "The missing mitigation favours users setting security-relevant attributes on computer objects they create." },
sources: [T1068, PINGCASTLE_RULES]
},
{
conditionId: 'dc-subnet-declaration-incomplete', role: 'prerequisite', techniqueIds: [],
statement: { de: "Unvollständige Subnetze begünstigen, dass Clients entfernte Domain Controller nutzen und Ausfälle schwerer abgefangen werden.", en: "Incomplete subnets favour clients using remote domain controllers and outages being harder to absorb." },
sources: [PINGCASTLE_RULES]
},
{
conditionId: 'cis-audit-policy-unmet', role: 'prerequisite', techniqueIds: [],
statement: { de: "Nicht erfüllte Überwachungsempfehlungen begünstigen, dass Aktivitäten nicht aufgezeichnet werden.", en: "Unmet audit recommendations favour activity going unrecorded." },
sources: [CIS_WINDOWS_SERVER]
},
{
conditionId: 'cis-event-log-unmet', role: 'prerequisite', techniqueIds: [],
statement: { de: "Nicht erfüllte Protokollempfehlungen begünstigen, dass Ereignisse verloren gehen.", en: "Unmet event log recommendations favour events being lost." },
sources: [CIS_WINDOWS_SERVER]
},
{
conditionId: 'cis-defender-unmet', role: 'prerequisite', techniqueIds: ['T1204.002'],
statement: { de: "Nicht erfüllte Defender-Empfehlungen begünstigen, dass Schadcode unerkannt läuft.", en: "Unmet Defender recommendations favour malicious code running undetected." },
sources: [T1204_002, CIS_WINDOWS_SERVER]
},
{
conditionId: 'cis-software-installation-unmet', role: 'prerequisite', techniqueIds: ['T1204.002'],
statement: { de: "Nicht erfüllte Installationsempfehlungen begünstigen die Installation nicht vertrauenswürdiger Software.", en: "Unmet installation recommendations favour installing untrusted software." },
sources: [T1204_002, CIS_WINDOWS_SERVER]
},
{
conditionId: 'cis-exploit-mitigations-unmet', role: 'prerequisite', techniqueIds: ['T1203'],
statement: { de: "Nicht erfüllte Exploit-Schutzmaßnahmen begünstigen das Ausnutzen von Speicher- und Verarbeitungsfehlern.", en: "Unmet exploit mitigations favour exploiting memory and parsing flaws." },
sources: [T1203, CIS_WINDOWS_SERVER]
},
{
conditionId: 'cis-remote-desktop-unmet', role: 'prerequisite', techniqueIds: ['T1021.001'],
statement: { de: "Nicht erfüllte RDP-Empfehlungen begünstigen Lateral Movement über Remote Desktop.", en: "Unmet RDP recommendations favour lateral movement over Remote Desktop." },
sources: [T1021_001, CIS_WINDOWS_SERVER]
},
{
conditionId: 'cis-remote-management-unmet', role: 'prerequisite', techniqueIds: ['T1021.006'],
statement: { de: "Nicht erfüllte Empfehlungen zur Remote-Verwaltung begünstigen Lateral Movement über WinRM.", en: "Unmet remote management recommendations favour lateral movement over WinRM." },
sources: [T1021_006, CIS_WINDOWS_SERVER]
},
{
conditionId: 'cis-firewall-profile-unmet', role: 'prerequisite', techniqueIds: ['T1021'],
statement: { de: "Nicht erfüllte Firewall-Empfehlungen begünstigen erreichbare Remote-Dienste.", en: "Unmet firewall recommendations favour reachable remote services." },
sources: [T1021, CIS_WINDOWS_SERVER]
},
{
conditionId: 'cis-network-stack-unmet', role: 'prerequisite', techniqueIds: ['T1557'],
statement: { de: "Nicht erfüllte Netzwerkempfehlungen begünstigen umgeleiteten Verkehr und ungewollte Netzwerkwege.", en: "Unmet network recommendations favour redirected traffic and unwanted network paths." },
sources: [T1557, CIS_WINDOWS_SERVER]
},
{
conditionId: 'cis-smb-hardening-unmet', role: 'prerequisite', techniqueIds: ['T1557'],
statement: { de: "Nicht erfüllte SMB-Empfehlungen begünstigen das Abfangen und Weiterleiten von SMB-Verbindungen.", en: "Unmet SMB recommendations favour intercepting and relaying SMB connections." },
sources: [T1557, CIS_WINDOWS_SERVER]
},
{
conditionId: 'cis-name-resolution-unmet', role: 'prerequisite', techniqueIds: ['T1557.001'],
statement: { de: "Nicht erfüllte Empfehlungen zur Namensauflösung begünstigen umgeleitete Namensabfragen.", en: "Unmet name resolution recommendations favour redirected name lookups." },
sources: [T1557_001, CIS_WINDOWS_SERVER]
},
{
conditionId: 'cis-authentication-hardening-unmet', role: 'prerequisite', techniqueIds: ['T1557'],
statement: { de: "Nicht erfüllte Authentifizierungsempfehlungen begünstigen schwächere, abfangbare Anmeldeverfahren.", en: "Unmet authentication recommendations favour weaker authentication that can be intercepted." },
sources: [T1557, CIS_WINDOWS_SERVER]
},
{
conditionId: 'cis-print-hardening-unmet', role: 'prerequisite', techniqueIds: ['T1187', 'T1068'],
statement: { de: "Nicht erfüllte Druckerempfehlungen begünstigen erzwungene Anmeldungen über den Spooler und Rechteerhöhung über Treiber.", en: "Unmet printer recommendations favour forced authentication through the spooler and privilege escalation through drivers." },
sources: [T1187, T1068, CIS_WINDOWS_SERVER]
},
{
conditionId: 'cis-user-rights-unmet', role: 'prerequisite', techniqueIds: [],
statement: { de: "Nicht erfüllte Benutzerrechte-Empfehlungen begünstigen mehr Konten mit Anmelde- oder Systemrechten als nötig.", en: "Unmet user rights recommendations favour more accounts holding logon or system rights than needed." },
sources: [CIS_WINDOWS_SERVER]
},
{
conditionId: 'cis-credential-handling-unmet', role: 'prerequisite', techniqueIds: [],
statement: { de: "Nicht erfüllte Empfehlungen zur Weitergabe begünstigen, dass Anmeldedaten über den Host hinaus gelangen.", en: "Unmet delegation recommendations favour credentials leaving the host." },
sources: [CIS_WINDOWS_SERVER]
},
{
conditionId: 'cis-domain-controller-options-unmet', role: 'prerequisite', techniqueIds: [],
statement: { de: "Nicht erfüllte DC-Empfehlungen begünstigen schwächere Schutzmaßnahmen auf Domain Controllern.", en: "Unmet domain controller recommendations favour weaker protections on domain controllers." },
sources: [CIS_WINDOWS_SERVER]
},
{
conditionId: 'cis-builtin-accounts-unmet', role: 'prerequisite', techniqueIds: ['T1110.001'],
statement: { de: "Nicht erfüllte Empfehlungen zu integrierten Konten begünstigen Rateangriffe auf bekannte Kontonamen.", en: "Unmet built-in account recommendations favour guessing attacks on well-known account names." },
sources: [T1110_001, CIS_WINDOWS_SERVER]
},
{
conditionId: 'cis-account-database-unmet', role: 'prerequisite', techniqueIds: [],
statement: { de: "Nicht erfüllte Empfehlungen zur Kontendatenbank begünstigen einen schwächeren Schutz lokaler Konten.", en: "Unmet account database recommendations favour weaker protection of local accounts." },
sources: [CIS_WINDOWS_SERVER]
},
{
conditionId: 'cis-sign-in-screen-unmet', role: 'prerequisite', techniqueIds: [],
statement: { de: "Nicht erfüllte Anmeldebildschirm-Empfehlungen begünstigen Informationspreisgabe und Missbrauch am Gerät.", en: "Unmet sign-in screen recommendations favour information disclosure and misuse at the device." },
sources: [CIS_WINDOWS_SERVER]
},
{
conditionId: 'cis-device-access-unmet', role: 'prerequisite', techniqueIds: ['T1200'],
statement: { de: "Nicht erfüllte Geräteempfehlungen begünstigen Missbrauch über physischen Zugriff oder angeschlossene Geräte.", en: "Unmet device recommendations favour misuse through physical access or attached devices." },
sources: [T1200, CIS_WINDOWS_SERVER]
},
{
conditionId: 'cis-telemetry-unmet', role: 'prerequisite', techniqueIds: [],
statement: { de: "Nicht erfüllte Telemetrie-Empfehlungen begünstigen, dass Diagnosedaten den Host verlassen.", en: "Unmet telemetry recommendations favour diagnostic data leaving the host." },
sources: [CIS_WINDOWS_SERVER]
},
{
conditionId: 'cis-cloud-sync-unmet', role: 'prerequisite', techniqueIds: [],
statement: { de: "Nicht erfüllte Synchronisierungsempfehlungen begünstigen, dass Inhalte und Aktivitäten in Cloud-Dienste gelangen.", en: "Unmet synchronisation recommendations favour content and activity reaching cloud services." },
sources: [CIS_WINDOWS_SERVER]
},
{
conditionId: 'cis-internet-communication-unmet', role: 'prerequisite', techniqueIds: [],
statement: { de: "Nicht erfüllte Empfehlungen zur Internetkommunikation begünstigen ungeprüfte Verbindungen zu externen Diensten.", en: "Unmet internet communication recommendations favour unchecked connections to external services." },
sources: [CIS_WINDOWS_SERVER]
},
{
conditionId: 'cis-windows-update-unmet', role: 'prerequisite', techniqueIds: ['T1210'],
statement: { de: "Nicht erfüllte Update-Empfehlungen begünstigen, dass bekannte Schwachstellen länger offen bleiben.", en: "Unmet update recommendations favour known vulnerabilities staying open longer." },
sources: [T1210, CIS_WINDOWS_SERVER]
},
{
conditionId: 'cis-policy-processing-unmet', role: 'prerequisite', techniqueIds: [],
statement: { de: "Nicht erfüllte Verarbeitungsempfehlungen begünstigen, dass lokal geänderte Sicherheitseinstellungen bestehen bleiben.", en: "Unmet processing recommendations favour locally changed security settings persisting." },
sources: [CIS_WINDOWS_SERVER]
},
{
conditionId: 'cis-time-sync-unmet', role: 'prerequisite', techniqueIds: [],
statement: { de: "Nicht erfüllte Zeitempfehlungen begünstigen Zeitabweichungen, die Kerberos und die Auswertung von Protokollen stören.", en: "Unmet time recommendations favour clock drift that disturbs Kerberos and log correlation." },
sources: [CIS_WINDOWS_SERVER]
},
{
conditionId: 'uncatalogued-deviations-pingcastle', role: 'prerequisite', techniqueIds: [],
statement: { de: "Eine noch nicht zugeordnete PingCastle-Abweichung begünstigt ein Risiko, das hier sichtbar bleibt, bis es katalogisiert ist.", en: "A PingCastle deviation that is not yet assigned favours a risk that stays visible here until it is catalogued." },
sources: [PINGCASTLE_RULES]
},
{
conditionId: 'uncatalogued-deviations-purple-knight', role: 'prerequisite', techniqueIds: [],
statement: { de: "Eine noch nicht zugeordnete Purple Knight-Abweichung begünstigt ein Risiko, das hier sichtbar bleibt, bis es katalogisiert ist.", en: "A Purple Knight deviation that is not yet assigned favours a risk that stays visible here until it is catalogued." },
sources: [PURPLE_KNIGHT]
},
{
conditionId: 'uncatalogued-deviations-cis-cat', role: 'prerequisite', techniqueIds: [],
statement: { de: "Eine noch nicht zugeordnete CIS-CAT-Abweichung begünstigt ein Risiko, das hier sichtbar bleibt, bis es katalogisiert ist.", en: "A CIS-CAT deviation that is not yet assigned favours a risk that stays visible here until it is catalogued." },
sources: [CIS_WINDOWS_SERVER]
},
{
conditionId: 'uncatalogued-deviations-maester', role: 'prerequisite', techniqueIds: [],
statement: { de: "Eine noch nicht zugeordnete Maester-Abweichung begünstigt ein Risiko, das hier sichtbar bleibt, bis es katalogisiert ist.", en: "A Maester deviation that is not yet assigned favours a risk that stays visible here until it is catalogued." },
sources: [maesterTest('MT.1001')]
},
{
conditionId: 'gpo-privileged-rights-deviate', role: 'prerequisite', techniqueIds: ['T1068'],
statement: { de: "Abweichend zugewiesene privilegierte Rechte wie Sichern, Wiederherstellen, Debuggen oder Treiberladen begünstigen das Umgehen von Schutzmechanismen und Rechteerhöhung.", en: "Deviating assignments of privileged rights such as backup, restore, debug or driver loading favour bypassing protections and raising privileges." },
sources: [T1068, { title: 'User Rights Assignment', url: `${SECURITY_POLICY_DOCS}user-rights-assignment`, publisher: 'Microsoft' }]
},
{
conditionId: 'gpo-delegation-right-deviates', role: 'prerequisite', techniqueIds: [],
statement: { de: "Ein abweichend vergebenes Delegierungsrecht begünstigt, dass weitere Konten für Delegierung freigeschaltet werden.", en: "A deviating delegation right favours more accounts being enabled for delegation." },
sources: [KCD_OVERVIEW]
},
{
conditionId: 'gpo-network-logon-right-deviates', role: 'prerequisite', techniqueIds: ['T1021'],
statement: { de: "Abweichende Netzwerk- und Remote-Anmelderechte begünstigen Anmeldungen über das Netz mit mehr Konten als vorgesehen.", en: "Deviating network and remote logon rights favour network sign-ins with more accounts than intended." },
sources: [T1021]
},
{
conditionId: 'gpo-local-logon-right-deviates', role: 'prerequisite', techniqueIds: [],
statement: { de: "Abweichende lokale Anmelderechte begünstigen Anmeldungen am Gerät durch mehr Konten als vorgesehen.", en: "Deviating local logon rights favour sign-ins at the device by more accounts than intended." },
sources: [CIS_WINDOWS_SERVER]
},
{
conditionId: 'gpo-audit-policy-deviates', role: 'prerequisite', techniqueIds: [],
statement: { de: "Eine abweichende Überwachungsrichtlinie begünstigt, dass Aktivitäten nicht aufgezeichnet werden.", en: "A deviating audit policy favours activity going unrecorded." },
sources: [CIS_WINDOWS_SERVER]
},
{
conditionId: 'gpo-firewall-logging-deviates', role: 'prerequisite', techniqueIds: [],
statement: { de: "Abweichende Firewall-Protokollierung begünstigt, dass Netzwerkverbindungen nicht nachvollzogen werden können.", en: "Deviating firewall logging favours network connections that cannot be traced." },
sources: [CIS_WINDOWS_SERVER]
},
{
conditionId: 'gpo-firewall-profile-deviates', role: 'prerequisite', techniqueIds: ['T1021'],
statement: { de: "Abweichende Firewall-Profile begünstigen erreichbare Remote-Dienste.", en: "Deviating firewall profiles favour reachable remote services." },
sources: [T1021]
},
{
conditionId: 'gpo-dns-client-policy-deviates', role: 'prerequisite', techniqueIds: ['T1557.001'],
statement: { de: "Abweichende DNS-Client-Einstellungen begünstigen umgeleitete Namensabfragen.", en: "Deviating DNS client settings favour redirected name lookups." },
sources: [T1557_001]
},
{
conditionId: 'gpo-application-control-deviates', role: 'prerequisite', techniqueIds: ['T1204.002'],
statement: { de: "Eine abweichende Anwendungssteuerung begünstigt, dass nicht freigegebene Programme, Skripte oder Installer laufen.", en: "Deviating application control favours unapproved programs, scripts or installers running." },
sources: [T1204_002]
},
{
conditionId: 'gpo-lockout-timing-deviates', role: 'prerequisite', techniqueIds: ['T1110.001'],
statement: { de: "Abweichende Sperrzeiten begünstigen, dass Rateversuche schneller fortgesetzt werden.", en: "Deviating lockout timing favours resuming guessing attempts sooner." },
sources: [T1110_001]
},
{
conditionId: 'gpo-password-lifetime-deviates', role: 'prerequisite', techniqueIds: ['T1110.002'],
statement: { de: "Abweichende Kennwortlaufzeiten begünstigen, dass Kennwörter länger nutzbar bleiben oder wiederverwendet werden.", en: "Deviating password lifetimes favour passwords staying usable longer or being reused." },
sources: [T1110_002]
},
{
conditionId: 'gpo-reversible-password-storage-deviates', role: 'prerequisite', techniqueIds: ['T1003'],
statement: { de: "Abweichend erlaubte umkehrbare Speicherung begünstigt, dass Kennwörter im Klartext gewonnen werden.", en: "Deviating reversible storage favours passwords being recovered in clear text." },
sources: [{ title: 'Store passwords using reversible encryption', url: `${SECURITY_POLICY_DOCS}store-passwords-using-reversible-encryption`, publisher: 'Microsoft' }]
},
{
conditionId: 'gpo-logon-hours-enforcement-deviates', role: 'prerequisite', techniqueIds: [],
statement: { de: "Nicht durchgesetzte Anmeldezeiten begünstigen, dass Sitzungen außerhalb erlaubter Zeiten bestehen bleiben.", en: "Unenforced logon hours favour sessions persisting outside permitted times." },
sources: [CIS_WINDOWS_SERVER]
},
{
conditionId: 'gpo-office-forms-auth-hosts-deviate', role: 'prerequisite', techniqueIds: ['T1056.002'],
statement: { de: "Abweichend erlaubte Anmeldeformulare in Office begünstigen, dass Zugangsdaten in fremde Anmeldedialoge eingegeben werden.", en: "Deviating forms-based sign-in hosts in Office favour credentials being entered into foreign sign-in prompts." },
sources: [T1056_002]
},
{
conditionId: 'gpo-convenience-pin-sign-in-deviates', role: 'prerequisite', techniqueIds: [],
statement: { de: "Eine abweichend erlaubte Komfort-PIN begünstigt, dass sich Domänenbenutzer am Gerät mit einer kurzen PIN statt ihres Kennworts anmelden.", en: "A deviating convenience PIN favours domain users signing in on the device with a short PIN instead of their password." },
sources: [{ title: 'Policy CSP - CredentialProviders: AllowPINLogon (Turn on convenience PIN sign-in)', url: 'https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-credentialproviders', publisher: 'Microsoft' }, CIS_WINDOWS_SERVER]
},
{
conditionId: 'ad-default-container-redirected', role: 'prerequisite', techniqueIds: [],
statement: { de: "Ein geänderter Standardort für neue Objekte begünstigt, dass Prüfprogramme die verschobenen Objekte nicht prüfen.", en: "A changed default location for new objects favours audit programs not checking the moved objects." },
sources: [PINGCASTLE_RULES]
},
{
conditionId: 'ad-dcshadow-evidence', role: 'prerequisite', techniqueIds: [],
statement: { de: "Hinweise auf DCShadow begünstigen, dass unbemerkte Änderungen über einen gefälschten Domain Controller im Verzeichnis verbleiben.", en: "Evidence of DCShadow favours unnoticed changes made through a rogue domain controller remaining in the directory." },
sources: [mitre('T1207', 'Rogue Domain Controller'), PURPLE_KNIGHT]
},
{
conditionId: 'ad-primary-group-anomaly', role: 'prerequisite', techniqueIds: [],
statement: { de: "Abweichende primäre Gruppen begünstigen, dass Gruppenmitgliedschaften verdeckt bestehen bleiben.", en: "Non-default primary groups favour group memberships persisting in a concealed way." },
sources: [T1098, PURPLE_KNIGHT]
},
{
conditionId: 'krbtgt-password-old', role: 'prerequisite', techniqueIds: [],
statement: { de: "Ein altes KRBTGT-Kennwort begünstigt, dass einmal gestohlenes Schlüsselmaterial weiter für gefälschte Tickets nutzbar bleibt.", en: "An old KRBTGT password favours once-stolen key material remaining usable for forged tickets." },
sources: [mitre('T1558.001', 'Steal or Forge Kerberos Tickets: Golden Ticket'), PURPLE_KNIGHT]
},
{
conditionId: 'ad-sidhistory-abuse', role: 'prerequisite', techniqueIds: [],
statement: { de: "Privilegierte oder neu gesetzte SIDHistory-Einträge begünstigen verdeckte, dauerhafte Rechte.", en: "Privileged or newly set SIDHistory entries favour concealed, lasting rights." },
sources: [mitre('T1134.005', 'Access Token Manipulation: SID-History Injection'), PURPLE_KNIGHT]
},
{
conditionId: 'ad-recent-sensitive-changes', role: 'prerequisite', techniqueIds: [],
statement: { de: "Kürzliche Änderungen an sensiblen Objekten begünstigen, dass unbemerkte Rechte oder Hintertüren entstanden sind.", en: "Recent changes to sensitive objects favour unnoticed rights or backdoors having been created." },
sources: [T1098, PURPLE_KNIGHT]
},
{
conditionId: 'ad-dangerous-acl-delegation', role: 'prerequisite', techniqueIds: [],
statement: { de: "Gefährliche Rechte an sensiblen AD-Objekten begünstigen, dass Konten ohne Adminrechte privilegierte Anmeldedaten erlangen.", en: "Dangerous rights on sensitive AD objects favour accounts without admin rights obtaining privileged credentials." },
sources: [mitre('T1003.006', 'OS Credential Dumping: DCSync'), PURPLE_KNIGHT]
},
{
conditionId: 'rodc-credential-caching-risky', role: 'prerequisite', techniqueIds: [],
statement: { de: "Zwischengespeicherte privilegierte Anmeldedaten auf RODCs begünstigen, dass sie mit einem RODC abgegriffen werden.", en: "Cached privileged credentials on RODCs favour them being captured together with an RODC." },
sources: [PURPLE_KNIGHT]
},
{
conditionId: 'gpo-link-delegation-broad', role: 'prerequisite', techniqueIds: [],
statement: { de: "Delegierte GPO-Verknüpfung auf hoher Ebene begünstigt, dass Nicht-Administratoren Richtlinien auf privilegierte Systeme anwenden.", en: "Delegated GPO linking at a high level favours non-administrators applying policies to privileged systems." },
sources: [mitre('T1484.001', 'Domain or Tenant Policy Modification: Group Policy Modification'), PURPLE_KNIGHT]
},
{
conditionId: 'ad-privileged-membership-hygiene', role: 'prerequisite', techniqueIds: [],
statement: { de: "Unnötige Mitglieder privilegierter Gruppen begünstigen, dass mehr Konten als nötig privilegierte Anmeldedaten tragen.", en: "Unnecessary members of privileged groups favour more accounts than necessary carrying privileged credentials." },
sources: [T1078_002, PURPLE_KNIGHT]
},
{
conditionId: 'ad-asrep-roastable', role: 'prerequisite', techniqueIds: [],
statement: { de: "Fehlende Vorauthentifizierung begünstigt, dass Antworten ohne Anmeldedaten angefordert und offline geknackt werden.", en: "Missing pre-authentication favours responses being requested without credentials and cracked offline." },
