Assessor_2.0/src/profiles/public-search/catalog.json

500 lines
16 KiB
JSON

{
"verifiedOn": "2026-09-06",
"sources": {
"registry": "https://learn.microsoft.com/en-us/azure/governance/policy/samples/guest-configuration-baseline-windows",
"privileges": "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-rights-assignment",
"passwords": "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/0b40db09-d95d-40a6-8467-32aedec8140c",
"asr": "https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-overview",
"maester": "https://maester.dev/docs/tests/maester/",
"pingcastle": "https://www.pingcastle.com/PingCastleFiles/ad_hc_rules_list.html"
},
"registryTargets": [
"SOFTWARE\\Policies\\Microsoft\\Windows Defender\\PUAProtection",
"Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableIOAVProtection",
"Software\\Policies\\Microsoft\\Windows Defender\\DisableAntiSpyware",
"Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring",
"SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Scan\\DisableEmailScanning",
"Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScriptScanning",
"SOFTWARE\\Policies\\Microsoft\\InputPersonalization\\AllowInputPersonalization",
"SYSTEM\\CurrentControlSet\\Services\\LanmanWorkstation\\DependOnService",
"SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\UseLogonCredential",
"System\\CurrentControlSet\\Services\\Tcpip6\\Parameters\\DisableIPSourceRouting",
"System\\CurrentControlSet\\Services\\Tcpip\\Parameters\\DisableIPSourceRouting",
"System\\CurrentControlSet\\Services\\Netbt\\Parameters\\NoNameReleaseOnDemand",
"SYSTEM\\CurrentControlSet\\Control\\Session Manager\\SafeDllSearchMode",
"SYSTEM\\CurrentControlSet\\Services\\Eventlog\\Security\\WarningLevel",
"SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\EnableICMPRedirect",
"SOFTWARE\\Policies\\Microsoft\\Windows\\LanmanWorkstation\\AllowInsecureGuestAuth",
"SOFTWARE\\Policies\\Microsoft\\Windows\\WcmSvc\\GroupPolicy\\fMinimizeConnections",
"SOFTWARE\\Policies\\Microsoft\\Windows\\Network Connections\\NC_AllowNetBridge_NLA",
"SOFTWARE\\Policies\\Microsoft\\Windows\\Network Connections\\NC_ShowSharedAccessUI",
"SOFTWARE\\Policies\\Microsoft\\Windows\\System\\EnableCdp",
"SOFTWARE\\Policies\\Microsoft\\Windows\\System\\EnumerateLocalUsers",
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Audit\\ProcessCreationIncludeCmdLine_Enabled",
"SOFTWARE\\Policies\\Microsoft\\Windows\\Device Metadata\\PreventDeviceMetadataFromNetwork",
"SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\Network Protection\\EnableNetworkProtection",
"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\NoConnectedUser",
"SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters\\SignSecureChannel",
"SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters\\DisablePasswordChange",
"System\\CurrentControlSet\\Services\\Netlogon\\Parameters\\MaximumPasswordAge",
"SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters\\RequireStrongKey",
"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\CachedLogonsCount",
"SYSTEM\\CurrentControlSet\\Services\\LanManServer\\Parameters\\EnableForcedLogoff",
"System\\CurrentControlSet\\Services\\LanManServer\\Parameters\\SMBServerNameHardeningLevel",
"SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters\\SMB1",
"SYSTEM\\CurrentControlSet\\Control\\Lsa\\RestrictAnonymousSAM",
"SYSTEM\\CurrentControlSet\\Control\\Lsa\\RestrictAnonymous",
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\Parameters\\SupportedEncryptionTypes",
"SYSTEM\\CurrentControlSet\\Control\\Lsa\\NoLMHash",
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableInstallerDetection",
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableSecureUIAPaths",
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA",
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop",
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableVirtualization",
"SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\DomainProfile\\Logging\\LogFilePath",
"SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\DomainProfile\\Logging\\LogFileSize",
"SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\DomainProfile\