sources: [mitre('T1558.004', 'Steal or Forge Kerberos Tickets: AS-REP Roasting'), PURPLE_KNIGHT]
},
{
conditionId: 'ad-user-spn', role: 'prerequisite', techniqueIds: [],
statement: { de: "Benutzerkonten mit SPN begünstigen, dass Service-Tickets für ihr Kennwort angefordert und offline geknackt werden.", en: "User accounts with an SPN favour service tickets for their password being requested and cracked offline." },
sources: [T1558_003, PURPLE_KNIGHT]
},
{
conditionId: 'ad-passwords-old', role: 'prerequisite', techniqueIds: [],
statement: { de: "Alte Kennwörter begünstigen, dass einmal erlangte oder geknackte Kennwörter weiter gültig sind.", en: "Old passwords favour once obtained or cracked passwords remaining valid." },
sources: [T1110_002, PURPLE_KNIGHT]
},
{
conditionId: 'ad-password-not-required', role: 'prerequisite', techniqueIds: [],
statement: { de: "Konten ohne Kennwortpflicht begünstigen eine Anmeldung mit leerem oder trivialem Kennwort.", en: "Accounts without a password requirement favour signing in with an empty or trivial password." },
sources: [T1110_001, PURPLE_KNIGHT]
},
{
conditionId: 'ad-recoverable-passwords', role: 'prerequisite', techniqueIds: [],
statement: { de: "Umkehrbar oder schwach gespeicherte Kennwörter begünstigen, dass sie ausgelesen oder schnell geknackt werden.", en: "Recoverably or weakly stored passwords favour them being read or cracked quickly." },
sources: [mitre('T1552.006', 'Unsecured Credentials: Group Policy Preferences'), T1110_002, PURPLE_KNIGHT]
},
{
conditionId: 'ad-obsolete-components', role: 'prerequisite', techniqueIds: [],
statement: { de: "Veraltete Komponenten begünstigen, dass bekannte Schwachstellen und fehlende Schutzfunktionen bestehen bleiben.", en: "Obsolete components favour known vulnerabilities and missing protections persisting." },
sources: [T1210, PURPLE_KNIGHT]
},
{
conditionId: 'ad-constrained-delegation-risky', role: 'prerequisite', techniqueIds: [],
statement: { de: "Konfigurierte Delegation begünstigt, dass ein übernommenes Konto sich gegenüber Zieldiensten als andere Nutzer ausgibt.", en: "Configured delegation favours a compromised account impersonating other users towards target services." },
sources: [KCD_OVERVIEW, PURPLE_KNIGHT]
},
{
conditionId: 'dc-health-inconsistent', role: 'prerequisite', techniqueIds: [],
statement: { de: "Inkonsistente Domain Controller begünstigen eine unvollständige Replikation und Wiederherstellung.", en: "Inconsistent domain controllers favour incomplete replication and recovery." },
sources: [PURPLE_KNIGHT]
},
{
conditionId: 'ad-trust-configuration-weak', role: 'prerequisite', techniqueIds: [],
statement: { de: "Schwach konfigurierte Vertrauensstellungen begünstigen, dass eine Kompromittierung der vertrauten Domäne diese Domäne erfasst und die Wiederherstellung erschwert.", en: "Weakly configured trusts favour a compromise of the trusted domain reaching this domain and complicating recovery." },
sources: [mitre('T1134.005', 'Access Token Manipulation: SID-History Injection'), PURPLE_KNIGHT]
},
{
conditionId: 'ad-explicit-certificate-mapping', role: 'prerequisite', techniqueIds: [],
statement: { de: "Explizite Zertifikatszuordnungen begünstigen, dass ein fremdes Zertifikat zur Anmeldung als dieses Konto dient.", en: "Explicit certificate mappings favour a foreign certificate serving to sign in as that account." },
sources: [T1649, PURPLE_KNIGHT]
},
{
conditionId: 'gpo-dangerous-execution-paths', role: 'prerequisite', techniqueIds: [],
statement: { de: "Beschreibbare Ziele in GPOs begünstigen, dass fremder Code bei der Anmeldung auf vielen Hosts ausgeführt wird.", en: "Writable targets in GPOs favour foreign code running on many hosts at sign-in." },
sources: [mitre('T1484.001', 'Domain or Tenant Policy Modification: Group Policy Modification'), PURPLE_KNIGHT]
},
{
conditionId: 'weak-certificate-cipher', role: 'prerequisite', techniqueIds: [],
statement: { de: "Schwache Zertifikatsverfahren begünstigen gefälschte oder abgefangene gesicherte Verbindungen.", en: "Weak certificate ciphers favour forged or intercepted secured connections." },
sources: [T1557, PURPLE_KNIGHT]
},
{
conditionId: 'entra-app-creation-unrestricted', role: 'prerequisite', techniqueIds: [],
statement: { de: "Uneingeschränkte Anwendungsregistrierung begünstigt dauerhafte Zugänge über eigene Anwendungen und deren Anmeldedaten.", en: "Unrestricted application registration favours lasting access through own applications and their credentials." },
sources: [T1098_001, SCUBA_AAD]
},
{
conditionId: 'entra-pim-controls-weak', role: 'prerequisite', techniqueIds: [],
statement: { de: "Fehlende PIM-Kontrollen begünstigen, dass privilegierte Rollen unbemerkt vergeben oder aktiviert werden.", en: "Missing PIM controls favour privileged roles being assigned or activated unnoticed." },
sources: [T1078_004, SCUBA_AAD]
},
{
conditionId: 'entra-password-expiry-enabled', role: 'prerequisite', techniqueIds: [],
statement: { de: "Erzwungener Kennwortwechsel begünstigt vorhersehbare, leichter zu erratende Kennwörter.", en: "Forced password changes favour predictable passwords that are easier to guess." },
sources: [SCUBA_AAD, CIS_M365]
},
{
conditionId: 'cis-password-policy-unmet', role: 'prerequisite', techniqueIds: [],
statement: { de: "Nicht erfüllte Kennwort- und Sperrempfehlungen begünstigen das Erraten und Knacken von Kennwörtern.", en: "Unmet password and lockout recommendations favour passwords being guessed and cracked." },
sources: [CIS_WINDOWS_SERVER, T1110_001]
},
{
conditionId: 'cis-anonymous-access-unmet', role: 'prerequisite', techniqueIds: [],
statement: { de: "Nicht erfüllte Empfehlungen zum anonymen Zugriff begünstigen das Auskundschaften von Konten und Freigaben ohne Anmeldung.", en: "Unmet anonymous access recommendations favour accounts and shares being explored without signing in." },
sources: [CIS_WINDOWS_SERVER, T1087_002]
},
{
conditionId: 'cis-local-privilege-hardening-unmet', role: 'prerequisite', techniqueIds: [],
statement: { de: "Nicht erfüllte UAC- und Systemobjekt-Empfehlungen begünstigen eine Rechteausweitung auf dem Host.", en: "Unmet UAC and system object recommendations favour privilege escalation on the host." },
sources: [CIS_WINDOWS_SERVER, T1548_002]
},
{
conditionId: 'gpo-powershell-logging-deviates', role: 'prerequisite', techniqueIds: [],
statement: { de: "Abweichende PowerShell-Protokollierung begünstigt, dass Skriptaktivität nicht aufgezeichnet wird.", en: "Deviating PowerShell logging favours script activity not being recorded." },
sources: [T1059, CIS_WINDOWS_SERVER]
},
{
conditionId: 'gpo-event-logging-deviates', role: 'prerequisite', techniqueIds: [],
statement: { de: "Abweichende Protokolleinstellungen begünstigen, dass Ereignisse fehlen oder überschrieben werden.", en: "Deviating log settings favour events missing or being overwritten." },
sources: [CIS_WINDOWS_SERVER]
},
{
conditionId: 'gpo-remote-desktop-deviates', role: 'prerequisite', techniqueIds: [],
statement: { de: "Abweichende Remotedesktop-Einstellungen begünstigen die Ausbreitung über RDP.", en: "Deviating Remote Desktop settings favour spreading over RDP." },
sources: [T1021_001]
},
{
conditionId: 'gpo-remote-management-deviates', role: 'prerequisite', techniqueIds: [],
statement: { de: "Abweichende WinRM-Einstellungen begünstigen die Ausbreitung über Windows-Remoteverwaltung.", en: "Deviating WinRM settings favour spreading over Windows Remote Management." },
sources: [T1021_006]
},
{
conditionId: 'gpo-smb-hardening-deviates', role: 'prerequisite', techniqueIds: [],
statement: { de: "Abweichende SMB-Härtung begünstigt das Abfangen und Weiterleiten von SMB-Anmeldungen.", en: "Deviating SMB hardening favours SMB authentications being intercepted and relayed." },
sources: [T1557_001, T1021_002]
},
{
conditionId: 'gpo-secure-channel-deviates', role: 'prerequisite', techniqueIds: [],
statement: { de: "Ein abweichend geschützter sicherer Kanal begünstigt das Abfangen oder Manipulieren von Domänenkommunikation.", en: "A deviatingly protected secure channel favours domain communication being intercepted or tampered with." },
sources: [T1557]
},
{
conditionId: 'gpo-ntlm-hardening-deviates', role: 'prerequisite', techniqueIds: [],
statement: { de: "Abweichende NTLM-Sitzungssicherheit begünstigt das Abfangen und Weiterleiten von NTLM-Anmeldungen.", en: "Deviating NTLM session security favours NTLM authentications being intercepted and relayed." },
sources: [T1557_001]
},
{
conditionId: 'gpo-anonymous-access-deviates', role: 'prerequisite', techniqueIds: [],
statement: { de: "Abweichende Einschränkungen anonymen Zugriffs begünstigen das Auskundschaften ohne Anmeldung.", en: "Deviating restrictions on anonymous access favour exploration without signing in." },
sources: [T1087_002]
},
{
conditionId: 'gpo-lm-hash-storage-deviates', role: 'prerequisite', techniqueIds: [],
statement: { de: "Abweichend gespeicherte LM-Hashes begünstigen, dass Kennwörter schnell geknackt werden.", en: "Deviatingly stored LM hashes favour passwords being cracked quickly." },
sources: [T1110_002]
},
{
conditionId: 'gpo-kerberos-encryption-deviates', role: 'prerequisite', techniqueIds: [],
statement: { de: "Abweichende Kerberos-Verschlüsselungstypen begünstigen, dass Tickets mit schwachen Verfahren offline geknackt werden.", en: "Deviating Kerberos encryption types favour tickets with weak ciphers being cracked offline." },
sources: [T1558_003]
},
{
conditionId: 'gpo-local-privilege-hardening-deviates', role: 'prerequisite', techniqueIds: [],
statement: { de: "Abweichende UAC- und Installationseinstellungen begünstigen eine Rechteausweitung auf dem Host.", en: "Deviating UAC and installation settings favour privilege escalation on the host." },
sources: [T1548_002]
},
{
conditionId: 'gpo-credential-protection-deviates', role: 'prerequisite', techniqueIds: [],
statement: { de: "Abweichender Schutz von Anmeldedaten begünstigt, dass sie aus dem Speicher oder Cache eines Hosts gewonnen werden.", en: "Deviating credential protection favours credentials being recovered from a host's memory or cache." },
sources: [T1003, REMOTE_CREDENTIAL_GUARD]
},
{
conditionId: 'gpo-print-hardening-deviates', role: 'prerequisite', techniqueIds: [],
statement: { de: "Abweichende Druckerhärtung begünstigt, dass der Druckdienst für erzwungene Anmeldungen oder Treiber-Rechteausweitung genutzt wird.", en: "Deviating printer hardening favours the print service being used for coerced authentication or driver-based privilege escalation." },
sources: [T1187, T1068]
},
{
conditionId: 'gpo-malware-protection-deviates', role: 'prerequisite', techniqueIds: [],
statement: { de: "Abweichender Schadcodeschutz begünstigt, dass schädliche Dateien und Inhalte ausgeführt werden.", en: "Deviating malware protection favours malicious files and content being run." },
sources: [T1204_002]
},
{
conditionId: 'gpo-office-hardening-deviates', role: 'prerequisite', techniqueIds: [],
statement: { de: "Abweichende Office-Härtung begünstigt, dass schädliche Dokumente Code ausführen.", en: "Deviating Office hardening favours malicious documents running code." },
sources: [T1204_002, T1566]
},
{
conditionId: 'gpo-local-device-access-deviates', role: 'prerequisite', techniqueIds: [],
statement: { de: "Abweichender lokaler Geräteschutz begünstigt den Missbrauch physischen Zugangs zu Hosts.", en: "Deviating local device protection favours misuse of physical access to hosts." },
sources: [T1200]
},
{
conditionId: 'ad-tombstone-reanimation-right', role: 'prerequisite', techniqueIds: [],
statement: { de: "Das Recht, gelöschte Objekte wiederherzustellen, begünstigt die Rückkehr gelöschter privilegierter Konten.", en: "The right to restore deleted objects favours deleted privileged accounts returning." },
sources: [T1098, PURPLE_KNIGHT]
},
{
conditionId: 'ad-sdprop-protection-inconsistent', role: 'prerequisite', techniqueIds: [],
statement: { de: "Ein uneinheitlicher SDProp-Schutz begünstigt, dass abweichende Rechte an privilegierten Objekten bestehen bleiben.", en: "Inconsistent SDProp protection favours deviating rights on privileged objects persisting." },
sources: [T1098, PURPLE_KNIGHT]
},
{
conditionId: 'dcom-perflog-groups-populated', role: 'prerequisite', techniqueIds: [],
statement: { de: "Mitglieder dieser Gruppen begünstigen die Ausführung über DCOM auf entfernten Hosts.", en: "Members of these groups favour execution over DCOM on remote hosts." },
sources: [mitre('T1021.003', 'Remote Services: Distributed Component Object Model'), PURPLE_KNIGHT]
},
{
conditionId: 'entra-ca-groups-unprotected', role: 'prerequisite', techniqueIds: [],
statement: { de: "Ungeschützte Gruppen in Conditional Access begünstigen, dass Richtlinienausnahmen über Gruppenmitgliedschaft entstehen.", en: "Unprotected groups in Conditional Access favour policy exclusions arising through group membership." },
sources: [maesterTest('MT.1035')]
},
{
conditionId: 'uncatalogued-deviations-gpo', role: 'prerequisite', techniqueIds: [],
statement: { de: "Eine noch nicht zugeordnete GPO-Abweichung begünstigt ein Risiko, das hier sichtbar bleibt, bis es katalogisiert ist.", en: "A GPO deviation that is not yet assigned favours a risk that stays visible here until it is catalogued." },
sources: [{ title: 'Microsoft Security Compliance Toolkit', url: 'https://learn.microsoft.com/en-us/windows/security/operating-system-security/device-management/windows-security-configuration-framework/security-compliance-toolkit-10', publisher: 'Microsoft' }]
}
],
clusters: [{
id: 'credential-relay-exposure',
label: { de: 'Credential Relay Exposure', en: 'Credential Relay Exposure' },
description: {
de: 'Mehrere deklarierte Einstellungen begünstigen denselben Angriffsweg: NTLM-Anmeldungen abgreifen und an SMB- oder LDAP-Dienste weiterleiten. Das ist kein Nachweis, dass ein Angriff möglich ist oder stattfand.',
en: 'Several declared settings favour the same attack path: capturing NTLM authentications and relaying them to SMB or LDAP services. This is not proof that an attack is possible or took place.'
},
conditionIds: [
'llmnr-not-turned-off', 'ntlm-legacy-responses-sent', 'smb-server-signing-not-required',
'smb-client-signing-not-required', 'ldap-server-signing-not-required', 'ldap-client-signing-none',
'ldap-channel-binding-not-always', 'ad-dc-spooler-coercion', 'adcs-web-enrollment-esc8',
'mdns-not-disabled', 'netbios-not-disabled', 'wpad-not-disabled',
'hardened-unc-paths-weakened', 'hardened-unc-paths-not-configured', 'smb-insecure-guest-logons', 'dns-nonsecure-dynamic-updates'
,
'lm-auth-level-below-refuse-lm-ntlm', 'ldap-signing-enforcement-off', 'adidns-authenticated-create', 'dc-ldaps-legacy-tls', 'weak-trusted-root-certificate', 'cis-smb-hardening-unmet', 'cis-name-resolution-unmet', 'cis-authentication-hardening-unmet', 'cis-print-hardening-unmet', 'gpo-dns-client-policy-deviates',
'weak-certificate-cipher', 'gpo-smb-hardening-deviates', 'gpo-secure-channel-deviates', 'gpo-ntlm-hardening-deviates', 'gpo-print-hardening-deviates'],
minimumSatisfied: 2,
sources: [T1557_001, T1187]
},
{
id: 'cloud-privileged-access-exposure',
label: { de: 'Cloud Privileged Access Exposure', en: 'Cloud Privileged Access Exposure' },
description: {
de: 'Mehrere beobachtete Befunde begünstigen denselben Weg: die Übernahme und dauerhafte Nutzung privilegierter Entra-Konten. Das ist kein Nachweis, dass ein Angriff möglich ist oder stattfand.',
en: 'Several observed findings favour the same path: taking over and lastingly using privileged Entra accounts. This is not proof that an attack is possible or took place.'
},
conditionIds: ['entra-permanent-privileged-assignments', 'entra-external-user-privileged-role', 'entra-client-secret-privileged-role',
'entra-admins-not-cloud-only', 'entra-privileged-mfa-not-phishing-resistant', 'entra-admin-mfa-not-required',
'entra-global-admin-overused', 'entra-privileged-user-mailbox', 'entra-admin-managed-device-not-required', 'azure-root-permanent-access',
'entra-global-admin-count-outside-range', 'entra-emergency-access-not-excluded', 'entra-eligible-roles-unused', 'entra-privileged-unusual-signin', 'entra-privileged-accounts-inactive', 'azure-management-group-creation-open',
'entra-pim-controls-weak', 'entra-ca-groups-unprotected'],
minimumSatisfied: 2,
sources: [SCUBA_AAD, T1078_004]
},
{
id: 'cloud-sign-in-protection-gaps',
label: { de: 'Cloud Sign-in Protection Gaps', en: 'Cloud Sign-in Protection Gaps' },
description: {
de: 'Mehrere beobachtete Befunde begünstigen denselben Weg: die Anmeldung mit erratenen, gestohlenen oder abgefangenen Zugangsdaten. Das ist kein Nachweis, dass ein Angriff möglich ist oder stattfand.',
en: 'Several observed findings favour the same path: signing in with guessed, stolen or intercepted credentials. This is not proof that an attack is possible or took place.'
},
conditionIds: ['entra-legacy-auth-not-blocked', 'entra-high-risk-signins-not-blocked', 'entra-signin-risk-not-covered',
'entra-mfa-not-phishing-resistant', 'entra-weak-mfa-methods-enabled', 'entra-password-protection-not-enforced', 'entra-smart-lockout-weak',
'entra-user-risk-not-covered', 'entra-mfa-registration-incomplete', 'entra-managed-device-not-required', 'entra-mfa-registration-unrestricted', 'entra-mfa-fatigue-protection-weak', 'entra-unmanaged-sessions-persistent',
'entra-ca-policy-integrity-gaps', 'entra-ca-coverage-gaps', 'entra-fido2-restrictions-off', 'entra-authenticator-otp-allowed', 'intune-device-compliance-gaps',
'entra-password-expiry-enabled'],
minimumSatisfied: 2,
sources: [SCUBA_AAD, T1110_003, T1078_004]
},
{
id: 'ad-privileged-account-exposure',
label: { de: 'AD Privileged Account Exposure', en: 'AD Privileged Account Exposure' },
description: {
de: 'Mehrere beobachtete Befunde begünstigen denselben Weg: das Abgreifen und Wiederverwenden von Anmeldedaten privilegierter AD-Konten. Das ist kein Nachweis, dass ein Angriff möglich ist oder stattfand.',
en: 'Several observed findings favour the same path: capturing and reusing credentials of privileged AD accounts. This is not proof that an attack is possible or took place.'
},
conditionIds: ['ad-admins-delegatable', 'ad-admins-not-protected-users', 'ad-builtin-admin-used', 'ad-privileged-spn', 'ad-shadow-credentials-privileged',
'dnsadmins-unprivileged-members', 'schema-admins-not-empty',
'dsheuristics-ldap-mitigation-off', 'cis-domain-controller-options-unmet',
'ad-dangerous-acl-delegation', 'rodc-credential-caching-risky', 'gpo-link-delegation-broad', 'ad-privileged-membership-hygiene'],
minimumSatisfied: 2,
sources: [PROTECTED_USERS, T1078_002, T1558_003]
},
{
id: 'kerberos-delegation-abuse',
label: { de: 'Kerberos Delegation Abuse', en: 'Kerberos Delegation Abuse' },
description: {
de: 'Mehrere beobachtete Befunde begünstigen denselben Weg: Kerberos-Delegation zu missbrauchen, um sich als andere Nutzer auszugeben. Das ist kein Nachweis, dass ein Angriff möglich ist oder stattfand.',
en: 'Several observed findings favour the same path: abusing Kerberos delegation to impersonate other users. This is not proof that an attack is possible or took place.'
},
conditionIds: ['ad-rbcd-write-on-dc', 'ad-rbcd-write-on-krbtgt', 'ad-rbcd-on-dc-or-krbtgt', 'ad-delegation-to-dc-or-krbtgt',
'ad-unconstrained-delegation', 'ad-rbcd-computer-takeover', 'ad-admins-delegatable', 'ad-users-can-add-computers', 'gpo-delegation-right-deviates',
'ad-constrained-delegation-risky'],
minimumSatisfied: 2,
sources: [KCD_OVERVIEW]
},
{
id: 'adcs-escalation',
label: { de: 'AD CS Escalation', en: 'AD CS Escalation' },
description: {
de: 'Mehrere beobachtete Befunde begünstigen denselben Weg: über Active Directory Certificate Services Zertifikate im Namen anderer Konten zu erhalten. Das ist kein Nachweis, dass ein Angriff möglich ist oder stattfand.',
en: 'Several observed findings favour the same path: obtaining certificates in the name of other accounts through Active Directory Certificate Services. This is not proof that an attack is possible or took place.'
},
conditionIds: ['adcs-template-requester-san', 'adcs-template-insecure-config', 'adcs-dangerous-control-paths', 'adcs-web-enrollment-esc8',
'ad-explicit-certificate-mapping'],
minimumSatisfied: 2,
sources: [T1649]
},
{
id: 'kerberoasting-exposure',
label: { de: 'Kerberoasting Exposure', en: 'Kerberoasting Exposure' },
description: {
de: 'Mehrere beobachtete Befunde begünstigen denselben Weg: Service-Tickets anzufordern, offline zu knacken und die Passwörter dauerhaft zu nutzen. Das ist kein Nachweis, dass ein Angriff möglich ist oder stattfand.',
en: 'Several observed findings favour the same path: requesting service tickets, cracking them offline and using the passwords lastingly. This is not proof that an attack is possible or took place.'
},
conditionIds: ['ad-privileged-spn', 'ad-spn-without-aes', 'ad-rc4-des-on-dcs', 'ad-privileged-password-never-expires', 'ad-password-never-expires',
'ad-service-accounts-no-strong-policy', 'kerberos-rc4-des-allowed',
'domain-admins-password-never-expires', 'gmsa-not-used',
'ad-asrep-roastable', 'ad-user-spn', 'gpo-kerberos-encryption-deviates'],
minimumSatisfied: 2,
sources: [T1558_003]
},
{
id: 'lateral-movement-exposure',
label: { de: 'Lateral Movement Exposure', en: 'Lateral Movement Exposure' },
description: {
de: 'Mehrere beobachtete Befunde begünstigen denselben Weg: sich mit gültigen Anmeldedaten über Remote-Dienste im Netz auszubreiten. Das ist kein Nachweis, dass ein Angriff möglich ist oder stattfand.',
en: 'Several observed findings favour the same path: spreading through the network over remote services with valid credentials. This is not proof that an attack is possible or took place.'
},
conditionIds: ['rdp-without-nla', 'winrm-basic-auth', 'winrm-unencrypted', 'winrm-remote-management-allowed', 'smbv1-enabled', 'host-firewall-off', 'host-firewall-inbound-allowed', 'network-logon-rights-broad',
'laps-not-deployed', 'ad-smartcard-password-rotation-disabled', 'rdp-sessions-not-timed-out', 'terminal-services-gpo-incomplete', 'rdp-connection-security-weak',
'cis-remote-desktop-unmet', 'cis-remote-management-unmet', 'cis-firewall-profile-unmet', 'cis-network-stack-unmet', 'gpo-network-logon-right-deviates', 'gpo-firewall-profile-deviates',
'gpo-remote-desktop-deviates', 'gpo-remote-management-deviates', 'dcom-perflog-groups-populated'],
minimumSatisfied: 2,
sources: [T1021]
},
{
id: 'host-credential-privilege-exposure',
label: { de: 'Host Credential & Privilege Exposure', en: 'Host Credential & Privilege Exposure' },
description: {
de: 'Mehrere beobachtete Befunde begünstigen denselben Weg: auf einem Host Anmeldedaten abzugreifen oder Rechte zu erhöhen. Das ist kein Nachweis, dass ein Angriff möglich ist oder stattfand.',
en: 'Several observed findings favour the same path: capturing credentials on a host or raising privileges there. This is not proof that an attack is possible or took place.'
},
conditionIds: ['network-credentials-stored', 'lsass-custom-ssp-allowed', 'winrm-runas-credentials-stored', 'uac-weak',
'dangerous-user-rights-granted', 'rdp-passwords-saved', 'always-install-elevated', 'remote-credential-delegation-unprotected',
'autoadminlogon-not-disabled', 'cis-print-hardening-unmet', 'cis-user-rights-unmet', 'cis-credential-handling-unmet', 'gpo-privileged-rights-deviate', 'gpo-office-forms-auth-hosts-deviate',
'cis-local-privilege-hardening-unmet', 'gpo-local-privilege-hardening-deviates', 'gpo-credential-protection-deviates'],
minimumSatisfied: 2,
sources: [T1555_004, T1547_005, T1548_002]
},
{
id: 'detection-blind-spots',
label: { de: 'Detection Blind Spots', en: 'Detection Blind Spots' },
description: {
de: 'Mehrere beobachtete Befunde begünstigen denselben Weg: Aktivitäten auszuführen, ohne dass sie aufgezeichnet werden. Das ist kein Nachweis, dass ein Angriff möglich ist oder stattfand.',
en: 'Several observed findings favour the same path: carrying out activity without it being recorded. This is not proof that an attack is possible or took place.'
},
conditionIds: ['powershell-logging-off', 'dc-audit-incomplete',
'host-audit-policy-incomplete', 'process-creation-not-logged', 'security-event-log-small', 'ntlm-usage-not-audited', 'firewall-logging-off', 'identity-threat-detection-missing', 'cloud-security-logs-not-forwarded', 'entra-privileged-role-alerts-missing',
'entra-leaked-credential-detection-limited', 'cis-audit-policy-unmet', 'cis-event-log-unmet', 'gpo-audit-policy-deviates', 'gpo-firewall-logging-deviates',
'ad-default-container-redirected',
'gpo-powershell-logging-deviates', 'gpo-event-logging-deviates'],
minimumSatisfied: 2,
sources: [CIS_WINDOWS_SERVER, PINGCASTLE_RULES]
},
{
id: 'password-guessing-exposure',
label: { de: 'Password Guessing Exposure', en: 'Password Guessing Exposure' },
description: {
de: 'Mehrere deklarierte Einstellungen oder beobachtete Befunde begünstigen denselben Weg: Kennwörter von AD-Konten zu erraten oder zu knacken. Das ist kein Nachweis, dass ein Angriff möglich ist oder stattfand.',
en: 'Several declared settings or observed findings favour the same path: guessing or cracking the passwords of AD accounts. This is not proof that an attack is possible or took place.'
},
conditionIds: ['password-length-below-14', 'password-length-below-8', 'password-complexity-off', 'account-lockout-threshold-weak',
'account-lockout-duration-short', 'ad-privileged-weak-password-policy', 'ad-service-accounts-no-strong-policy',
'ad-password-never-expires', 'ad-privileged-password-never-expires', 'kerberos-armoring-off',
'domain-admins-password-never-expires', 'cis-builtin-accounts-unmet', 'cis-account-database-unmet', 'gpo-lockout-timing-deviates', 'gpo-password-lifetime-deviates', 'gpo-reversible-password-storage-deviates',
'ad-passwords-old', 'ad-password-not-required', 'ad-recoverable-passwords', 'cis-password-policy-unmet', 'gpo-lm-hash-storage-deviates'],
minimumSatisfied: 2,
sources: [T1110_001, T1110_002]
},
{
id: 'malicious-code-execution-exposure',
label: { de: 'Malicious Code Execution Exposure', en: 'Malicious Code Execution Exposure' },
description: {
de: "Mehrere deklarierte Einstellungen oder beobachtete Befunde begünstigen denselben Weg: schädliche Dateien, Skripte oder Wechselmedien auf Hosts auszuführen. Das ist kein Nachweis, dass ein Angriff möglich ist oder stattfand.",
en: "Several declared settings or observed findings favour the same path: running malicious files, scripts or removable media on hosts. This is not proof that an attack is possible or took place."
},
conditionIds: ['defender-asr-not-enforced', 'defender-protection-weakened', 'web-protection-off', 'mark-of-the-web-suppressed', 'autorun-enabled', 'script-files-run-on-double-click', 'script-engines-reach-internet',
'cis-defender-unmet', 'cis-software-installation-unmet', 'cis-exploit-mitigations-unmet', 'gpo-application-control-deviates',
'gpo-dangerous-execution-paths', 'gpo-malware-protection-deviates', 'gpo-office-hardening-deviates'],
minimumSatisfied: 2,
sources: [T1204_002, T1059]
},
{
id: 'ad-persistence-indicators',
label: { de: 'AD Persistence Indicators', en: 'AD Persistence Indicators' },
description: {
de: "Mehrere deklarierte Einstellungen oder beobachtete Befunde begünstigen denselben Weg: dauerhafte, unbemerkte Rechte an geschützten AD-Konten zu behalten. Das ist kein Nachweis, dass ein Angriff möglich ist oder stattfand.",
en: "Several declared settings or observed findings favour the same path: keeping lasting, unnoticed rights on protected AD accounts. This is not proof that an attack is possible or took place."
},
conditionIds: ['adminsdholder-permissions-changed', 'ad-stale-admincount',
'ad-dcshadow-evidence', 'ad-primary-group-anomaly', 'krbtgt-password-old', 'ad-sidhistory-abuse', 'ad-recent-sensitive-changes', 'ad-tombstone-reanimation-right', 'ad-sdprop-protection-inconsistent'],
minimumSatisfied: 2,
sources: [T1098]
},
{
id: 'ad-reconnaissance-exposure',
label: { de: 'AD Reconnaissance Exposure', en: 'AD Reconnaissance Exposure' },
description: {
de: "Mehrere deklarierte Einstellungen oder beobachtete Befunde begünstigen denselben Weg: Active Directory ohne oder mit geringen Rechten zu erkunden. Das ist kein Nachweis, dass ein Angriff möglich ist oder stattfand.",
en: "Several declared settings or observed findings favour the same path: exploring Active Directory without or with minimal rights. This is not proof that an attack is possible or took place."
},
conditionIds: ['anonymous-ldap-bind', 'anonymous-directory-access', 'anonymous-nspi-access', 'prewin2000-access-broad', 'prewin2000-membership-changed', 'net-session-enumeration-open', 'anonymous-named-pipes', 'guest-account-enabled',
'cis-anonymous-access-unmet', 'gpo-anonymous-access-deviates'],
minimumSatisfied: 2,
sources: [T1087_002]
},
{
id: 'ad-recovery-gaps',
label: { de: 'AD Recovery Gaps', en: 'AD Recovery Gaps' },
description: {
de: "Mehrere deklarierte Einstellungen oder beobachtete Befunde begünstigen denselben Weg: eine lange oder unvollständige Wiederherstellung nach Löschung oder Zerstörung. Das ist kein Nachweis, dass ein Angriff möglich ist oder stattfand.",
en: "Several declared settings or observed findings favour the same path: a long or incomplete recovery after deletion or destruction. This is not proof that an attack is possible or took place."
},
conditionIds: ['ad-backup-outdated', 'ad-recycle-bin-disabled', 'ou-deletion-unprotected', 'dc-redundancy-missing',
'dc-subnet-declaration-incomplete',
'dc-health-inconsistent', 'ad-trust-configuration-weak'],
minimumSatisfied: 2,
sources: [T1490, T1485]
},
{
id: 'cloud-app-consent-exposure',
label: { de: 'Cloud App Consent Exposure', en: 'Cloud App Consent Exposure' },
description: {
de: "Mehrere deklarierte Einstellungen oder beobachtete Befunde begünstigen denselben Weg: über zugestimmte oder vergessene Anwendungen dauerhaften Zugriff auf Tenant-Daten zu erhalten. Das ist kein Nachweis, dass ein Angriff möglich ist oder stattfand.",
en: "Several declared settings or observed findings favour the same path: gaining lasting access to tenant data through consented or forgotten applications. This is not proof that an attack is possible or took place."
},
conditionIds: ['entra-users-can-consent-apps', 'entra-users-consent-risky-apps', 'entra-app-credentials-stale',
'entra-admin-consent-workflow-missing', 'entra-app-credentials-expiring',
'entra-app-creation-unrestricted'],
minimumSatisfied: 2,
sources: [T1528, T1098_001]
},
{
id: 'cloud-external-access-exposure',
label: { de: 'Cloud External Access Exposure', en: 'Cloud External Access Exposure' },
description: {
de: "Mehrere deklarierte Einstellungen oder beobachtete Befunde begünstigen denselben Weg: externen Identitäten ohne Kontrolle Zugang zum Tenant und seinen Daten zu verschaffen. Das ist kein Nachweis, dass ein Angriff möglich ist oder stattfand.",
en: "Several declared settings or observed findings favour the same path: giving external identities uncontrolled access to the tenant and its data. This is not proof that an attack is possible or took place."
},
conditionIds: ['entra-guest-invites-unrestricted', 'entra-guest-invite-domains-unrestricted', 'entra-self-service-signup-allowed', 'entra-guest-directory-access-broad', 'sharepoint-external-sharing-broad', 'teams-auto-admit-broad',
'm365-public-groups-unmanaged'],
minimumSatisfied: 2,
sources: [T1078_004, SCUBA_AAD]
},
{
id: 'data-sharing-exposure',
label: { de: 'Data Sharing & Privacy Exposure', en: 'Data Sharing & Privacy Exposure' },
description: {
de: "Mehrere deklarierte Einstellungen oder beobachtete Befunde begünstigen denselben Weg: Daten vom Host an externe Dienste gelangen zu lassen. Das ist kein Nachweis, dass ein Angriff möglich ist oder stattfand.",
en: "Several declared settings or observed findings favour the same path: data leaving hosts for external services. This is not proof that an attack is possible or took place."
},
conditionIds: ['cis-telemetry-unmet', 'cis-cloud-sync-unmet', 'cis-internet-communication-unmet'],
minimumSatisfied: 2,
sources: [CIS_WINDOWS_SERVER]
},
{
id: 'physical-local-access-exposure',
label: { de: 'Physical & Local Access Exposure', en: 'Physical & Local Access Exposure' },
description: {
de: "Mehrere deklarierte Einstellungen oder beobachtete Befunde begünstigen denselben Weg: lokalen oder physischen Zugang zu Hosts zu missbrauchen. Das ist kein Nachweis, dass ein Angriff möglich ist oder stattfand.",
en: "Several declared settings or observed findings favour the same path: misusing local or physical access to hosts. This is not proof that an attack is possible or took place."
},
conditionIds: ['cis-sign-in-screen-unmet', 'cis-device-access-unmet', 'gpo-local-logon-right-deviates', 'gpo-logon-hours-enforcement-deviates',
'gpo-convenience-pin-sign-in-deviates',
'gpo-local-device-access-deviates'],
minimumSatisfied: 2,
sources: [T1200, CIS_WINDOWS_SERVER]
},
{
id: 'patch-configuration-drift',
label: { de: 'Patch & Configuration Drift', en: 'Patch & Configuration Drift' },
description: {
de: "Mehrere deklarierte Einstellungen oder beobachtete Befunde begünstigen denselben Weg: bekannte Schwachstellen und abweichende Einstellungen länger bestehen zu lassen. Das ist kein Nachweis, dass ein Angriff möglich ist oder stattfand.",
en: "Several declared settings or observed findings favour the same path: known vulnerabilities and drifted settings persisting longer. This is not proof that an attack is possible or took place."
},
conditionIds: ['cis-windows-update-unmet', 'cis-policy-processing-unmet', 'cis-time-sync-unmet',
'ad-obsolete-components'],
minimumSatisfied: 2,
sources: [T1210, CIS_WINDOWS_SERVER]
},
{
id: 'email-spoofing-phishing-exposure',
label: { de: 'Email Spoofing & Phishing Exposure', en: 'Email Spoofing & Phishing Exposure' },
description: {
de: "Mehrere deklarierte Einstellungen oder beobachtete Befunde begünstigen denselben Weg: gefälschte oder schädliche E-Mails zuzustellen oder Daten per Weiterleitung abfließen zu lassen. Das ist kein Nachweis, dass ein Angriff möglich ist oder stattfand.",
en: "Several declared settings or observed findings favour the same path: delivering spoofed or malicious mail or letting data leave through forwarding. This is not proof that an attack is possible or took place."
},
conditionIds: ['email-sender-authentication-incomplete', 'email-threat-protection-weak', 'email-external-forwarding-allowed'],
minimumSatisfied: 2,
sources: [T1566, EMAIL_AUTHENTICATION, SCUBA_EXO, SCUBA_DEFENDER]
},
{
id: 'other-deviations',
label: { de: 'Other Deviations (not yet catalogued)', en: 'Other Deviations (not yet catalogued)' },
description: {
de: 'Abweichungen, die der Katalog noch keinem Angriffsweg zuordnet. Jede gemeldete Abweichung ist ein Befund und bleibt hier sichtbar, bis sie katalogisiert ist.',
en: 'Deviations the catalogue does not yet assign to an attack path. Every reported deviation is a finding and stays visible here until it is catalogued.'
},
conditionIds: ['uncatalogued-deviations-pingcastle', 'uncatalogued-deviations-purple-knight', 'uncatalogued-deviations-cis-cat', 'uncatalogued-deviations-maester', 'uncatalogued-deviations-gpo'],
minimumSatisfied: 2,
sources: [PINGCASTLE_RULES, PURPLE_KNIGHT, CIS_WINDOWS_SERVER]
}],
scannerRules: [
{ tool: 'pingcastle', ruleId: 'S-OldNtlm', conditionId: 'ntlm-legacy-responses-sent', polarity: 'fail-means-met',
ruleText: 'The LAN Manager Authentication Level allows the use of NTLMv1 or LM.', sources: [PINGCASTLE_RULES] },
{ tool: 'pingcastle', ruleId: 'A-NoGPOLLMNR', conditionId: 'llmnr-not-turned-off', polarity: 'fail-means-met',
ruleText: 'No GPO has been found which disables LLMNR or at least one GPO does enable it explicitly', sources: [PINGCASTLE_RULES] },
{ tool: 'purple-knight', ruleId: 'SI000154', conditionId: 'smb-server-signing-not-required', polarity: 'fail-means-met',
ruleText: 'SMB Signing is not required on Domain Controllers', sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000153', conditionId: 'ldap-server-signing-not-required', polarity: 'fail-means-met',
ruleText: 'LDAP signing is not required on Domain Controllers', sources: [PURPLE_KNIGHT] },
{ tool: 'cis-cat', ruleId: '2.3.9.2', conditionId: 'smb-server-signing-not-required', polarity: 'fail-means-met',
ruleText: "Ensure 'Microsoft network server: Digitally sign communications (always)' is set to 'Enabled'",
requiredTitleFragment: "'Microsoft network server: Digitally sign communications (always)'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '2.3.8.1', conditionId: 'smb-client-signing-not-required', polarity: 'fail-means-met',
ruleText: "Ensure 'Microsoft network client: Digitally sign communications (always)' is set to 'Enabled'",
requiredTitleFragment: "'Microsoft network client: Digitally sign communications (always)'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '2.3.11.8', conditionId: 'ldap-client-signing-none', polarity: 'fail-means-met',
ruleText: "Ensure 'Network security: LDAP client signing requirements' is set to 'Negotiate signing' or higher",
requiredTitleFragment: "'Network security: LDAP client signing requirements'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '2.3.5.3', conditionId: 'ldap-channel-binding-not-always', polarity: 'fail-means-met',
ruleText: "Ensure 'Domain controller: LDAP server channel binding token requirements' is set to 'Always' (DC Only)",
requiredTitleFragment: "'Domain controller: LDAP server channel binding token requirements'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.6.4.4', conditionId: 'llmnr-not-turned-off', polarity: 'fail-means-met',
ruleText: "Ensure 'Turn off multicast name resolution' is set to 'Enabled'",
requiredTitleFragment: "'Turn off multicast name resolution'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'maester', ruleId: 'CISA.MS.AAD.7.4', conditionId: 'entra-permanent-privileged-assignments', polarity: 'fail-means-met',
ruleText: 'Permanent active role assignments SHALL NOT be allowed for highly privileged roles.', sources: [SCUBA_AAD] },
{ tool: 'maester', ruleId: 'MT.1025', conditionId: 'entra-external-user-privileged-role', polarity: 'fail-means-met',
ruleText: 'No external user with permanent role assignment on Control Plane.', sources: [maesterTest('MT.1025')] },
{ tool: 'maester', ruleId: 'MT.1027', conditionId: 'entra-client-secret-privileged-role', polarity: 'fail-means-met',
ruleText: 'No Service Principal with Client Secret and permanent role assignment on Control Plane.', sources: [maesterTest('MT.1027')] },
{ tool: 'maester', ruleId: 'CISA.MS.AAD.7.3', conditionId: 'entra-admins-not-cloud-only', polarity: 'fail-means-met',
ruleText: 'Privileged users SHALL be provisioned cloud-only accounts separate from an on-premises directory or other federated identity providers.', sources: [SCUBA_AAD] },
{ tool: 'maester', ruleId: 'CIS.M365.1.1.1', conditionId: 'entra-admins-not-cloud-only', polarity: 'fail-means-met',
ruleText: '(L1) Ensure Administrative accounts are cloud-only', sources: [CIS_M365] },
{ tool: 'maester', ruleId: 'CISA.MS.AAD.3.6', conditionId: 'entra-privileged-mfa-not-phishing-resistant', polarity: 'fail-means-met',
ruleText: 'Phishing-resistant MFA SHALL be required for highly privileged roles.', sources: [SCUBA_AAD] },
{ tool: 'maester', ruleId: 'MT.1024.adminMFAV2', conditionId: 'entra-admin-mfa-not-required', polarity: 'fail-means-met',
ruleText: 'Require multifactor authentication for administrative roles.', sources: [maesterTest('MT.1024')] },
{ tool: 'maester', ruleId: 'CISA.MS.AAD.1.1', conditionId: 'entra-legacy-auth-not-blocked', polarity: 'fail-means-met',
ruleText: 'Legacy authentication SHALL be blocked.', sources: [SCUBA_AAD] },
{ tool: 'maester', ruleId: 'MT.1024.blockLegacyAuthentication', conditionId: 'entra-legacy-auth-not-blocked', polarity: 'fail-means-met',
ruleText: 'Enable policy to block legacy authentication.', sources: [maesterTest('MT.1024')] },
{ tool: 'maester', ruleId: 'CISA.MS.AAD.2.3', conditionId: 'entra-high-risk-signins-not-blocked', polarity: 'fail-means-met',
ruleText: 'Sign-ins detected as high risk SHALL be blocked.', sources: [SCUBA_AAD] },
{ tool: 'maester', ruleId: 'MT.1012', conditionId: 'entra-signin-risk-not-covered', polarity: 'fail-means-met',
ruleText: 'At least one Conditional Access policy is configured to require MFA for risky sign-ins.', sources: [maesterTest('MT.1012')] },
{ tool: 'maester', ruleId: 'MT.1024.signinRiskPolicy', conditionId: 'entra-signin-risk-not-covered', polarity: 'fail-means-met',
ruleText: 'Protect all users with a sign-in risk policy.', sources: [maesterTest('MT.1024')] },
{ tool: 'maester', ruleId: 'CISA.MS.AAD.3.1', conditionId: 'entra-mfa-not-phishing-resistant', polarity: 'fail-means-met',
ruleText: 'Phishing-resistant MFA SHALL be enforced for all users.', sources: [SCUBA_AAD] },
{ tool: 'maester', ruleId: 'CISA.MS.AAD.3.5', conditionId: 'entra-weak-mfa-methods-enabled', polarity: 'fail-means-met',
ruleText: 'The authentication methods SMS, Voice Call, and Email One-Time Passcode (OTP) SHALL be disabled.', sources: [SCUBA_AAD] },
{ tool: 'pingcastle', ruleId: 'P-Delegated', conditionId: 'ad-admins-delegatable', polarity: 'fail-means-met',
ruleText: 'Presence of Admin accounts which do not have the flag "This account is sensitive and cannot be delegated"', sources: [PINGCASTLE_RULES] },
{ tool: 'pingcastle', ruleId: 'P-ProtectedUsers', conditionId: 'ad-admins-not-protected-users', polarity: 'fail-means-met',
ruleText: 'Number of admins not in Protected Users', sources: [PINGCASTLE_RULES] },
{ tool: 'purple-knight', ruleId: 'SI000020', conditionId: 'ad-admins-not-protected-users', polarity: 'fail-means-met',
ruleText: 'Protected Users group not in use', sources: [PURPLE_KNIGHT] },
{ tool: 'pingcastle', ruleId: 'P-AdminLogin', conditionId: 'ad-builtin-admin-used', polarity: 'fail-means-met',
ruleText: 'The native administrator account has been used recently', sources: [PINGCASTLE_RULES] },
{ tool: 'purple-knight', ruleId: 'SI000028', conditionId: 'ad-builtin-admin-used', polarity: 'fail-means-met',
ruleText: 'Built-in domain Administrator account used within the last two weeks', sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000019', conditionId: 'ad-privileged-spn', polarity: 'fail-means-met',
ruleText: 'Privileged users with SPN defined', sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000077', conditionId: 'ad-dc-spooler-coercion', polarity: 'fail-means-met',
ruleText: 'Print spooler service is enabled on a DC', sources: [] },
{ tool: 'pingcastle', ruleId: 'A-DC-Spooler', conditionId: 'ad-dc-spooler-coercion', polarity: 'fail-means-met',
ruleText: 'The spooler service is remotely accessible from a DC', sources: [] },
{ tool: 'purple-knight', ruleId: 'SI000095', conditionId: 'adcs-web-enrollment-esc8', polarity: 'fail-means-met',
ruleText: 'AD Certificate Authority with Web Enrollment - ESC8', sources: [] },
{ tool: 'purple-knight', ruleId: 'SI000157', conditionId: 'adcs-template-requester-san', polarity: 'fail-means-met',
ruleText: 'Certificate templates that allow requesters to specify a subjectAltName', sources: [] },
{ tool: 'pingcastle', ruleId: 'A-CertTempCustomSubject', conditionId: 'adcs-template-requester-san', polarity: 'fail-means-met',
ruleText: 'At least one certificate template used for authentication can have its subject modified when being used', sources: [] },
{ tool: 'purple-knight', ruleId: 'SI000156', conditionId: 'adcs-template-insecure-config', polarity: 'fail-means-met',
ruleText: 'Certificate templates with 3 or more insecure configurations', sources: [] },
{ tool: 'purple-knight', ruleId: 'SI000090', conditionId: 'adcs-dangerous-control-paths', polarity: 'fail-means-met',
ruleText: 'Dangerous control paths expose certificate templates', sources: [] },
{ tool: 'purple-knight', ruleId: 'SI000091', conditionId: 'adcs-dangerous-control-paths', polarity: 'fail-means-met',
ruleText: 'Dangerous control paths expose certificate containers', sources: [] },
{ tool: 'purple-knight', ruleId: 'SI000079', conditionId: 'ad-rbcd-write-on-dc', polarity: 'fail-means-met',
ruleText: 'Write access to RBCD on DC', sources: [] },
{ tool: 'purple-knight', ruleId: 'SI000080', conditionId: 'ad-rbcd-write-on-krbtgt', polarity: 'fail-means-met',
ruleText: 'Write access to RBCD on krbtgt account', sources: [] },
{ tool: 'purple-knight', ruleId: 'SI000066', conditionId: 'ad-rbcd-on-dc-or-krbtgt', polarity: 'fail-means-met',
ruleText: 'Domain Controllers with Resource-Based Constrained Delegation (RBCD) enabled', sources: [] },
{ tool: 'purple-knight', ruleId: 'SI000071', conditionId: 'ad-rbcd-on-dc-or-krbtgt', polarity: 'fail-means-met',
ruleText: 'krbtgt account with Resource-Based Constrained Delegation (RBCD) enabled', sources: [] },
{ tool: 'purple-knight', ruleId: 'SI000070', conditionId: 'ad-delegation-to-dc-or-krbtgt', polarity: 'fail-means-met',
ruleText: 'Principals with constrained authentication delegation enabled for a DC service', sources: [] },
{ tool: 'purple-knight', ruleId: 'SI000065', conditionId: 'ad-delegation-to-dc-or-krbtgt', polarity: 'fail-means-met',
ruleText: 'Principals with constrained delegation using protocol transition enabled for a DC service', sources: [] },
{ tool: 'purple-knight', ruleId: 'SI000099', conditionId: 'ad-delegation-to-dc-or-krbtgt', polarity: 'fail-means-met',
ruleText: 'Accounts with Constrained Delegation configured to krbtgt', sources: [] },
{ tool: 'purple-knight', ruleId: 'SI000016', conditionId: 'ad-unconstrained-delegation', polarity: 'fail-means-met',
ruleText: 'Computer or user accounts with SPN that have unconstrained delegation', sources: [] },
{ tool: 'purple-knight', ruleId: 'SI000031', conditionId: 'ad-rbcd-computer-takeover', polarity: 'fail-means-met',
ruleText: 'Computer account takeover through Kerberos Resource-Based Constrained Delegation (RBCD)', sources: [] },
{ tool: 'purple-knight', ruleId: 'SI000152', conditionId: 'ad-spn-without-aes', polarity: 'fail-means-met',
ruleText: 'Primary users with SPN not supporting AES encryption on Kerberos', sources: [] },
{ tool: 'purple-knight', ruleId: 'SI000151', conditionId: 'ad-rc4-des-on-dcs', polarity: 'fail-means-met',
ruleText: 'RC4 or DES encryption type are supported by Domain Controllers', sources: [] },
{ tool: 'purple-knight', ruleId: 'SI000067', conditionId: 'ad-privileged-password-never-expires', polarity: 'fail-means-met',
ruleText: 'Privileged accounts with a password that never expires', sources: [] },
// Source: user-supplied Purple Knight SI000147 report (2026-10-02), not a tactic-only assignment.
// The report states disabled msDS-ExpirePasswordsOnSmartCardOnlyAccounts permits indefinite credentials
// and can favour persistent access and lateral movement. No effective compromise is asserted.
{ tool: 'purple-knight', ruleId: 'SI000147', conditionId: 'ad-smartcard-password-rotation-disabled', polarity: 'fail-means-met',
ruleText: 'Smart card password rotation disabled', sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000029', conditionId: 'ad-password-never-expires', polarity: 'fail-means-met',
ruleText: 'Users with Password Never Expires flag set', sources: [] },
{ tool: 'purple-knight', ruleId: 'SI000351', conditionId: 'ad-shadow-credentials-privileged', polarity: 'fail-means-met',
ruleText: 'Shadow Credentials on privileged objects', sources: [] },
{ tool: 'cis-cat', ruleId: '18.6.4.1', conditionId: 'mdns-not-disabled', polarity: 'fail-means-met',
ruleText: "Ensure 'Configure multicast DNS (mDNS) protocol' is set to 'Disabled'",
requiredTitleFragment: "'Configure multicast DNS (mDNS) protocol'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.6.4.2', conditionId: 'netbios-not-disabled', polarity: 'fail-means-met',
ruleText: "Ensure 'Configure NetBIOS settings' is set to 'Enabled: Disable NetBIOS name resolution on public networks'",
requiredTitleFragment: "'Configure NetBIOS settings'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.11.1', conditionId: 'wpad-not-disabled', polarity: 'fail-means-met',
ruleText: "Ensure 'Disable HTTP proxy features: Disable WPAD' is set to 'Enabled: Checked'",
requiredTitleFragment: "'Disable HTTP proxy features: Disable WPAD'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'purple-knight', ruleId: 'SI000011', conditionId: 'ad-users-can-add-computers', polarity: 'fail-means-met',
ruleText: 'Unprivileged users can add computer accounts to the domain', sources: [PURPLE_KNIGHT] },
{ tool: 'pingcastle', ruleId: 'S-ADRegistration', conditionId: 'ad-users-can-add-computers', polarity: 'fail-means-met',
ruleText: 'Non-admin users can add computers to a domain', sources: [PINGCASTLE_RULES] },
{ tool: 'cis-cat', ruleId: '18.10.57.3.9.4', conditionId: 'rdp-without-nla', polarity: 'fail-means-met',
ruleText: "Ensure 'Require user authentication for remote connections by using Network Level Authentication' is set to 'Enabled'",
requiredTitleFragment: "'Require user authentication for remote connections by using Network Level Authentication'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.10.90.1.1', conditionId: 'winrm-basic-auth', polarity: 'fail-means-met',
ruleText: "Ensure 'Allow Basic authentication' is set to 'Disabled' (WinRM Client)",
requiredTitleFragment: "'Allow Basic authentication'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.10.90.2.1', conditionId: 'winrm-basic-auth', polarity: 'fail-means-met',
ruleText: "Ensure 'Allow Basic authentication' is set to 'Disabled' (WinRM Service)",
requiredTitleFragment: "'Allow Basic authentication'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.10.90.1.2', conditionId: 'winrm-unencrypted', polarity: 'fail-means-met',
ruleText: "Ensure 'Allow unencrypted traffic' is set to 'Disabled' (WinRM Client)",
requiredTitleFragment: "'Allow unencrypted traffic'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.10.90.2.3', conditionId: 'winrm-unencrypted', polarity: 'fail-means-met',
ruleText: "Ensure 'Allow unencrypted traffic' is set to 'Disabled' (WinRM Service)",
requiredTitleFragment: "'Allow unencrypted traffic'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.10.90.2.2', conditionId: 'winrm-remote-management-allowed', polarity: 'fail-means-met',
ruleText: "Ensure 'Allow remote server management through WinRM' is set to 'Disabled'",
requiredTitleFragment: "'Allow remote server management through WinRM'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.4.2', conditionId: 'smbv1-enabled', polarity: 'fail-means-met',
ruleText: "Ensure 'Configure SMB v1 client driver' is set to 'Enabled: Disable driver (recommended)'",
requiredTitleFragment: "'Configure SMB v1 client driver'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.4.3', conditionId: 'smbv1-enabled', polarity: 'fail-means-met',
ruleText: "Ensure 'Configure SMB v1 server' is set to 'Disabled'",
requiredTitleFragment: "'Configure SMB v1 server'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'purple-knight', ruleId: 'SI000155', conditionId: 'smbv1-enabled', polarity: 'fail-means-met',
ruleText: 'SMBv1 is enabled on Domain Controllers', sources: [PURPLE_KNIGHT] },
{ tool: 'pingcastle', ruleId: 'S-SMB-v1', conditionId: 'smbv1-enabled', polarity: 'fail-means-met',
ruleText: 'DC vulnerability (SMB v1)', sources: [PINGCASTLE_RULES] },
{ tool: 'cis-cat', ruleId: '9.1.1', conditionId: 'host-firewall-off', polarity: 'fail-means-met',
ruleText: "Ensure 'Windows Firewall: Domain: Firewall state' is set to 'On (recommended)'",
requiredTitleFragment: "'Windows Firewall: Domain: Firewall state'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '9.2.1', conditionId: 'host-firewall-off', polarity: 'fail-means-met',
ruleText: "Ensure 'Windows Firewall: Private: Firewall state' is set to 'On (recommended)'",
requiredTitleFragment: "'Windows Firewall: Private: Firewall state'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '9.3.1', conditionId: 'host-firewall-off', polarity: 'fail-means-met',
ruleText: "Ensure 'Windows Firewall: Public: Firewall state' is set to 'On (recommended)'",
requiredTitleFragment: "'Windows Firewall: Public: Firewall state'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '9.1.2', conditionId: 'host-firewall-inbound-allowed', polarity: 'fail-means-met',
ruleText: "Ensure 'Windows Firewall: Domain: Inbound connections' is set to 'Block (default)'",
requiredTitleFragment: "'Windows Firewall: Domain: Inbound connections'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '9.2.2', conditionId: 'host-firewall-inbound-allowed', polarity: 'fail-means-met',
ruleText: "Ensure 'Windows Firewall: Private: Inbound connections' is set to 'Block (default)'",
requiredTitleFragment: "'Windows Firewall: Private: Inbound connections'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '9.3.2', conditionId: 'host-firewall-inbound-allowed', polarity: 'fail-means-met',
ruleText: "Ensure 'Windows Firewall: Public: Inbound connections' is set to 'Block (default)'",
requiredTitleFragment: "'Windows Firewall: Public: Inbound connections'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '2.2.2', conditionId: 'network-logon-rights-broad', polarity: 'fail-means-met',
ruleText: "Ensure 'Access this computer from the network' is set to 'Administrators, Authenticated Users, ENTERPRISE DOMAIN CONTROLLERS' (DC only)",
requiredTitleFragment: "'Access this computer from the network'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '2.3.10.4', conditionId: 'network-credentials-stored', polarity: 'fail-means-met',
ruleText: "Ensure 'Network access: Do not allow storage of passwords and credentials for network authentication' is set to 'Enabled'",
requiredTitleFragment: "'Network access: Do not allow storage of passwords and credentials for network authentication'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.9.27.1', conditionId: 'lsass-custom-ssp-allowed', polarity: 'fail-means-met',
ruleText: "Ensure 'Allow Custom SSPs and APs to be loaded into LSASS' is set to 'Disabled' (DC only)",
requiredTitleFragment: "'Allow Custom SSPs and APs to be loaded into LSASS'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.10.90.2.4', conditionId: 'winrm-runas-credentials-stored', polarity: 'fail-means-met',
ruleText: "Ensure 'Disallow WinRM from storing RunAs credentials' is set to 'Enabled'",
requiredTitleFragment: "'Disallow WinRM from storing RunAs credentials'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '2.3.17.1', conditionId: 'uac-weak', polarity: 'fail-means-met',
ruleText: "Ensure 'User Account Control: Admin Approval Mode for the Built-in Administrator account' is set to 'Enabled'",
requiredTitleFragment: "'User Account Control: Admin Approval Mode for the Built-in Administrator account'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '2.3.17.2', conditionId: 'uac-weak', polarity: 'fail-means-met',
ruleText: "Ensure 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' is set to the recommended value",
requiredTitleFragment: "'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '2.3.17.3', conditionId: 'uac-weak', polarity: 'fail-means-met',
ruleText: "Ensure 'User Account Control: Behavior of the elevation prompt for standard users' is set to 'Automatically deny elevation requests'",
requiredTitleFragment: "'User Account Control: Behavior of the elevation prompt for standard users'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.10.88.1', conditionId: 'powershell-logging-off', polarity: 'fail-means-met',
ruleText: "Ensure 'Turn on PowerShell Script Block Logging' is set to 'Enabled'",
requiredTitleFragment: "'Turn on PowerShell Script Block Logging'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.10.88.2', conditionId: 'powershell-logging-off', polarity: 'fail-means-met',
ruleText: "Ensure 'Turn on PowerShell Transcription' is set to 'Enabled'",
requiredTitleFragment: "'Turn on PowerShell Transcription'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'pingcastle', ruleId: 'A-AuditPowershell', conditionId: 'powershell-logging-off', polarity: 'fail-means-met',
ruleText: 'The PowerShell audit configuration is not fully enabled.', sources: [PINGCASTLE_RULES] },
{ tool: 'pingcastle', ruleId: 'A-AuditDC', conditionId: 'dc-audit-incomplete', polarity: 'fail-means-met',
ruleText: 'The audit policy on domain controllers does not collect key events.', sources: [PINGCASTLE_RULES] },
{ tool: 'cis-cat', ruleId: '1.1.4', conditionId: 'password-length-below-14', polarity: 'fail-means-met',
ruleText: "Ensure 'Minimum password length' is set to '14 or more character(s)'",
requiredTitleFragment: "'Minimum password length'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '1.1.5', conditionId: 'password-complexity-off', polarity: 'fail-means-met',
ruleText: "Ensure 'Password must meet complexity requirements' is set to 'Enabled'",
requiredTitleFragment: "'Password must meet complexity requirements'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '1.2.2', conditionId: 'account-lockout-threshold-weak', polarity: 'fail-means-met',
ruleText: "Ensure 'Account lockout threshold' is set to '5 or fewer invalid logon attempt(s), but not 0'",
requiredTitleFragment: "'Account lockout threshold'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '1.2.1', conditionId: 'account-lockout-duration-short', polarity: 'fail-means-met',
ruleText: "Ensure 'Account lockout duration' is set to '15 or more minute(s)'",
requiredTitleFragment: "'Account lockout duration'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '1.2.4', conditionId: 'account-lockout-duration-short', polarity: 'fail-means-met',
ruleText: "Ensure 'Reset account lockout counter after' is set to '15 or more minute(s)'",
requiredTitleFragment: "'Reset account lockout counter after'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'pingcastle', ruleId: 'A-MinPwdLen', conditionId: 'password-length-below-8', polarity: 'fail-means-met',
ruleText: 'Policy where the password length is less than 8 characters', sources: [PINGCASTLE_RULES] },
{ tool: 'pingcastle', ruleId: 'S-PwdNeverExpires', conditionId: 'ad-password-never-expires', polarity: 'fail-means-met',
ruleText: 'Accounts which have never expiring passwords', sources: [PINGCASTLE_RULES] },
{ tool: 'pingcastle', ruleId: 'S-DefaultOUChanged', conditionId: 'ad-default-container-redirected', polarity: 'fail-means-met',
ruleText: 'Check if default OU location has been changed within the domain.', sources: [PINGCASTLE_RULES] },
{ tool: 'purple-knight', ruleId: 'SI000013', conditionId: 'ad-dcshadow-evidence', polarity: 'fail-means-met',
ruleText: "Evidence of Mimikatz DCShadow attack", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000014', conditionId: 'ad-primary-group-anomaly', polarity: 'fail-means-met',
ruleText: "Users and computers with non-default Primary Group IDs", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000078', conditionId: 'ad-primary-group-anomaly', polarity: 'fail-means-met',
ruleText: "Users and computers without readable PGID", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000017', conditionId: 'krbtgt-password-old', polarity: 'fail-means-met',
ruleText: "Kerberos KRBTGT account with old password", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000023', conditionId: 'ad-sidhistory-abuse', polarity: 'fail-means-met',
ruleText: "Well-known privileged SIDs in SIDHistory", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000060', conditionId: 'ad-sidhistory-abuse', polarity: 'fail-means-met',
ruleText: "Recent SIDHistory changes on objects", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000033', conditionId: 'ad-recent-sensitive-changes', polarity: 'fail-means-met',
ruleText: "Recent privileged account creation activity", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000043', conditionId: 'ad-recent-sensitive-changes', polarity: 'fail-means-met',
ruleText: "Changes to privileged group membership in the last 7 days", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000047', conditionId: 'ad-recent-sensitive-changes', polarity: 'fail-means-met',
ruleText: "Changes to default security descriptor schema in the last 90 days", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000048', conditionId: 'ad-recent-sensitive-changes', polarity: 'fail-means-met',
ruleText: "Changes to Default Domain Policy or Default Domain Controllers Policy in the last 7 days", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000082', conditionId: 'ad-recent-sensitive-changes', polarity: 'fail-means-met',
ruleText: "Changes to AD Display Specifiers in the past 90 days", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000101', conditionId: 'ad-recent-sensitive-changes', polarity: 'fail-means-met',
ruleText: "SYSVOL Executable Changes", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000021', conditionId: 'ad-dangerous-acl-delegation', polarity: 'fail-means-met',
ruleText: "Non-default principals with DC Sync rights on the domain", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000025', conditionId: 'ad-dangerous-acl-delegation', polarity: 'fail-means-met',
ruleText: "Privileged objects with unprivileged owners", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000050', conditionId: 'ad-dangerous-acl-delegation', polarity: 'fail-means-met',
ruleText: "Domain Controller owner is not an administrator", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000056', conditionId: 'ad-dangerous-acl-delegation', polarity: 'fail-means-met',
ruleText: "Enterprise Key Admins with full access to domain", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000081', conditionId: 'ad-dangerous-acl-delegation', polarity: 'fail-means-met',
ruleText: "Non-standard schema permissions", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000083', conditionId: 'ad-dangerous-acl-delegation', polarity: 'fail-means-met',
ruleText: "Non-privileged users with access to gMSA passwords", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000089', conditionId: 'ad-dangerous-acl-delegation', polarity: 'fail-means-met',
ruleText: "Users with permissions to set Server Trust Account", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000092', conditionId: 'ad-dangerous-acl-delegation', polarity: 'fail-means-met',
ruleText: "Non-default access to DPAPI key", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000185', conditionId: 'ad-tombstone-reanimation-right', polarity: 'fail-means-met',
ruleText: "Objects with Reanimate-Tombstones extended right", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000193', conditionId: 'ad-dangerous-acl-delegation', polarity: 'fail-means-met',
ruleText: "OU permissions enabling BadSuccessor dMSA escalation", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000022', conditionId: 'rodc-credential-caching-risky', polarity: 'fail-means-met',
ruleText: "Risky RODC credential caching", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000138', conditionId: 'rodc-credential-caching-risky', polarity: 'fail-means-met',
ruleText: "Privileged user credentials cached on RODC", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000032', conditionId: 'gpo-link-delegation-broad', polarity: 'fail-means-met',
ruleText: "GPO linking delegation at the domain level", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000040', conditionId: 'gpo-link-delegation-broad', polarity: 'fail-means-met',
ruleText: "GPO linking delegation at the domain controller OU level", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000041', conditionId: 'gpo-link-delegation-broad', polarity: 'fail-means-met',
ruleText: "GPO linking delegation at the AD Site level", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000038', conditionId: 'ad-privileged-membership-hygiene', polarity: 'fail-means-met',
ruleText: "Enabled admin accounts that are inactive", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000039', conditionId: 'ad-privileged-membership-hygiene', polarity: 'fail-means-met',
ruleText: "Privileged users that are disabled", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000046', conditionId: 'ad-sdprop-protection-inconsistent', polarity: 'fail-means-met',
ruleText: "Objects in privileged groups without adminCount=1 (SDProp)", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000053', conditionId: 'ad-sdprop-protection-inconsistent', polarity: 'fail-means-met',
ruleText: "Operator groups no longer protected by AdminSDHolder and SDProp", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000061', conditionId: 'ad-privileged-membership-hygiene', polarity: 'fail-means-met',
ruleText: "Computer Accounts in Privileged Groups", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000064', conditionId: 'ad-privileged-membership-hygiene', polarity: 'fail-means-met',
ruleText: "Forest contains more than 50 privileged accounts", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000110', conditionId: 'ad-recent-sensitive-changes', polarity: 'fail-means-met',
ruleText: "Ephemeral Admins", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000124', conditionId: 'ad-privileged-membership-hygiene', polarity: 'fail-means-met',
ruleText: "Foreign Security Principals in Privileged Group", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000150', conditionId: 'ad-privileged-membership-hygiene', polarity: 'fail-means-met',
ruleText: "Operators Groups that are not empty", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000355', conditionId: 'dcom-perflog-groups-populated', polarity: 'fail-means-met',
ruleText: "Distributed COM Users group or Performance Log Users group are not empty", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000027', conditionId: 'ad-asrep-roastable', polarity: 'fail-means-met',
ruleText: "Users with Kerberos pre-authentication disabled", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000042', conditionId: 'ad-user-spn', polarity: 'fail-means-met',
ruleText: "Users with SPN defined", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000037', conditionId: 'ad-passwords-old', polarity: 'fail-means-met',
ruleText: "Users with old passwords", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000049', conditionId: 'ad-passwords-old', polarity: 'fail-means-met',
ruleText: "Built-in domain Administrator account with old password (180 days)", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000059', conditionId: 'ad-passwords-old', polarity: 'fail-means-met',
ruleText: "Computers with password last set over 90 days ago", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000062', conditionId: 'ad-passwords-old', polarity: 'fail-means-met',
ruleText: "Admins with old passwords", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000063', conditionId: 'ad-passwords-old', polarity: 'fail-means-met',
ruleText: "Domain Controllers with old passwords", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000068', conditionId: 'ad-trust-configuration-weak', polarity: 'fail-means-met',
ruleText: "Trust accounts with old passwords", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000072', conditionId: 'ad-passwords-old', polarity: 'fail-means-met',
ruleText: "gMSA objects with old passwords", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000236', conditionId: 'ad-passwords-old', polarity: 'fail-means-met',
ruleText: "User accounts using Smart Card authentication with old password", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000074', conditionId: 'ad-password-not-required', polarity: 'fail-means-met',
ruleText: "User accounts with password not required", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000015', conditionId: 'ad-recoverable-passwords', polarity: 'fail-means-met',
ruleText: "Reversible passwords found in GPOs", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000076', conditionId: 'ad-recoverable-passwords', polarity: 'fail-means-met',
ruleText: "User accounts that store passwords with reversible encryption", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000188', conditionId: 'ad-recoverable-passwords', polarity: 'fail-means-met',
ruleText: "GPO Weak LM Hash storage enabled", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000339', conditionId: 'ad-recoverable-passwords', polarity: 'fail-means-met',
ruleText: "Users with the attribute userPassword set", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000075', conditionId: 'kerberos-rc4-des-allowed', polarity: 'fail-means-met',
ruleText: "User accounts that use DES encryption", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000051', conditionId: 'ad-obsolete-components', polarity: 'fail-means-met',
ruleText: "Domains with obsolete functional levels", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000054', conditionId: 'ad-obsolete-components', polarity: 'fail-means-met',
ruleText: "Computers with older OS versions", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000097', conditionId: 'ad-obsolete-components', polarity: 'fail-means-met',
ruleText: "NTFRS SYSVOL Replication", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000057', conditionId: 'ad-constrained-delegation-risky', polarity: 'fail-means-met',
ruleText: "Objects with constrained delegation configured", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000058', conditionId: 'ad-constrained-delegation-risky', polarity: 'fail-means-met',
ruleText: "Kerberos protocol transition delegation configured", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000100', conditionId: 'ad-constrained-delegation-risky', polarity: 'fail-means-met',
ruleText: "Accounts with Constrained Delegation configured to ghost SPN", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000069', conditionId: 'dc-health-inconsistent', polarity: 'fail-means-met',
ruleText: "Domain Controllers in inconsistent state", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000073', conditionId: 'dc-health-inconsistent', polarity: 'fail-means-met',
ruleText: "Domain Controllers that have not authenticated to the domain for more than 45 days", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000087', conditionId: 'ad-trust-configuration-weak', polarity: 'fail-means-met',
ruleText: "Domain trust to a third-party domain without quarantine", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000088', conditionId: 'ad-trust-configuration-weak', polarity: 'fail-means-met',
ruleText: "Outbound forest trust with SID History enabled", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000108', conditionId: 'ad-trust-configuration-weak', polarity: 'fail-means-met',
ruleText: "Dangerous Trust Attribute Set", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000102', conditionId: 'ad-explicit-certificate-mapping', polarity: 'fail-means-met',
ruleText: "Accounts with altSecurityIdentities configured", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000106', conditionId: 'adminsdholder-permissions-changed', polarity: 'fail-means-met',
ruleText: "Inheritance enabled on AdminSDHolder object", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000314', conditionId: 'adcs-dangerous-control-paths', polarity: 'fail-means-met',
ruleText: "Unexpected accounts in Cert Publishers Group", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000086', conditionId: 'weak-certificate-cipher', polarity: 'fail-means-met',
ruleText: "Weak certificate cipher", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000189', conditionId: 'gpo-dangerous-execution-paths', polarity: 'fail-means-met',
ruleText: "Writable shortcuts found in GPO", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000304', conditionId: 'gpo-dangerous-execution-paths', polarity: 'fail-means-met',
ruleText: "Dangerous GPO logon script path", sources: [PURPLE_KNIGHT] },
{ tool: 'maester', ruleId: 'CIS.M365.1.3.1', conditionId: 'entra-password-expiry-enabled', polarity: 'fail-means-met',
ruleText: "(L1) Ensure the 'Password expiration policy' is set to 'Set passwords to never expire (recommended)'", sources: [CIS_M365] },
{ tool: 'maester', ruleId: 'CISA.MS.AAD.6.1', conditionId: 'entra-password-expiry-enabled', polarity: 'fail-means-met',
ruleText: "User passwords SHALL NOT expire.", sources: [SCUBA_AAD] },
{ tool: 'maester', ruleId: 'MT.1024.pwagePolicyNew', conditionId: 'entra-password-expiry-enabled', polarity: 'fail-means-met',
ruleText: "Do not expire passwords.", sources: [maesterTest('MT.1024')] },
{ tool: 'maester', ruleId: 'CISA.MS.AAD.2.1', conditionId: 'entra-user-risk-not-covered', polarity: 'fail-means-met',
ruleText: "Users detected as high risk SHALL be blocked.", sources: [SCUBA_AAD] },
{ tool: 'maester', ruleId: 'MT.1013', conditionId: 'entra-user-risk-not-covered', polarity: 'fail-means-met',
ruleText: "At least one Conditional Access policy is configured to require new password when user risk is high.", sources: [maesterTest('MT.1013')] },
{ tool: 'maester', ruleId: 'CISA.MS.AAD.3.2', conditionId: 'entra-ca-coverage-gaps', polarity: 'fail-means-met',
ruleText: "If phishing-resistant MFA has not been enforced, an alternative MFA method SHALL be enforced for all users.", sources: [SCUBA_AAD] },
{ tool: 'maester', ruleId: 'MT.1003', conditionId: 'entra-ca-coverage-gaps', polarity: 'fail-means-met',
ruleText: "At least one Conditional Access policy is configured with All Apps.", sources: [maesterTest('MT.1003')] },
{ tool: 'maester', ruleId: 'MT.1004', conditionId: 'entra-ca-coverage-gaps', polarity: 'fail-means-met',
ruleText: "At least one Conditional Access policy is configured with All Apps and All Users.", sources: [maesterTest('MT.1004')] },
{ tool: 'maester', ruleId: 'MT.1007', conditionId: 'entra-ca-coverage-gaps', polarity: 'fail-means-met',
ruleText: "At least one Conditional Access policy is configured to require MFA for all users.", sources: [maesterTest('MT.1007')] },
{ tool: 'maester', ruleId: 'MT.1008', conditionId: 'entra-ca-coverage-gaps', polarity: 'fail-means-met',
ruleText: "At least one Conditional Access policy is configured to require MFA for Azure management.", sources: [maesterTest('MT.1008')] },
{ tool: 'maester', ruleId: 'MT.1016', conditionId: 'entra-ca-coverage-gaps', polarity: 'fail-means-met',
ruleText: "At least one Conditional Access policy is configured to require MFA for guest access.", sources: [maesterTest('MT.1016')] },
{ tool: 'maester', ruleId: 'MT.1052', conditionId: 'entra-ca-coverage-gaps', polarity: 'fail-means-met',
ruleText: "At least one Conditional Access policy is targeting the Device Code authentication flow.", sources: [maesterTest('MT.1052')] },
{ tool: 'maester', ruleId: 'MT.1006', conditionId: 'entra-admin-mfa-not-required', polarity: 'fail-means-met',
ruleText: "At least one Conditional Access policy is configured to require MFA for admins.", sources: [maesterTest('MT.1006')] },
{ tool: 'maester', ruleId: 'MT.1001', conditionId: 'entra-managed-device-not-required', polarity: 'fail-means-met',
ruleText: "At least one Conditional Access policy is configured with device compliance.", sources: [maesterTest('MT.1001')] },
{ tool: 'maester', ruleId: 'MT.1035', conditionId: 'entra-ca-groups-unprotected', polarity: 'fail-means-met',
ruleText: "All security groups assigned to Conditional Access Policies should be protected by RMAU.", sources: [maesterTest('MT.1035')] },
{ tool: 'maester', ruleId: 'MT.1049', conditionId: 'entra-ca-policy-integrity-gaps', polarity: 'fail-means-met',
ruleText: "Conditional Access policies for User Risk and Sign-in Risk should be configured separately.", sources: [maesterTest('MT.1049')] },
{ tool: 'maester', ruleId: 'MT.1061', conditionId: 'entra-ca-policy-integrity-gaps', polarity: 'fail-means-met',
ruleText: "Device registration MFA control conflicts with Conditional Access policies.", sources: [maesterTest('MT.1061')] },
{ tool: 'maester', ruleId: 'MT.1067', conditionId: 'entra-ca-policy-integrity-gaps', polarity: 'fail-means-met',
ruleText: "Authentication method policies should not reference non-existent groups.", sources: [maesterTest('MT.1067')] },
{ tool: 'maester', ruleId: 'MT.1072', conditionId: 'entra-ca-policy-integrity-gaps', polarity: 'fail-means-met',
ruleText: "Conditional access policies should not use the deprecated Approved Client App grant.", sources: [maesterTest('MT.1072')] },
{ tool: 'maester', ruleId: 'CISA.MS.AAD.7.5', conditionId: 'entra-pim-controls-weak', polarity: 'fail-means-met',
ruleText: "Provisioning users to highly privileged roles SHALL NOT occur outside of a PAM system.", sources: [SCUBA_AAD] },
{ tool: 'maester', ruleId: 'CISA.MS.AAD.7.6', conditionId: 'entra-pim-controls-weak', polarity: 'fail-means-met',
ruleText: "Activation of the Global Administrator role SHALL require approval.", sources: [SCUBA_AAD] },
{ tool: 'maester', ruleId: 'MT.1031', conditionId: 'entra-pim-controls-weak', polarity: 'fail-means-met',
ruleText: "Privileged role on Control Plane are managed by PIM only.", sources: [maesterTest('MT.1031')] },
{ tool: 'maester', ruleId: 'CISA.MS.AAD.7.8', conditionId: 'entra-privileged-role-alerts-missing', polarity: 'fail-means-met',
ruleText: "User activation of the Global Administrator role SHALL trigger an alert.", sources: [SCUBA_AAD] },
{ tool: 'maester', ruleId: 'MT.1026', conditionId: 'entra-admins-not-cloud-only', polarity: 'fail-means-met',
ruleText: "No hybrid user with permanent role assignment on Control Plane.", sources: [maesterTest('MT.1026')] },
{ tool: 'maester', ruleId: 'MT.1029', conditionId: 'entra-privileged-accounts-inactive', polarity: 'fail-means-met',
ruleText: "Stale accounts are not assigned to privileged roles.", sources: [maesterTest('MT.1029')] },
{ tool: 'maester', ruleId: 'MT.1024.oneAdmin', conditionId: 'entra-global-admin-count-outside-range', polarity: 'fail-means-met',
ruleText: "Designate more than one global admin.", sources: [maesterTest('MT.1024')] },
{ tool: 'maester', ruleId: 'MT.1024.roleOverlap', conditionId: 'entra-global-admin-overused', polarity: 'fail-means-met',
ruleText: "Use least privileged administrative roles .", sources: [maesterTest('MT.1024')] },
{ tool: 'maester', ruleId: 'MT.1024.servicePrincipalKeyExpiry', conditionId: 'entra-app-credentials-expiring', polarity: 'fail-means-met',
ruleText: "Renew expiring service principal credentials.", sources: [maesterTest('MT.1024')] },
{ tool: 'maester', ruleId: 'CISA.MS.AAD.5.1', conditionId: 'entra-app-creation-unrestricted', polarity: 'fail-means-met',
ruleText: "Only administrators SHALL be allowed to register applications.", sources: [SCUBA_AAD] },
{ tool: 'maester', ruleId: 'EIDSCA.AP10', conditionId: 'entra-app-creation-unrestricted', polarity: 'fail-means-met',
ruleText: "Default Authorization Settings - Default User Role Permissions - Allowed to create Apps.", sources: [EIDSCA_TESTS] },
{ tool: 'maester', ruleId: 'MT.1002', conditionId: 'entra-app-creation-unrestricted', polarity: 'fail-means-met',
ruleText: "App management restrictions on applications and service principals is configured and enabled.", sources: [maesterTest('MT.1002')] },
{ tool: 'maester', ruleId: 'EIDSCA.AP08', conditionId: 'entra-users-can-consent-apps', polarity: 'fail-means-met',
ruleText: "Default Authorization Settings - User consent policy assigned for applications.", sources: [EIDSCA_TESTS] },
{ tool: 'maester', ruleId: 'EIDSCA.AF01', conditionId: 'entra-mfa-not-phishing-resistant', polarity: 'fail-means-met',
ruleText: "Authentication Method - FIDO2 security key - State.", sources: [EIDSCA_TESTS] },
{ tool: 'maester', ruleId: 'EIDSCA.AG03', conditionId: 'entra-mfa-fatigue-protection-weak', polarity: 'fail-means-met',
ruleText: "Authentication Method - General Settings - Report suspicious activity - Included users/groups.", sources: [EIDSCA_TESTS] },
{ tool: 'maester', ruleId: 'EIDSCA.AM03', conditionId: 'entra-mfa-fatigue-protection-weak', polarity: 'fail-means-met',
ruleText: "Authentication Method - Microsoft Authenticator - Require number matching for push notifications.", sources: [EIDSCA_TESTS] },
{ tool: 'maester', ruleId: 'EIDSCA.AM04', conditionId: 'entra-mfa-fatigue-protection-weak', polarity: 'fail-means-met',
ruleText: "Authentication Method - Microsoft Authenticator - Included users/groups of number matching for push notifications.", sources: [EIDSCA_TESTS] },
{ tool: 'maester', ruleId: 'EIDSCA.AM06', conditionId: 'entra-mfa-fatigue-protection-weak', polarity: 'fail-means-met',
ruleText: "Authentication Method - Microsoft Authenticator - Show application name in push and passwordless notifications.", sources: [EIDSCA_TESTS] },
{ tool: 'maester', ruleId: 'EIDSCA.AM07', conditionId: 'entra-mfa-fatigue-protection-weak', polarity: 'fail-means-met',
ruleText: "Authentication Method - Microsoft Authenticator - Included users/groups to show application name in push and passwordless notifications.", sources: [EIDSCA_TESTS] },
{ tool: 'maester', ruleId: 'EIDSCA.AM09', conditionId: 'entra-mfa-fatigue-protection-weak', polarity: 'fail-means-met',
ruleText: "Authentication Method - Microsoft Authenticator - Show geographic location in push and passwordless notifications.", sources: [EIDSCA_TESTS] },
{ tool: 'maester', ruleId: 'EIDSCA.AM10', conditionId: 'entra-mfa-fatigue-protection-weak', polarity: 'fail-means-met',
ruleText: "Authentication Method - Microsoft Authenticator - Included users/groups to show geographic location in push and passwordless notifications.", sources: [EIDSCA_TESTS] },
{ tool: 'maester', ruleId: 'EIDSCA.AS04', conditionId: 'entra-weak-mfa-methods-enabled', polarity: 'fail-means-met',
ruleText: "Authentication Method - SMS - Use for sign-in.", sources: [EIDSCA_TESTS] },
{ tool: 'maester', ruleId: 'EIDSCA.AV01', conditionId: 'entra-weak-mfa-methods-enabled', polarity: 'fail-means-met',
ruleText: "Authentication Method - Voice call - State.", sources: [EIDSCA_TESTS] },
{ tool: 'maester', ruleId: 'EIDSCA.PR02', conditionId: 'entra-password-protection-not-enforced', polarity: 'fail-means-met',
ruleText: "Default Settings - Password Rule Settings - Password Protection - Enable password protection on Windows Server Active Directory.", sources: [EIDSCA_PASSWORD_RULES] },
{ tool: 'cis-cat', ruleId: '19.7.5.1', conditionId: 'mark-of-the-web-suppressed', polarity: 'fail-means-met',
ruleText: "Ensure 'Do not preserve zone information in file attachments' is set to 'Disabled'",
requiredTitleFragment: "'Do not preserve zone information in file attachments'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'pingcastle', ruleId: 'A-NoServicePolicy', conditionId: 'ad-service-accounts-no-strong-policy', polarity: 'fail-means-met',
ruleText: 'No password policy for service accounts found (MinimumPasswordLength>=20)', sources: [PINGCASTLE_RULES] },
{ tool: 'purple-knight', ruleId: 'SI000096', conditionId: 'ad-privileged-weak-password-policy', polarity: 'fail-means-met',
ruleText: 'Privileged Users with Weak Password Policy', sources: [PURPLE_KNIGHT] },
{ tool: 'maester', ruleId: 'EIDSCA.PR01', conditionId: 'entra-password-protection-not-enforced', polarity: 'fail-means-met',
ruleText: 'Default Settings - Password Rule Settings - Password Protection - Mode.', sources: [EIDSCA_PASSWORD_RULES] },
{ tool: 'maester', ruleId: 'EIDSCA.PR03', conditionId: 'entra-password-protection-not-enforced', polarity: 'fail-means-met',
ruleText: 'Default Settings - Password Rule Settings - Enforce custom list.', sources: [EIDSCA_PASSWORD_RULES] },
{ tool: 'maester', ruleId: 'EIDSCA.PR05', conditionId: 'entra-smart-lockout-weak', polarity: 'fail-means-met',
ruleText: 'Default Settings - Password Rule Settings - Smart Lockout - Lockout duration in seconds.', sources: [EIDSCA_PASSWORD_RULES] },
{ tool: 'maester', ruleId: 'EIDSCA.PR06', conditionId: 'entra-smart-lockout-weak', polarity: 'fail-means-met',
ruleText: 'Default Settings - Password Rule Settings - Smart Lockout - Lockout threshold.', sources: [EIDSCA_PASSWORD_RULES] },
{ tool: 'cis-cat', ruleId: '5.1', conditionId: 'ad-dc-spooler-coercion', polarity: 'fail-means-met',
ruleText: "Ensure 'Print Spooler (Spooler)' is set to 'Disabled' (DC only)",
requiredTitleFragment: "'Print Spooler (Spooler)'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.4.6', conditionId: 'netbios-not-disabled', polarity: 'fail-means-met',
ruleText: "Ensure 'NetBT NodeType configuration' is set to 'Enabled: P-node (recommended)'",
requiredTitleFragment: "'NetBT NodeType configuration'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'pingcastle', ruleId: 'A-HardenedPaths', conditionId: 'hardened-unc-paths-weakened', polarity: 'fail-means-met',
ruleText: "Hardened Paths have been modified to lower the security level", sources: [PINGCASTLE_RULES] },
{ tool: 'cis-cat', ruleId: '18.6.14.1', conditionId: 'hardened-unc-paths-not-configured', polarity: 'fail-means-met',
ruleText: "Ensure 'Hardened UNC Paths' is set to 'Enabled, with \"Require Mutual Authentication\", \"Require Integrity\", and \"Require Privacy\" set for all NETLOGON and SYSVOL shares'",
requiredTitleFragment: "'Hardened UNC Paths'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.6.8.4', conditionId: 'smb-insecure-guest-logons', polarity: 'fail-means-met',
ruleText: "Ensure 'Enable insecure guest logons' is set to 'Disabled'",
requiredTitleFragment: "'Enable insecure guest logons'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'purple-knight', ruleId: 'SI000085', conditionId: 'dns-nonsecure-dynamic-updates', polarity: 'fail-means-met',
ruleText: "Unsecured DNS configuration", sources: [PURPLE_KNIGHT] },
{ tool: 'cis-cat', ruleId: '2.3.11.4', conditionId: 'kerberos-rc4-des-allowed', polarity: 'fail-means-met',
ruleText: "Ensure 'Network security: Configure encryption types allowed for Kerberos' is set to 'AES128_HMAC_SHA1, AES256_HMAC_SHA1, Future encryption types'",
requiredTitleFragment: "'Network security: Configure encryption types allowed for Kerberos'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'pingcastle', ruleId: 'S-KerberosArmoring', conditionId: 'kerberos-armoring-off', polarity: 'fail-means-met',
ruleText: "Verify Kerberos Armoring is enabled on clients and the domain functional level is at least Windows Server 2012", sources: [PINGCASTLE_RULES] },
{ tool: 'pingcastle', ruleId: 'S-KerberosArmoringDC', conditionId: 'kerberos-armoring-off', polarity: 'fail-means-met',
ruleText: "Verify Kerberos Armoring is enabled on DCs and the domain functional level is at least Windows Server 2012", sources: [PINGCASTLE_RULES] },
{ tool: 'cis-cat', ruleId: '17.1.1', conditionId: 'host-audit-policy-incomplete', polarity: 'fail-means-met',
ruleText: "Ensure 'Audit Credential Validation' is set to 'Success and Failure'",
requiredTitleFragment: "'Audit Credential Validation'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '17.1.2', conditionId: 'host-audit-policy-incomplete', polarity: 'fail-means-met',
ruleText: "Ensure 'Audit Kerberos Authentication Service' is set to 'Success and Failure' (DC Only)",
requiredTitleFragment: "'Audit Kerberos Authentication Service'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '17.1.3', conditionId: 'host-audit-policy-incomplete', polarity: 'fail-means-met',
ruleText: "Ensure 'Audit Kerberos Service Ticket Operations' is set to 'Success and Failure' (DC Only)",
requiredTitleFragment: "'Audit Kerberos Service Ticket Operations'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '17.2.6', conditionId: 'host-audit-policy-incomplete', polarity: 'fail-means-met',
ruleText: "Ensure 'Audit User Account Management' is set to 'Success and Failure'",
requiredTitleFragment: "'Audit User Account Management'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '17.4.1', conditionId: 'host-audit-policy-incomplete', polarity: 'fail-means-met',
ruleText: "Ensure 'Audit Directory Service Access' is set to include 'Failure' (DC only)",
requiredTitleFragment: "'Audit Directory Service Access'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '17.4.2', conditionId: 'host-audit-policy-incomplete', polarity: 'fail-means-met',
ruleText: "Ensure 'Audit Directory Service Changes' is set to include 'Success' (DC only)",
requiredTitleFragment: "'Audit Directory Service Changes'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '17.5.2', conditionId: 'host-audit-policy-incomplete', polarity: 'fail-means-met',
ruleText: "Ensure 'Audit Group Membership' is set to include 'Success'",
requiredTitleFragment: "'Audit Group Membership'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '17.8.1', conditionId: 'host-audit-policy-incomplete', polarity: 'fail-means-met',
ruleText: "Ensure 'Audit Sensitive Privilege Use' is set to 'Success'",
requiredTitleFragment: "'Audit Sensitive Privilege Use'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '17.3.2', conditionId: 'process-creation-not-logged', polarity: 'fail-means-met',
ruleText: "Ensure 'Audit Process Creation' is set to include 'Success'",
requiredTitleFragment: "'Audit Process Creation'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.9.3.1', conditionId: 'process-creation-not-logged', polarity: 'fail-means-met',
ruleText: "Ensure 'Include command line in process creation events' is set to 'Enabled'",
requiredTitleFragment: "'Include command line in process creation events'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.10.26.2.1', conditionId: 'security-event-log-small', polarity: 'fail-means-met',
ruleText: "Ensure 'Security: Control Event Log behavior when the log file reaches its maximum size' is set to 'Disabled'",
requiredTitleFragment: "'Security: Control Event Log behavior when the log file reaches its maximum size'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.10.26.2.2', conditionId: 'security-event-log-small', polarity: 'fail-means-met',
ruleText: "Ensure 'Security: Specify the maximum log file size (KB)' is set to 'Enabled: 196,608 or greater'",
requiredTitleFragment: "'Security: Specify the maximum log file size (KB)'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '2.3.11.11', conditionId: 'ntlm-usage-not-audited', polarity: 'fail-means-met',
ruleText: "Ensure 'Network security: Restrict NTLM: Audit Incoming NTLM Traffic' is set to 'Enable auditing for all accounts'",
requiredTitleFragment: "'Network security: Restrict NTLM: Audit Incoming NTLM Traffic'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '2.3.11.12', conditionId: 'ntlm-usage-not-audited', polarity: 'fail-means-met',
ruleText: "Ensure 'Network security: Restrict NTLM: Audit NTLM authentication in this domain' is set to 'Enable all' (DC only)",
requiredTitleFragment: "'Network security: Restrict NTLM: Audit NTLM authentication in this domain'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '2.3.11.13', conditionId: 'ntlm-usage-not-audited', polarity: 'fail-means-met',
ruleText: "Ensure 'Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers' is set to 'Audit all' or higher",
requiredTitleFragment: "'Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '9.1.6', conditionId: 'firewall-logging-off', polarity: 'fail-means-met',
ruleText: "Ensure 'Windows Firewall: Domain: Logging: Log dropped packets' is set to 'Yes'",
requiredTitleFragment: "'Windows Firewall: Domain: Logging: Log dropped packets'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '9.1.7', conditionId: 'firewall-logging-off', polarity: 'fail-means-met',
ruleText: "Ensure 'Windows Firewall: Domain: Logging: Log successful connections' is set to 'Yes'",
requiredTitleFragment: "'Windows Firewall: Domain: Logging: Log successful connections'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '9.2.6', conditionId: 'firewall-logging-off', polarity: 'fail-means-met',
ruleText: "Ensure 'Windows Firewall: Private: Logging: Log dropped packets' is set to 'Yes'",
requiredTitleFragment: "'Windows Firewall: Private: Logging: Log dropped packets'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '9.2.7', conditionId: 'firewall-logging-off', polarity: 'fail-means-met',
ruleText: "Ensure 'Windows Firewall: Private: Logging: Log successful connections' is set to 'Yes'",
requiredTitleFragment: "'Windows Firewall: Private: Logging: Log successful connections'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '9.3.8', conditionId: 'firewall-logging-off', polarity: 'fail-means-met',
ruleText: "Ensure 'Windows Firewall: Public: Logging: Log dropped packets' is set to 'Yes'",
requiredTitleFragment: "'Windows Firewall: Public: Logging: Log dropped packets'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '9.3.9', conditionId: 'firewall-logging-off', polarity: 'fail-means-met',
ruleText: "Ensure 'Windows Firewall: Public: Logging: Log successful connections' is set to 'Yes'",
requiredTitleFragment: "'Windows Firewall: Public: Logging: Log successful connections'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'maester', ruleId: 'MT.1024.DefenderForIdentityIsNotInstalled', conditionId: 'identity-threat-detection-missing', polarity: 'fail-means-met',
ruleText: "Start your Defender for Identity deployment, installing Sensors on Domain Controllers and other eligible servers.", sources: [maesterTest('MT.1024')] },
{ tool: 'maester', ruleId: 'CISA.MS.AAD.4.1', conditionId: 'cloud-security-logs-not-forwarded', polarity: 'fail-means-met',
ruleText: "Security logs SHALL be sent to the agency's security operations center for monitoring.", sources: [SCUBA_AAD] },
{ tool: 'maester', ruleId: 'CISA.MS.AAD.7.7', conditionId: 'entra-privileged-role-alerts-missing', polarity: 'fail-means-met',
ruleText: "Eligible and Active highly privileged role assignments SHALL trigger an alert.", sources: [SCUBA_AAD] },
{ tool: 'maester', ruleId: 'CISA.MS.AAD.7.9', conditionId: 'entra-privileged-role-alerts-missing', polarity: 'fail-means-met',
ruleText: "User activation of other highly privileged roles SHOULD trigger an alert.", sources: [SCUBA_AAD] },
{ tool: 'pingcastle', ruleId: 'S-DefenderASR', conditionId: 'defender-asr-not-enforced', polarity: 'fail-means-met',
ruleText: "Not all possible Defender ASR mitigations are in Block or Warn mode", sources: [PINGCASTLE_RULES] },
{ tool: 'cis-cat', ruleId: '18.10.42.6.1.1', conditionId: 'defender-asr-not-enforced', polarity: 'fail-means-met',
ruleText: "Ensure 'Configure Attack Surface Reduction rules' is set to 'Enabled'",
requiredTitleFragment: "'Configure Attack Surface Reduction rules'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.10.42.6.1.2', conditionId: 'defender-asr-not-enforced', polarity: 'fail-means-met',
ruleText: "Ensure 'Configure Attack Surface Reduction rules: Set the state for each ASR rule' is configured",
requiredTitleFragment: "'Configure Attack Surface Reduction rules: Set the state for each ASR rule'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.10.42.10.2', conditionId: 'defender-protection-weakened', polarity: 'fail-means-met',
ruleText: "Ensure 'Scan all downloaded files and attachments' is set to 'Enabled'",
requiredTitleFragment: "'Scan all downloaded files and attachments'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.10.42.10.3', conditionId: 'defender-protection-weakened', polarity: 'fail-means-met',
ruleText: "Ensure 'Turn off real-time protection' is set to 'Disabled'",
requiredTitleFragment: "'Turn off real-time protection'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.10.42.10.4', conditionId: 'defender-protection-weakened', polarity: 'fail-means-met',
ruleText: "Ensure 'Turn on behavior monitoring' is set to 'Enabled'",
requiredTitleFragment: "'Turn on behavior monitoring'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.10.42.10.5', conditionId: 'defender-protection-weakened', polarity: 'fail-means-met',
ruleText: "Ensure 'Turn on script scanning' is set to 'Enabled'",
requiredTitleFragment: "'Turn on script scanning'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.10.42.4.1', conditionId: 'defender-protection-weakened', polarity: 'fail-means-met',
ruleText: "Ensure 'Enable EDR in block mode' is set to 'Enabled'",
requiredTitleFragment: "'Enable EDR in block mode'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.10.42.6.3.1', conditionId: 'web-protection-off', polarity: 'fail-means-met',
ruleText: "Ensure 'Prevent users and apps from accessing dangerous websites' is set to 'Enabled: Block'",
requiredTitleFragment: "'Prevent users and apps from accessing dangerous websites'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.10.77.2.1', conditionId: 'web-protection-off', polarity: 'fail-means-met',
ruleText: "Ensure 'Configure Windows Defender SmartScreen' is set to 'Enabled: Warn and prevent bypass'",
requiredTitleFragment: "'Configure Windows Defender SmartScreen'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.10.29.2', conditionId: 'mark-of-the-web-suppressed', polarity: 'fail-means-met',
ruleText: "Ensure 'Do not apply the Mark of the Web tag to files copied from insecure sources' is set to 'Disabled'",
requiredTitleFragment: "'Do not apply the Mark of the Web tag to files copied from insecure sources'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.10.8.2', conditionId: 'autorun-enabled', polarity: 'fail-means-met',
ruleText: "Ensure 'Set the default behavior for AutoRun' is set to 'Enabled: Do not execute any autorun commands'",
requiredTitleFragment: "'Set the default behavior for AutoRun'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.10.8.3', conditionId: 'autorun-enabled', polarity: 'fail-means-met',
ruleText: "Ensure 'Turn off Autoplay' is set to 'Enabled: All drives'",
requiredTitleFragment: "'Turn off Autoplay'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'pingcastle', ruleId: 'S-FolderOptions', conditionId: 'script-files-run-on-double-click', polarity: 'fail-means-met',
ruleText: "Some script extensions, used in phishing, can be directly run by double clicking on it", sources: [PINGCASTLE_RULES] },
{ tool: 'pingcastle', ruleId: 'S-FirewallScript', conditionId: 'script-engines-reach-internet', polarity: 'fail-means-met',
ruleText: "It is possible for scripts engine used by hackers to connect directly to the Internet", sources: [PINGCASTLE_RULES] },
{ tool: 'pingcastle', ruleId: 'A-LAPS-Not-Installed', conditionId: 'laps-not-deployed', polarity: 'fail-means-met',
ruleText: "LAPS doesn't seem to be installed", sources: [PINGCASTLE_RULES] },
{ tool: 'cis-cat', ruleId: '18.10.57.3.10.1', conditionId: 'rdp-sessions-not-timed-out', polarity: 'fail-means-met',
ruleText: "Ensure 'Set time limit for active but idle Remote Desktop Services sessions' is set to 'Enabled: 15 minutes or less, but not Never (0)'",
requiredTitleFragment: "'Set time limit for active but idle Remote Desktop Services sessions'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.10.57.3.10.2', conditionId: 'rdp-sessions-not-timed-out', polarity: 'fail-means-met',
ruleText: "Ensure 'Set time limit for disconnected sessions' is set to 'Enabled: 1 minute'",
requiredTitleFragment: "'Set time limit for disconnected sessions'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'pingcastle', ruleId: 'S-TerminalServicesGPO', conditionId: 'terminal-services-gpo-incomplete', polarity: 'fail-means-met',
ruleText: "The GPO are not pushing recommended configuration for Terminal Services", sources: [PINGCASTLE_RULES] },
{ tool: 'cis-cat', ruleId: '18.10.57.3.9.2', conditionId: 'rdp-connection-security-weak', polarity: 'fail-means-met',
ruleText: "Ensure 'Require secure RPC communication' is set to 'Enabled'",
requiredTitleFragment: "'Require secure RPC communication'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.10.57.3.9.3', conditionId: 'rdp-connection-security-weak', polarity: 'fail-means-met',
ruleText: "Ensure 'Require use of specific security layer for remote (RDP) connections' is set to 'Enabled: SSL'",
requiredTitleFragment: "'Require use of specific security layer for remote (RDP) connections'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.10.57.3.9.5', conditionId: 'rdp-connection-security-weak', polarity: 'fail-means-met',
ruleText: "Ensure 'Set client connection encryption level' is set to 'Enabled: High Level'",
requiredTitleFragment: "'Set client connection encryption level'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'purple-knight', ruleId: 'SI000302', conditionId: 'dangerous-user-rights-granted', polarity: 'fail-means-met',
ruleText: "Dangerous user rights granted by GPO", sources: [PURPLE_KNIGHT] },
{ tool: 'cis-cat', ruleId: '2.2.11', conditionId: 'dangerous-user-rights-granted', polarity: 'fail-means-met',
ruleText: "Ensure 'Back up files and directories' is set to 'Administrators'",
requiredTitleFragment: "'Back up files and directories'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '2.2.34', conditionId: 'dangerous-user-rights-granted', polarity: 'fail-means-met',
ruleText: "Ensure 'Load and unload device drivers' is set to 'Administrators'",
requiredTitleFragment: "'Load and unload device drivers'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '2.2.45', conditionId: 'dangerous-user-rights-granted', polarity: 'fail-means-met',
ruleText: "Ensure 'Restore files and directories' is set to 'Administrators'",
requiredTitleFragment: "'Restore files and directories'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.10.57.2.2', conditionId: 'rdp-passwords-saved', polarity: 'fail-means-met',
ruleText: "Ensure 'Do not allow passwords to be saved' is set to 'Enabled'",
requiredTitleFragment: "'Do not allow passwords to be saved'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.10.57.3.9.1', conditionId: 'rdp-passwords-saved', polarity: 'fail-means-met',
ruleText: "Ensure 'Always prompt for password upon connection' is set to 'Enabled'",
requiredTitleFragment: "'Always prompt for password upon connection'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.10.82.2', conditionId: 'always-install-elevated', polarity: 'fail-means-met',
ruleText: "Ensure 'Always install with elevated privileges' is set to 'Disabled'",
requiredTitleFragment: "'Always install with elevated privileges'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.9.4.2', conditionId: 'remote-credential-delegation-unprotected', polarity: 'fail-means-met',
ruleText: "Ensure 'Remote host allows delegation of non-exportable credentials' is set to 'Enabled'",
requiredTitleFragment: "'Remote host allows delegation of non-exportable credentials'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'purple-knight', ruleId: 'SI000024', conditionId: 'dnsadmins-unprivileged-members', polarity: 'fail-means-met',
ruleText: "Unprivileged principals as DNS Admins", sources: [PURPLE_KNIGHT] },
{ tool: 'pingcastle', ruleId: 'P-SchemaAdmin', conditionId: 'schema-admins-not-empty', polarity: 'fail-means-met',
ruleText: "The group Schema Admins is not empty", sources: [PINGCASTLE_RULES] },
{ tool: 'purple-knight', ruleId: 'SI000055', conditionId: 'adminsdholder-permissions-changed', polarity: 'fail-means-met',
ruleText: "Permission changes on AdminSDHolder object", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000034', conditionId: 'ad-stale-admincount', polarity: 'fail-means-met',
ruleText: "Unprivileged accounts with adminCount=1", sources: [PURPLE_KNIGHT] },
{ tool: 'pingcastle', ruleId: 'A-AdminSDHolder', conditionId: 'ad-stale-admincount', polarity: 'fail-means-met',
ruleText: "Suspicious admin activities detected", sources: [PINGCASTLE_RULES] },
{ tool: 'pingcastle', ruleId: 'A-RootDseAnonBinding', conditionId: 'anonymous-ldap-bind', polarity: 'fail-means-met',
ruleText: "Anonymous Binding to the rootDse is enabled", sources: [PINGCASTLE_RULES] },
{ tool: 'purple-knight', ruleId: 'SI000030', conditionId: 'anonymous-directory-access', polarity: 'fail-means-met',
ruleText: "Anonymous access to Active Directory enabled", sources: [PURPLE_KNIGHT] },
{ tool: 'purple-knight', ruleId: 'SI000052', conditionId: 'anonymous-nspi-access', polarity: 'fail-means-met',
ruleText: "Anonymous NSPI access to AD enabled", sources: [PURPLE_KNIGHT] },
{ tool: 'pingcastle', ruleId: 'A-PreWin2000AuthenticatedUsers', conditionId: 'prewin2000-access-broad', polarity: 'fail-means-met',
ruleText: "The PreWin2000 compatible group contains \"Authenticated Users\"", sources: [PINGCASTLE_RULES] },
{ tool: 'pingcastle', ruleId: 'A-PreWin2000Other', conditionId: 'prewin2000-access-broad', polarity: 'fail-means-met',
ruleText: "At least one user, computer or group has been added as a member to the PreWin2000 compatible group", sources: [PINGCASTLE_RULES] },
{ tool: 'purple-knight', ruleId: 'SI000104', conditionId: 'prewin2000-membership-changed', polarity: 'fail-means-met',
ruleText: "Changes to Pre-Windows 2000 Compatible Access Group membership", sources: [PURPLE_KNIGHT] },
{ tool: 'pingcastle', ruleId: 'A-NoNetSessionHardening', conditionId: 'net-session-enumeration-open', polarity: 'fail-means-met',
ruleText: "No GPO has been found which implements NetCease", sources: [PINGCASTLE_RULES] },
{ tool: 'cis-cat', ruleId: '2.3.10.6', conditionId: 'anonymous-named-pipes', polarity: 'fail-means-met',
ruleText: "Ensure 'Network access: Named Pipes that can be accessed anonymously' is configured (DC only)",
requiredTitleFragment: "'Network access: Named Pipes that can be accessed anonymously'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'purple-knight', ruleId: 'SI000012', conditionId: 'guest-account-enabled', polarity: 'fail-means-met',
ruleText: "Built-in guest account is enabled", sources: [PURPLE_KNIGHT] },
{ tool: 'pingcastle', ruleId: 'A-BackupMetadata', conditionId: 'ad-backup-outdated', polarity: 'fail-means-met',
ruleText: "Last AD backup has been performed", sources: [PINGCASTLE_RULES] },
{ tool: 'pingcastle', ruleId: 'P-RecycleBin', conditionId: 'ad-recycle-bin-disabled', polarity: 'fail-means-met',
ruleText: "The Recycle Bin is not enabled", sources: [PINGCASTLE_RULES] },
{ tool: 'pingcastle', ruleId: 'P-UnprotectedOU', conditionId: 'ou-deletion-unprotected', polarity: 'fail-means-met',
ruleText: "OU without the accidental deletion protection have been found", sources: [PINGCASTLE_RULES] },
{ tool: 'pingcastle', ruleId: 'A-NotEnoughDC', conditionId: 'dc-redundancy-missing', polarity: 'fail-means-met',
ruleText: "The number of DCs is too small to provide redundancy", sources: [PINGCASTLE_RULES] },
{ tool: 'maester', ruleId: 'MT.1009', conditionId: 'entra-legacy-auth-not-blocked', polarity: 'fail-means-met',
ruleText: "At least one Conditional Access policy is configured to block other legacy authentication.", sources: [maesterTest('MT.1009')] },
{ tool: 'maester', ruleId: 'MT.1010', conditionId: 'entra-legacy-auth-not-blocked', polarity: 'fail-means-met',
ruleText: "At least one Conditional Access policy is configured to block legacy authentication for Exchange ActiveSync.", sources: [maesterTest('MT.1010')] },
{ tool: 'maester', ruleId: 'MT.1024.userRiskPolicy', conditionId: 'entra-user-risk-not-covered', polarity: 'fail-means-met',
ruleText: "Protect all users with a user risk policy.", sources: [maesterTest('MT.1024')] },
{ tool: 'maester', ruleId: 'MT.1024.mfaRegistrationV2', conditionId: 'entra-mfa-registration-incomplete', polarity: 'fail-means-met',
ruleText: "Ensure all users can complete multifactor authentication.", sources: [maesterTest('MT.1024')] },
{ tool: 'maester', ruleId: 'CISA.MS.AAD.3.7', conditionId: 'entra-managed-device-not-required', polarity: 'fail-means-met',
ruleText: "Managed devices SHOULD be required for authentication.", sources: [SCUBA_AAD] },
{ tool: 'maester', ruleId: 'CISA.MS.AAD.3.8', conditionId: 'entra-mfa-registration-unrestricted', polarity: 'fail-means-met',
ruleText: "Managed Devices SHOULD be required to register MFA.", sources: [SCUBA_AAD] },
{ tool: 'maester', ruleId: 'MT.1011', conditionId: 'entra-mfa-registration-unrestricted', polarity: 'fail-means-met',
ruleText: "At least one Conditional Access policy is configured to secure security info registration only from a trusted location.", sources: [maesterTest('MT.1011')] },
{ tool: 'maester', ruleId: 'CISA.MS.AAD.3.3', conditionId: 'entra-mfa-fatigue-protection-weak', polarity: 'fail-means-met',
ruleText: "If phishing-resistant MFA has not been enforced and Microsoft Authenticator is enabled, it SHALL be configured to show login context information.", sources: [SCUBA_AAD] },
{ tool: 'maester', ruleId: 'EIDSCA.AG02', conditionId: 'entra-mfa-fatigue-protection-weak', polarity: 'fail-means-met',
ruleText: "Authentication Method - General Settings - Report suspicious activity - State.", sources: [EIDSCA_TESTS] },
{ tool: 'maester', ruleId: 'MT.1017', conditionId: 'entra-unmanaged-sessions-persistent', polarity: 'fail-means-met',
ruleText: "At least one Conditional Access policy is configured to enforce non persistent browser session for non-corporate devices.", sources: [maesterTest('MT.1017')] },
{ tool: 'maester', ruleId: 'MT.1018', conditionId: 'entra-unmanaged-sessions-persistent', polarity: 'fail-means-met',
ruleText: "At least one Conditional Access policy is configured to enforce sign-in frequency for non-corporate devices.", sources: [maesterTest('MT.1018')] },
{ tool: 'maester', ruleId: 'CISA.MS.AAD.7.2', conditionId: 'entra-global-admin-overused', polarity: 'fail-means-met',
ruleText: "Privileged users SHALL be provisioned with finer-grained roles instead of Global Administrator.", sources: [SCUBA_AAD] },
{ tool: 'maester', ruleId: 'MT.1028', conditionId: 'entra-privileged-user-mailbox', polarity: 'fail-means-met',
ruleText: "No user with mailbox and permanent role assignment on Control Plane.", sources: [maesterTest('MT.1028')] },
{ tool: 'maester', ruleId: 'MT.1014', conditionId: 'entra-admin-managed-device-not-required', polarity: 'fail-means-met',
ruleText: "At least one Conditional Access policy is configured to require compliant or Entra hybrid joined devices for admins.", sources: [maesterTest('MT.1014')] },
{ tool: 'maester', ruleId: 'MT.1056', conditionId: 'azure-root-permanent-access', polarity: 'fail-means-met',
ruleText: "Ensure that no person has permanent access to all Azure subscriptions at the root scope", sources: [maesterTest('MT.1056')] },
{ tool: 'maester', ruleId: 'CISA.MS.AAD.5.2', conditionId: 'entra-users-can-consent-apps', polarity: 'fail-means-met',
ruleText: "Only administrators SHALL be allowed to consent to applications.", sources: [SCUBA_AAD] },
{ tool: 'maester', ruleId: 'MT.1024.integratedApps', conditionId: 'entra-users-consent-risky-apps', polarity: 'fail-means-met',
ruleText: "Do not allow users to grant consent to unreliable applications.", sources: [maesterTest('MT.1024')] },
{ tool: 'maester', ruleId: 'EIDSCA.AP09', conditionId: 'entra-users-consent-risky-apps', polarity: 'fail-means-met',
ruleText: "Default Authorization Settings - Allow user consent on risk-based apps.", sources: [EIDSCA_TESTS] },
{ tool: 'maester', ruleId: 'EIDSCA.CP03', conditionId: 'entra-users-consent-risky-apps', polarity: 'fail-means-met',
ruleText: "Default Settings - Consent Policy Settings - Block user consent for risky apps.", sources: [EIDSCA_TESTS] },
{ tool: 'maester', ruleId: 'MT.1024.staleAppCreds', conditionId: 'entra-app-credentials-stale', polarity: 'fail-means-met',
ruleText: "Remove unused credentials from applications.", sources: [maesterTest('MT.1024')] },
{ tool: 'maester', ruleId: 'MT.1024.staleApps', conditionId: 'entra-app-credentials-stale', polarity: 'fail-means-met',
ruleText: "Remove unused applications.", sources: [maesterTest('MT.1024')] },
{ tool: 'maester', ruleId: 'CISA.MS.AAD.8.2', conditionId: 'entra-guest-invites-unrestricted', polarity: 'fail-means-met',
ruleText: "Only users with the Guest Inviter role SHOULD be able to invite guest users.", sources: [SCUBA_AAD] },
{ tool: 'maester', ruleId: 'EIDSCA.AP04', conditionId: 'entra-guest-invites-unrestricted', polarity: 'fail-means-met',
ruleText: "Default Authorization Settings - Guest invite restrictions.", sources: [EIDSCA_TESTS] },
{ tool: 'maester', ruleId: 'CISA.MS.AAD.8.3', conditionId: 'entra-guest-invite-domains-unrestricted', polarity: 'fail-means-met',
ruleText: "Guest invites SHOULD only be allowed to specific external domains that have been authorized by the agency for legitimate business purposes.", sources: [SCUBA_AAD] },
{ tool: 'maester', ruleId: 'EIDSCA.AP05', conditionId: 'entra-self-service-signup-allowed', polarity: 'fail-means-met',
ruleText: "Default Authorization Settings - Sign-up for email based subscription.", sources: [EIDSCA_TESTS] },
{ tool: 'maester', ruleId: 'EIDSCA.AP06', conditionId: 'entra-self-service-signup-allowed', polarity: 'fail-means-met',
ruleText: "Default Authorization Settings - User can join the tenant by email validation.", sources: [EIDSCA_TESTS] },
{ tool: 'maester', ruleId: 'CISA.MS.AAD.8.1', conditionId: 'entra-guest-directory-access-broad', polarity: 'fail-means-met',
ruleText: "Guest users SHOULD have limited or restricted access to Entra ID directory objects.", sources: [SCUBA_AAD] },
{ tool: 'maester', ruleId: 'EIDSCA.AP07', conditionId: 'entra-guest-directory-access-broad', polarity: 'fail-means-met',
ruleText: "Default Authorization Settings - Guest user access.", sources: [EIDSCA_TESTS] },
{ tool: 'maester', ruleId: 'CISA.MS.SHAREPOINT.1.1', conditionId: 'sharepoint-external-sharing-broad', polarity: 'fail-means-met',
ruleText: "External sharing for SharePoint SHALL be limited to Existing guests or Only People in your organization.", sources: [SCUBA_SHAREPOINT] },
{ tool: 'maester', ruleId: 'CISA.MS.SHAREPOINT.1.3', conditionId: 'sharepoint-external-sharing-broad', polarity: 'fail-means-met',
ruleText: "External sharing SHALL be restricted to approved external domains and/or users in approved security groups per interagency collaboration needs.", sources: [SCUBA_SHAREPOINT] },
{ tool: 'maester', ruleId: 'MT.1045', conditionId: 'teams-auto-admit-broad', polarity: 'fail-means-met',
ruleText: "Only invited users should be automatically admitted to Teams meetings", sources: [maesterTest('MT.1045')] },
{ tool: 'cis-cat', ruleId: '2.3.11.6', conditionId: 'lm-auth-level-below-refuse-lm-ntlm', polarity: 'fail-means-met',
ruleText: "Ensure 'Network security: LAN Manager authentication level' is set to 'Send NTLMv2 response only. Refuse LM & NTLM'",
requiredTitleFragment: "'Network security: LAN Manager authentication level'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '2.3.5.4', conditionId: 'ldap-signing-enforcement-off', polarity: 'fail-means-met',
ruleText: "Ensure 'Domain controller: LDAP server signing requirements Enforcement' is set to 'Enabled' (DC only)",
requiredTitleFragment: "'Domain controller: LDAP server signing requirements Enforcement'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'cis-cat', ruleId: '18.5.1', conditionId: 'autoadminlogon-not-disabled', polarity: 'fail-means-met',
ruleText: "Ensure 'MSS: (AutoAdminLogon) Enable Automatic Logon' is set to 'Disabled'",
requiredTitleFragment: "'MSS: (AutoAdminLogon) Enable Automatic Logon'", sources: [CIS_WINDOWS_SERVER] },
{ tool: 'pingcastle', ruleId: 'A-DnsZoneAUCreateChild', conditionId: 'adidns-authenticated-create', polarity: 'fail-means-met',
ruleText: "Authenticated Users can create DNS records", sources: [PINGCASTLE_RULES] },
{ tool: 'pingcastle', ruleId: 'A-DCLdapsProtocolAdvanced', conditionId: 'dc-ldaps-legacy-tls', polarity: 'fail-means-met',
ruleText: "At least one DC is using Tls1.0 or Tls1.1.", sources: [PINGCASTLE_RULES] },
{ tool: 'pingcastle', ruleId: 'A-WeakRSARootCert2', conditionId: 'weak-trusted-root-certificate', polarity: 'fail-means-met',
ruleText: "At least one trusted certificate found has a relatively weak RSA key", sources: [PINGCASTLE_RULES] },
{ tool: 'maester', ruleId: 'CISA.MS.AAD.7.1', conditionId: 'entra-global-admin-count-outside-range', polarity: 'fail-means-met',
ruleText: "A minimum of two users and a maximum of eight users SHALL be provisioned with the Global Administrator role.", sources: [SCUBA_AAD] },
{ tool: 'maester', ruleId: 'CIS.M365.1.1.3', conditionId: 'entra-global-admin-count-outside-range', polarity: 'fail-means-met',
ruleText: "(L1) Ensure that between two and four global admins are designated", sources: [CIS_M365] },
{ tool: 'maester', ruleId: 'MT.1032', conditionId: 'entra-global-admin-count-outside-range', polarity: 'fail-means-met',
ruleText: "Limited number of Global Admins are assigned.", sources: [maesterTest('MT.1032')] },
{ tool: 'maester', ruleId: 'MT.1005', conditionId: 'entra-emergency-access-not-excluded', polarity: 'fail-means-met',
ruleText: "All Conditional Access policies are configured to exclude at least one emergency/break glass account or group.", sources: [maesterTest('MT.1005')] },
{ tool: 'maester', ruleId: 'MT.1030', conditionId: 'entra-eligible-roles-unused', polarity: 'fail-means-met',
ruleText: "Eligible role assignments on Control Plane are in use by administrators.", sources: [maesterTest('MT.1030')] },
{ tool: 'maester', ruleId: 'MT.INV.001', conditionId: 'entra-privileged-unusual-signin', polarity: 'fail-means-met',
ruleText: "Unusual sign-in activity detected for privileged accounts", sources: [maesterTest('MT.INV')] },
{ tool: 'maester', ruleId: 'MT.INV.003', conditionId: 'entra-privileged-accounts-inactive', polarity: 'fail-means-met',
ruleText: "Inactive privileged accounts detected", sources: [maesterTest('MT.INV')] },
{ tool: 'maester', ruleId: 'MT.1064', conditionId: 'azure-management-group-creation-open', polarity: 'fail-means-met',
ruleText: "Ensure that write permissions are required to create new management groups", sources: [maesterTest('MT.1064')] },
{ tool: 'maester', ruleId: 'MT.1020', conditionId: 'entra-ca-policy-integrity-gaps', polarity: 'fail-means-met',
ruleText: "All Conditional Access policies are configured to exclude directory synchronization accounts or do not scope them.", sources: [maesterTest('MT.1020')] },
{ tool: 'maester', ruleId: 'MT.1036', conditionId: 'entra-ca-policy-integrity-gaps', polarity: 'fail-means-met',
ruleText: "All excluded objects should have a fallback include in another policy.", sources: [maesterTest('MT.1036')] },
{ tool: 'maester', ruleId: 'MT.1038', conditionId: 'entra-ca-policy-integrity-gaps', polarity: 'fail-means-met',
ruleText: "Conditional Access policies should not include or exclude deleted groups.", sources: [maesterTest('MT.1038')] },
{ tool: 'maester', ruleId: 'MT.1066', conditionId: 'entra-ca-policy-integrity-gaps', polarity: 'fail-means-met',
ruleText: "Conditional Access policies should not reference non-existent users, groups, or roles.", sources: [maesterTest('MT.1066')] },
{ tool: 'maester', ruleId: 'MT.1015', conditionId: 'entra-ca-coverage-gaps', polarity: 'fail-means-met',
ruleText: "At least one Conditional Access policy is configured to block access for unknown or unsupported device platforms.", sources: [maesterTest('MT.1015')] },
{ tool: 'maester', ruleId: 'MT.1019', conditionId: 'entra-ca-coverage-gaps', polarity: 'fail-means-met',
ruleText: "At least one Conditional Access policy is configured to enable application enforced restrictions.", sources: [maesterTest('MT.1019')] },
{ tool: 'maester', ruleId: 'MT.1071', conditionId: 'entra-ca-coverage-gaps', polarity: 'fail-means-met',
ruleText: "At least one Conditional Access policy explicitly includes Azure DevOps.", sources: [maesterTest('MT.1071')] },
{ tool: 'maester', ruleId: 'MT.1024.insiderRiskPolicy', conditionId: 'entra-ca-coverage-gaps', polarity: 'fail-means-met',
ruleText: "Protect your tenant with Insider Risk condition in Conditional Access policy.", sources: [maesterTest('MT.1024')] },
{ tool: 'maester', ruleId: 'EIDSCA.AF03', conditionId: 'entra-fido2-restrictions-off', polarity: 'fail-means-met',
ruleText: "Authentication Method - FIDO2 security key - Enforce attestation.", sources: [EIDSCA_TESTS] },
{ tool: 'maester', ruleId: 'EIDSCA.AF04', conditionId: 'entra-fido2-restrictions-off', polarity: 'fail-means-met',
ruleText: "Authentication Method - FIDO2 security key - Enforce key restrictions.", sources: [EIDSCA_TESTS] },
{ tool: 'maester', ruleId: 'EIDSCA.AM02', conditionId: 'entra-authenticator-otp-allowed', polarity: 'fail-means-met',
ruleText: "Authentication Method - Microsoft Authenticator - Allow use of Microsoft Authenticator OTP.", sources: [EIDSCA_TESTS] },
{ tool: 'maester', ruleId: 'MT.1053', conditionId: 'intune-device-compliance-gaps', polarity: 'fail-means-met',
ruleText: "Ensure intune device clean-up rule is configured", sources: [maesterTest('MT.1053')] },
{ tool: 'maester', ruleId: 'MT.1054', conditionId: 'intune-device-compliance-gaps', polarity: 'fail-means-met',
ruleText: "Ensure built-in Device Compliance Policy marks devices with no compliance policy assigned as 'Not compliant'", sources: [maesterTest('MT.1054')] },
{ tool: 'maester', ruleId: 'MT.1024.passwordHashSync', conditionId: 'entra-leaked-credential-detection-limited', polarity: 'fail-means-met',
ruleText: "Enable password hash sync if hybrid.", sources: [maesterTest('MT.1024')] },
{ tool: 'maester', ruleId: 'CISA.MS.AAD.5.3', conditionId: 'entra-admin-consent-workflow-missing', polarity: 'fail-means-met',
ruleText: "An admin consent workflow SHALL be configured for applications.", sources: [SCUBA_AAD] },
{ tool: 'maester', ruleId: 'EIDSCA.CR01', conditionId: 'entra-admin-consent-workflow-missing', polarity: 'fail-means-met',
ruleText: "Consent Framework - Admin Consent Request - Policy to enable or disable admin consent request feature.", sources: [EIDSCA_TESTS] },
{ tool: 'maester', ruleId: 'EIDSCA.CP04', conditionId: 'entra-admin-consent-workflow-missing', polarity: 'fail-means-met',
ruleText: "Default Settings - Consent Policy Settings - Users can request admin consent to apps they are unable to consent to.", sources: [EIDSCA_TESTS] },
{ tool: 'maester', ruleId: 'MT.1024.applicationCredentialExpiry', conditionId: 'entra-app-credentials-expiring', polarity: 'fail-means-met',
ruleText: "Renew expiring application credentials.", sources: [maesterTest('MT.1024')] },
{ tool: 'maester', ruleId: 'MT.INV.002', conditionId: 'entra-app-credentials-expiring', polarity: 'fail-means-met',
ruleText: "Service principal credentials nearing expiration", sources: [maesterTest('MT.INV')] },
{ tool: 'maester', ruleId: 'CIS.M365.1.2.1', conditionId: 'm365-public-groups-unmanaged', polarity: 'fail-means-met',
ruleText: "(L2) Ensure that only organizationally managed/approved public groups exist", sources: [CIS_M365] },
{ tool: 'pingcastle', ruleId: 'P-ServiceDomainAdmin', conditionId: 'domain-admins-password-never-expires', polarity: 'fail-means-met',
ruleText: "Presence of accounts with non-expiring passwords in the domain admin group (at least 2 accounts)", sources: [PINGCASTLE_RULES] },
{ tool: 'purple-knight', ruleId: 'SI000084', conditionId: 'gmsa-not-used', polarity: 'fail-means-met',
ruleText: "gMSA not in use", sources: [PURPLE_KNIGHT] },
{ tool: 'pingcastle', ruleId: 'A-DsHeuristicsLDAPSecurity', conditionId: 'dsheuristics-ldap-mitigation-off', polarity: 'fail-means-met',
ruleText: "DsHeuristics has not been set to enable the mitigation for CVE-2021-42291", sources: [PINGCASTLE_RULES] },
{ tool: 'pingcastle', ruleId: 'S-DC-SubnetMissing', conditionId: 'dc-subnet-declaration-incomplete', polarity: 'fail-means-met',
ruleText: "The subnet declaration is incomplete", sources: [PINGCASTLE_RULES] }
],
cisSectionRules: [
{ tool: 'cis-cat', sectionTitle: "Advanced Audit Policy Configuration", conditionId: 'cis-audit-policy-unmet' },
{ tool: 'cis-cat', sectionTitle: "Audit", conditionId: 'cis-audit-policy-unmet' },
{ tool: 'cis-cat', sectionTitle: "Event Log Service", conditionId: 'cis-event-log-unmet' },
{ tool: 'cis-cat', sectionTitle: "Microsoft Defender Antivirus (formerly Windows Defender and Windows Defender Antivirus)", conditionId: 'cis-defender-unmet' },
{ tool: 'cis-cat', sectionTitle: "Early Launch Antimalware", conditionId: 'cis-defender-unmet' },
{ tool: 'cis-cat', sectionTitle: "Windows Security (formerly Windows Defender Security Center)", conditionId: 'cis-defender-unmet' },
{ tool: 'cis-cat', sectionTitle: "Desktop App Installer", conditionId: 'cis-software-installation-unmet' },
{ tool: 'cis-cat', sectionTitle: "App Package Deployment", conditionId: 'cis-software-installation-unmet' },
{ tool: 'cis-cat', sectionTitle: "Windows Installer", conditionId: 'cis-software-installation-unmet' },
// Section titles match without regard to letter case; this one is lower-cased for the local-only core check.
{ tool: 'cis-cat', sectionTitle: "file explorer (formerly windows explorer)", conditionId: 'cis-exploit-mitigations-unmet' },
{ tool: 'cis-cat', sectionTitle: "Filesystem (formerly NTFS Filesystem)", conditionId: 'cis-exploit-mitigations-unmet' },
{ tool: 'cis-cat', sectionTitle: "MS Security Guide", conditionId: 'cis-exploit-mitigations-unmet' },
{ tool: 'cis-cat', sectionTitle: "Remote Desktop Services (formerly Terminal Services)", conditionId: 'cis-remote-desktop-unmet' },
{ tool: 'cis-cat', sectionTitle: "Remote Assistance", conditionId: 'cis-remote-desktop-unmet' },
{ tool: 'cis-cat', sectionTitle: "Windows Remote Management (WinRM)", conditionId: 'cis-remote-management-unmet' },
{ tool: 'cis-cat', sectionTitle: "Windows Remote Shell", conditionId: 'cis-remote-management-unmet' },
{ tool: 'cis-cat', sectionTitle: "Domain Profile", conditionId: 'cis-firewall-profile-unmet' },
{ tool: 'cis-cat', sectionTitle: "Private Profile", conditionId: 'cis-firewall-profile-unmet' },
{ tool: 'cis-cat', sectionTitle: "Public Profile", conditionId: 'cis-firewall-profile-unmet' },
{ tool: 'cis-cat', sectionTitle: "MSS (Legacy)", conditionId: 'cis-network-stack-unmet' },
{ tool: 'cis-cat', sectionTitle: "TCPIP Settings", conditionId: 'cis-network-stack-unmet' },
{ tool: 'cis-cat', sectionTitle: "Network Connections", conditionId: 'cis-network-stack-unmet' },
{ tool: 'cis-cat', sectionTitle: "Microsoft Peer-to-Peer Networking Services", conditionId: 'cis-network-stack-unmet' },
{ tool: 'cis-cat', sectionTitle: "Link-Layer Topology Discovery", conditionId: 'cis-network-stack-unmet' },
{ tool: 'cis-cat', sectionTitle: "Windows Connection Manager", conditionId: 'cis-network-stack-unmet' },
{ tool: 'cis-cat', sectionTitle: "Lanman Server", conditionId: 'cis-smb-hardening-unmet' },
{ tool: 'cis-cat', sectionTitle: "Lanman Workstation", conditionId: 'cis-smb-hardening-unmet' },
{ tool: 'cis-cat', sectionTitle: "DNS Client", conditionId: 'cis-name-resolution-unmet' },
{ tool: 'cis-cat', sectionTitle: "DC Locator DNS Records", conditionId: 'cis-name-resolution-unmet' },
{ tool: 'cis-cat', sectionTitle: "Custom Settings", conditionId: 'cis-name-resolution-unmet' },
{ tool: 'cis-cat', sectionTitle: "Network security", conditionId: 'cis-authentication-hardening-unmet' },
{ tool: 'cis-cat', sectionTitle: "Kerberos", conditionId: 'cis-authentication-hardening-unmet' },
{ tool: 'cis-cat', sectionTitle: "Printers", conditionId: 'cis-print-hardening-unmet' },
{ tool: 'cis-cat', sectionTitle: "User Rights Assignment", conditionId: 'cis-user-rights-unmet' },
{ tool: 'cis-cat', sectionTitle: "Credentials Delegation", conditionId: 'cis-credential-handling-unmet' },
{ tool: 'cis-cat', sectionTitle: "Windows Logon Options", conditionId: 'cis-credential-handling-unmet' },
{ tool: 'cis-cat', sectionTitle: "Domain controller", conditionId: 'cis-domain-controller-options-unmet' },
{ tool: 'cis-cat', sectionTitle: "Accounts", conditionId: 'cis-builtin-accounts-unmet' },
{ tool: 'cis-cat', sectionTitle: "Security Account Manager", conditionId: 'cis-account-database-unmet' },
{ tool: 'cis-cat', sectionTitle: "Interactive logon", conditionId: 'cis-sign-in-screen-unmet' },
{ tool: 'cis-cat', sectionTitle: "Logon", conditionId: 'cis-sign-in-screen-unmet' },
{ tool: 'cis-cat', sectionTitle: "Personalization", conditionId: 'cis-sign-in-screen-unmet' },
{ tool: 'cis-cat', sectionTitle: "Windows Ink Workspace", conditionId: 'cis-sign-in-screen-unmet' },
{ tool: 'cis-cat', sectionTitle: "Credential User Interface", conditionId: 'cis-sign-in-screen-unmet' },
{ tool: 'cis-cat', sectionTitle: "Locale Services", conditionId: 'cis-sign-in-screen-unmet' },
{ tool: 'cis-cat', sectionTitle: "Camera", conditionId: 'cis-device-access-unmet' },
{ tool: 'cis-cat', sectionTitle: "Sleep Settings", conditionId: 'cis-device-access-unmet' },
{ tool: 'cis-cat', sectionTitle: "Biometrics", conditionId: 'cis-device-access-unmet' },
{ tool: 'cis-cat', sectionTitle: "Kernel DMA Protection", conditionId: 'cis-device-access-unmet' },
{ tool: 'cis-cat', sectionTitle: "Connect", conditionId: 'cis-device-access-unmet' },
{ tool: 'cis-cat', sectionTitle: "Windows Connect Now", conditionId: 'cis-device-access-unmet' },
{ tool: 'cis-cat', sectionTitle: "Data Collection and Preview Builds", conditionId: 'cis-telemetry-unmet' },
{ tool: 'cis-cat', sectionTitle: "Windows Performance PerfTrack", conditionId: 'cis-telemetry-unmet' },
{ tool: 'cis-cat', sectionTitle: "Microsoft Support Diagnostic Tool", conditionId: 'cis-telemetry-unmet' },
{ tool: 'cis-cat', sectionTitle: "Software Protection Platform", conditionId: 'cis-telemetry-unmet' },
{ tool: 'cis-cat', sectionTitle: "User Profiles", conditionId: 'cis-telemetry-unmet' },
{ tool: 'cis-cat', sectionTitle: "Cloud Content", conditionId: 'cis-cloud-sync-unmet' },
{ tool: 'cis-cat', sectionTitle: "Messaging", conditionId: 'cis-cloud-sync-unmet' },
{ tool: 'cis-cat', sectionTitle: "OS Policies", conditionId: 'cis-cloud-sync-unmet' },
{ tool: 'cis-cat', sectionTitle: "Microsoft account", conditionId: 'cis-cloud-sync-unmet' },
{ tool: 'cis-cat', sectionTitle: "App runtime", conditionId: 'cis-cloud-sync-unmet' },
{ tool: 'cis-cat', sectionTitle: "Search", conditionId: 'cis-cloud-sync-unmet' },
{ tool: 'cis-cat', sectionTitle: "Location and Sensors", conditionId: 'cis-cloud-sync-unmet' },
{ tool: 'cis-cat', sectionTitle: "Internet Communication settings", conditionId: 'cis-internet-communication-unmet' },
{ tool: 'cis-cat', sectionTitle: "RSS Feeds", conditionId: 'cis-internet-communication-unmet' },
{ tool: 'cis-cat', sectionTitle: "Push To Install", conditionId: 'cis-internet-communication-unmet' },
{ tool: 'cis-cat', sectionTitle: "Regional and Language Options", conditionId: 'cis-internet-communication-unmet' },
{ tool: 'cis-cat', sectionTitle: "Control Panel", conditionId: 'cis-internet-communication-unmet' },
{ tool: 'cis-cat', sectionTitle: "Fonts", conditionId: 'cis-internet-communication-unmet' },
{ tool: 'cis-cat', sectionTitle: "Device Installation", conditionId: 'cis-internet-communication-unmet' },
{ tool: 'cis-cat', sectionTitle: "Notifications", conditionId: 'cis-internet-communication-unmet' },
{ tool: 'cis-cat', sectionTitle: "Windows Update", conditionId: 'cis-windows-update-unmet' },
{ tool: 'cis-cat', sectionTitle: "Group Policy", conditionId: 'cis-policy-processing-unmet' },
{ tool: 'cis-cat', sectionTitle: "Windows Time Service", conditionId: 'cis-time-sync-unmet' },
{ tool: 'cis-cat', sectionTitle: "AutoPlay Policies", conditionId: 'autorun-enabled' },
{ tool: 'cis-cat', sectionTitle: "Password Policy", conditionId: 'cis-password-policy-unmet' },
{ tool: 'cis-cat', sectionTitle: "Account Lockout Policy", conditionId: 'cis-password-policy-unmet' },
{ tool: 'cis-cat', sectionTitle: "Domain member", conditionId: 'cis-authentication-hardening-unmet' },
{ tool: 'cis-cat', sectionTitle: "Microsoft network client", conditionId: 'cis-smb-hardening-unmet' },
{ tool: 'cis-cat', sectionTitle: "Microsoft network server", conditionId: 'cis-smb-hardening-unmet' },
{ tool: 'cis-cat', sectionTitle: "Network access", conditionId: 'cis-anonymous-access-unmet' },
{ tool: 'cis-cat', sectionTitle: "User Account Control", conditionId: 'cis-local-privilege-hardening-unmet' },
{ tool: 'cis-cat', sectionTitle: "System objects", conditionId: 'cis-local-privilege-hardening-unmet' },
{ tool: 'cis-cat', sectionTitle: "Shutdown", conditionId: 'cis-device-access-unmet' },
{ tool: 'cis-cat', sectionTitle: "Devices", conditionId: 'cis-print-hardening-unmet' },
{ tool: 'cis-cat', sectionTitle: "Attachment Manager", conditionId: 'cis-defender-unmet' },
{ tool: 'cis-cat', sectionTitle: "Playback", conditionId: 'cis-internet-communication-unmet' }
],
gpoVerdictRules: [
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeBackupPrivilege" }, conditionId: 'gpo-privileged-rights-deviate' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeRestorePrivilege" }, conditionId: 'gpo-privileged-rights-deviate' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeLoadDriverPrivilege" }, conditionId: 'gpo-privileged-rights-deviate' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeIncreaseBasePriorityPrivilege" }, conditionId: 'gpo-privileged-rights-deviate' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeRemoteShutdownPrivilege" }, conditionId: 'gpo-privileged-rights-deviate' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeAuditPrivilege" }, conditionId: 'gpo-privileged-rights-deviate' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeDebugPrivilege" }, conditionId: 'gpo-privileged-rights-deviate' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeTakeOwnershipPrivilege" }, conditionId: 'gpo-privileged-rights-deviate' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeTcbPrivilege" }, conditionId: 'gpo-privileged-rights-deviate' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeImpersonatePrivilege" }, conditionId: 'gpo-privileged-rights-deviate' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeCreateTokenPrivilege" }, conditionId: 'gpo-privileged-rights-deviate' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeSecurityPrivilege" }, conditionId: 'gpo-privileged-rights-deviate' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeSystemEnvironmentPrivilege" }, conditionId: 'gpo-privileged-rights-deviate' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeManageVolumePrivilege" }, conditionId: 'gpo-privileged-rights-deviate' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeAssignPrimaryTokenPrivilege" }, conditionId: 'gpo-privileged-rights-deviate' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeBatchLogonRight" }, conditionId: 'gpo-privileged-rights-deviate' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeServiceLogonRight" }, conditionId: 'gpo-privileged-rights-deviate' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeEnableDelegationPrivilege" }, conditionId: 'gpo-delegation-right-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeNetworkLogonRight" }, conditionId: 'gpo-network-logon-right-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeDenyNetworkLogonRight" }, conditionId: 'gpo-network-logon-right-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeRemoteInteractiveLogonRight" }, conditionId: 'gpo-network-logon-right-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeDenyRemoteInteractiveLogonRight" }, conditionId: 'gpo-network-logon-right-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeInteractiveLogonRight" }, conditionId: 'gpo-local-logon-right-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeDenyInteractiveLogonRight" }, conditionId: 'gpo-local-logon-right-deviates' },
{ target: { mechanism: 'advanced-audit-policy', scope: 'computer' }, conditionId: 'gpo-audit-policy-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "Software\\Policies\\Microsoft\\WindowsFirewall\\DomainProfile\\Logging" }, conditionId: 'gpo-firewall-logging-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "Software\\Policies\\Microsoft\\WindowsFirewall\\DomainProfile" }, conditionId: 'gpo-firewall-profile-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "Software\\Policies\\Microsoft\\WindowsFirewall\\PrivateProfile\\Logging" }, conditionId: 'gpo-firewall-logging-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "Software\\Policies\\Microsoft\\WindowsFirewall\\PrivateProfile" }, conditionId: 'gpo-firewall-profile-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "Software\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile\\Logging" }, conditionId: 'gpo-firewall-logging-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "Software\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile" }, conditionId: 'gpo-firewall-profile-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "Software\\Policies\\Microsoft\\Windows NT\\DNSClient" }, conditionId: 'gpo-dns-client-policy-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "Software\\Policies\\Microsoft\\Windows\\Safer" }, conditionId: 'gpo-application-control-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "Software\\Policies\\Microsoft\\Windows\\SrpV2" }, conditionId: 'gpo-application-control-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "System Access", key: "LockoutDuration" }, conditionId: 'gpo-lockout-timing-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "System Access", key: "ResetLockoutCount" }, conditionId: 'gpo-lockout-timing-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "System Access", key: "MaximumPasswordAge" }, conditionId: 'gpo-password-lifetime-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "System Access", key: "MinimumPasswordAge" }, conditionId: 'gpo-password-lifetime-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "System Access", key: "PasswordHistorySize" }, conditionId: 'gpo-password-lifetime-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "System Access", key: "ClearTextPassword" }, conditionId: 'gpo-reversible-password-storage-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "System Access", key: "ForceLogoffWhenHourExpire" }, conditionId: 'gpo-logon-hours-enforcement-deviates' },
{ target: { mechanism: 'registry-key', scope: 'user', key: "Software\\Policies\\Microsoft\\Office\\16.0\\Common", valueName: "fbaenabledhosts" }, conditionId: 'gpo-office-forms-auth-hosts-deviate' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "Software\\Policies\\Microsoft\\Windows\\System", valueName: "AllowDomainPINLogon" }, conditionId: 'gpo-convenience-pin-sign-in-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeTrustedCredManAccessPrivilege" }, conditionId: 'gpo-privileged-rights-deviate' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeCreateSymbolicLinkPrivilege" }, conditionId: 'gpo-privileged-rights-deviate' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeCreateGlobalPrivilege" }, conditionId: 'gpo-privileged-rights-deviate' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeCreatePermanentPrivilege" }, conditionId: 'gpo-privileged-rights-deviate' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeLockMemoryPrivilege" }, conditionId: 'gpo-privileged-rights-deviate' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeCreatePagefilePrivilege" }, conditionId: 'gpo-privileged-rights-deviate' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeProfileSingleProcessPrivilege" }, conditionId: 'gpo-privileged-rights-deviate' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeSystemProfilePrivilege" }, conditionId: 'gpo-privileged-rights-deviate' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeSystemtimePrivilege" }, conditionId: 'gpo-privileged-rights-deviate' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeIncreaseQuotaPrivilege" }, conditionId: 'gpo-privileged-rights-deviate' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeMachineAccountPrivilege" }, conditionId: 'gpo-privileged-rights-deviate' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeDenyBatchLogonRight" }, conditionId: 'gpo-privileged-rights-deviate' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Privilege Rights", key: "SeDenyServiceLogonRight" }, conditionId: 'gpo-privileged-rights-deviate' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "Software\\Policies\\Microsoft\\Windows\\PowerShell" }, conditionId: 'gpo-powershell-logging-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "Software\\Policies\\Microsoft\\Windows\\EventLog" }, conditionId: 'gpo-event-logging-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Audit" }, conditionId: 'gpo-event-logging-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\SCENoApplyLegacyAuditPolicy" }, conditionId: 'gpo-audit-policy-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "Software\\Policies\\Microsoft\\Windows NT\\Terminal Services" }, conditionId: 'gpo-remote-desktop-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "Software\\Policies\\Microsoft\\Windows\\WinRM" }, conditionId: 'gpo-remote-management-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\System\\CurrentControlSet\\Services\\LanManServer\\Parameters\\EnableSecuritySignature" }, conditionId: 'gpo-smb-hardening-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\System\\CurrentControlSet\\Services\\LanmanWorkstation\\Parameters\\EnableSecuritySignature" }, conditionId: 'gpo-smb-hardening-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\System\\CurrentControlSet\\Services\\LanmanWorkstation\\Parameters\\EnablePlainTextPassword" }, conditionId: 'gpo-smb-hardening-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "Software\\Policies\\Microsoft\\Windows\\LanmanWorkstation" }, conditionId: 'gpo-smb-hardening-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "System\\CurrentControlSet\\Services\\LanmanServer\\Parameters", valueName: "SMB1" }, conditionId: 'gpo-smb-hardening-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "System\\CurrentControlSet\\Services\\MrxSmb10" }, conditionId: 'gpo-smb-hardening-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\System\\CurrentControlSet\\Services\\Netlogon\\Parameters\\RequireSignOrSeal" }, conditionId: 'gpo-secure-channel-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\System\\CurrentControlSet\\Services\\Netlogon\\Parameters\\SealSecureChannel" }, conditionId: 'gpo-secure-channel-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\System\\CurrentControlSet\\Services\\Netlogon\\Parameters\\SignSecureChannel" }, conditionId: 'gpo-secure-channel-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\System\\CurrentControlSet\\Services\\Netlogon\\Parameters\\RequireStrongKey" }, conditionId: 'gpo-secure-channel-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\System\\CurrentControlSet\\Services\\Netlogon\\Parameters\\DisablePasswordChange" }, conditionId: 'gpo-secure-channel-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\System\\CurrentControlSet\\Services\\Netlogon\\Parameters\\MaximumPasswordAge" }, conditionId: 'gpo-secure-channel-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\MSV1_0\\NTLMMinClientSec" }, conditionId: 'gpo-ntlm-hardening-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\MSV1_0\\NTLMMinServerSec" }, conditionId: 'gpo-ntlm-hardening-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\MSV1_0\\AllowNullSessionFallback" }, conditionId: 'gpo-ntlm-hardening-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\pku2u\\AllowOnlineID" }, conditionId: 'gpo-ntlm-hardening-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\UseMachineId" }, conditionId: 'gpo-ntlm-hardening-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "System Access", key: "LSAAnonymousNameLookup" }, conditionId: 'gpo-anonymous-access-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "System Access", key: "EnableGuestAccount" }, conditionId: 'gpo-anonymous-access-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\RestrictAnonymous" }, conditionId: 'gpo-anonymous-access-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\RestrictAnonymousSAM" }, conditionId: 'gpo-anonymous-access-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\EveryoneIncludesAnonymous" }, conditionId: 'gpo-anonymous-access-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\ForceGuest" }, conditionId: 'gpo-anonymous-access-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\System\\CurrentControlSet\\Services\\LanManServer\\Parameters\\RestrictNullSessAccess" }, conditionId: 'gpo-anonymous-access-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\System\\CurrentControlSet\\Services\\LanManServer\\Parameters\\NullSessionPipes" }, conditionId: 'gpo-anonymous-access-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\System\\CurrentControlSet\\Services\\LanManServer\\Parameters\\NullSessionShares" }, conditionId: 'gpo-anonymous-access-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\System\\CurrentControlSet\\Control\\SecurePipeServers\\Winreg\\AllowedExactPaths\\Machine" }, conditionId: 'gpo-anonymous-access-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\System\\CurrentControlSet\\Control\\SecurePipeServers\\Winreg\\AllowedPaths\\Machine" }, conditionId: 'gpo-anonymous-access-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "Software\\Policies\\Microsoft\\Windows NT\\Rpc" }, conditionId: 'gpo-anonymous-access-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\NoLMHash" }, conditionId: 'gpo-lm-hash-storage-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\Parameters\\SupportedEncryptionTypes" }, conditionId: 'gpo-kerberos-encryption-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA" }, conditionId: 'gpo-local-privilege-hardening-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorAdmin" }, conditionId: 'gpo-local-privilege-hardening-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorUser" }, conditionId: 'gpo-local-privilege-hardening-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableInstallerDetection" }, conditionId: 'gpo-local-privilege-hardening-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableSecureUIAPaths" }, conditionId: 'gpo-local-privilege-hardening-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop" }, conditionId: 'gpo-local-privilege-hardening-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableVirtualization" }, conditionId: 'gpo-local-privilege-hardening-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\FilterAdministratorToken" }, conditionId: 'gpo-local-privilege-hardening-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableUIADesktopToggle" }, conditionId: 'gpo-local-privilege-hardening-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\ProtectionMode" }, conditionId: 'gpo-local-privilege-hardening-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\Kernel\\ObCaseInsensitive" }, conditionId: 'gpo-local-privilege-hardening-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", valueName: "LocalAccountTokenFilterPolicy" }, conditionId: 'gpo-local-privilege-hardening-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "Software\\Policies\\Microsoft\\Windows\\Installer" }, conditionId: 'gpo-local-privilege-hardening-deviates' },
{ target: { mechanism: 'registry-key', scope: 'user', key: "Software\\Policies\\Microsoft\\Windows\\Installer" }, conditionId: 'gpo-local-privilege-hardening-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "System\\CurrentControlSet\\Control\\Lsa", valueName: "RunAsPPL" }, conditionId: 'gpo-credential-protection-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "Software\\Policies\\Microsoft\\Windows\\DeviceGuard" }, conditionId: 'gpo-credential-protection-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "Software\\Policies\\Microsoft\\Windows\\CredentialsDelegation" }, conditionId: 'gpo-credential-protection-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest" }, conditionId: 'gpo-credential-protection-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\DisableDomainCreds" }, conditionId: 'gpo-credential-protection-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\CachedLogonsCount" }, conditionId: 'gpo-credential-protection-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "Software\\Policies\\Microsoft\\Windows NT\\Printers" }, conditionId: 'gpo-print-hardening-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\System\\CurrentControlSet\\Control\\Print\\Providers\\LanMan Print Services\\Servers\\AddPrinterDrivers" }, conditionId: 'gpo-print-hardening-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "Software\\Policies\\Microsoft\\Windows Defender" }, conditionId: 'gpo-malware-protection-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "Software\\Policies\\Microsoft\\Edge" }, conditionId: 'gpo-malware-protection-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "Software\\Policies\\Microsoft\\Windows\\Explorer" }, conditionId: 'gpo-malware-protection-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, conditionId: 'gpo-malware-protection-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "Software\\Policies\\Microsoft\\Windows\\System", valueName: "EnableSmartScreen" }, conditionId: 'gpo-malware-protection-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "Software\\Policies\\Microsoft\\Windows\\System", valueName: "ShellSmartScreenLevel" }, conditionId: 'gpo-malware-protection-deviates' },
{ target: { mechanism: 'registry-key', scope: 'user', key: "Software\\Policies\\Microsoft\\Office\\16.0" }, conditionId: 'gpo-office-hardening-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "Software\\Policies\\Microsoft\\Windows\\DeviceInstall" }, conditionId: 'gpo-local-device-access-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "Software\\Policies\\Microsoft\\FVE" }, conditionId: 'gpo-local-device-access-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "Software\\Policies\\Microsoft\\Windows\\Kernel DMA Protection" }, conditionId: 'gpo-local-device-access-deviates' },
{ target: { mechanism: 'registry-key', scope: 'computer', key: "Software\\Policies\\Microsoft\\Windows\\Personalization" }, conditionId: 'gpo-local-device-access-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ShutdownWithoutLogon" }, conditionId: 'gpo-local-device-access-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\InactivityTimeoutSecs" }, conditionId: 'gpo-local-device-access-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableCAD" }, conditionId: 'gpo-local-device-access-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DontDisplayLastUserName" }, conditionId: 'gpo-local-device-access-deviates' },
{ target: { mechanism: 'security-template', scope: 'computer', section: "Registry Values", key: "MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\ScRemoveOption" }, conditionId: 'gpo-local-device-access-deviates' }
],
primaryClusters: {
'adcs-web-enrollment-esc8': 'adcs-escalation',
'cis-print-hardening-unmet': 'host-credential-privilege-exposure',
'ad-admins-delegatable': 'kerberos-delegation-abuse',
'ad-privileged-spn': 'kerberoasting-exposure',
'ad-service-accounts-no-strong-policy': 'kerberoasting-exposure',
'ad-privileged-password-never-expires': 'password-guessing-exposure',
'ad-password-never-expires': 'password-guessing-exposure',
'domain-admins-password-never-expires': 'password-guessing-exposure'
},
uncataloguedDeviationConditions: { 'gpo': 'uncatalogued-deviations-gpo', 'pingcastle': 'uncatalogued-deviations-pingcastle', 'purple-knight': 'uncatalogued-deviations-purple-knight', 'cis-cat': 'uncatalogued-deviations-cis-cat', 'maester': 'uncatalogued-deviations-maester' }
};
/** Structural validation; a catalog failing it must never be used. */
export function assessmentContextCatalogErrors(catalog: AssessmentContextCatalog): string[] {
const errors: string[] = [];
const sourceOk = (sources: ContextSource[], owner: string) => {
if (!sources.length) errors.push(`${owner}: at least one source is required.`);
for (const source of sources) {
if (!source.title.trim() || !/^https:\/\/[a-z0-9.-]+\.[a-z]{2,}\//i.test(source.url)) errors.push(`${owner}: invalid source.`);
}
};
const conditionIds = new Set<string>();
const semanticIds = new Set<string>();
for (const semantic of catalog.semantics) {
if (semanticIds.has(semantic.id)) errors.push(`${semantic.id}: duplicate semantic id.`);
semanticIds.add(semantic.id);
if (!semantic.targets.length) errors.push(`${semantic.id}: at least one technical target is required.`);
sourceOk(semantic.sources, semantic.id);
for (const condition of semantic.conditions) {
if (conditionIds.has(condition.id)) errors.push(`${condition.id}: duplicate condition id.`);
conditionIds.add(condition.id);
const overlap = condition.satisfiedValues.filter(value => condition.notSatisfiedValues.includes(value));
if (overlap.length) errors.push(`${condition.id}: value sets overlap.`);
if (!condition.satisfiedValues.length || !condition.notSatisfiedValues.length) errors.push(`${condition.id}: both value sets are required.`);
}
}
for (const condition of catalog.standaloneConditions) {
if (conditionIds.has(condition.id)) errors.push(`${condition.id}: duplicate condition id.`);
conditionIds.add(condition.id);
if (!condition.label.de.trim() || !condition.label.en.trim()) errors.push(`${condition.id}: label is required.`);
}
for (const relationship of catalog.relationships) {
if (!conditionIds.has(relationship.conditionId)) errors.push(`${relationship.conditionId}: relationship without condition.`);
if (!/begünstig/.test(relationship.statement.de) || !/\bfavours?\b/.test(relationship.statement.en)) {
errors.push(`${relationship.conditionId}: statements must be phrased as favouring, not as confirmed.`);
}
sourceOk(relationship.sources, relationship.conditionId);
}
const scannerKeys = new Set<string>();
for (const rule of catalog.scannerRules) {
const key = `${rule.tool} ${rule.ruleId}`;
if (scannerKeys.has(key)) errors.push(`${key}: duplicate scanner rule.`);
scannerKeys.add(key);
if (!conditionIds.has(rule.conditionId)) errors.push(`${key}: unknown condition.`);
if (rule.polarity !== 'fail-means-met') errors.push(`${key}: unsupported polarity.`);
if (!rule.ruleId.trim() || !rule.ruleText.trim()) errors.push(`${key}: rule ID and native rule text are required.`);
// The official scan report is authoritative; a documentation source is optional further reading.
if (rule.sources.length) sourceOk(rule.sources, key);
}
const sectionTitles = new Set<string>();
for (const rule of catalog.cisSectionRules) {
const title = rule.sectionTitle.trim().toLowerCase().replace(/\s+/g, ' ');
if (!title) errors.push('cis-cat section rule: title is required.');
if (sectionTitles.has(title)) errors.push(`${rule.sectionTitle}: duplicate section rule.`);
sectionTitles.add(title);
if (!conditionIds.has(rule.conditionId)) errors.push(`${rule.sectionTitle}: unknown condition.`);
}
for (const rule of catalog.gpoVerdictRules) {
if (!conditionIds.has(rule.conditionId)) errors.push(`${JSON.stringify(rule.target)}: unknown condition.`);
if (rule.target.mechanism !== 'advanced-audit-policy' && !rule.target.key.trim()) errors.push('gpo verdict rule: key is required.');
}
for (const [tool, conditionId] of Object.entries(catalog.uncataloguedDeviationConditions ?? {})) {
if (!conditionIds.has(conditionId)) errors.push(`${tool}: unknown uncatalogued-deviation condition.`);
}
for (const cluster of catalog.clusters) {
const unknown = cluster.conditionIds.filter(id => !conditionIds.has(id));
if (unknown.length) errors.push(`${cluster.id}: unknown conditions ${unknown.join(', ')}.`);
if (cluster.minimumSatisfied < 2 || cluster.minimumSatisfied > cluster.conditionIds.length) {
errors.push(`${cluster.id}: minimumSatisfied must name several conditions.`);
}
sourceOk(cluster.sources, cluster.id);
}
// One finding, one cluster (user decision 2026-10-04): every shared condition declares exactly one of its clusters.
for (const conditionId of conditionIds) {
const owners = catalog.clusters.filter(cluster => cluster.conditionIds.includes(conditionId)).map(cluster => cluster.id);
const primary = catalog.primaryClusters?.[conditionId];
if (owners.length > 1 && !primary) errors.push(`${conditionId}: shared by ${owners.join(', ')} without a primary cluster.`);
if (primary && !owners.includes(primary)) errors.push(`${conditionId}: primary cluster ${primary} does not list the condition.`);
}
return errors;
}
/** The single cluster a catalogued condition counts for (user decision 2026-10-04). */
export function primaryClusterOfCondition(catalog: AssessmentContextCatalog, conditionId: string): string | undefined {
return catalog.primaryClusters?.[conditionId] ?? catalog.clusters.find(cluster => cluster.conditionIds.includes(conditionId))?.id;
}
Reference in New Issue View Git Blame Copy Permalink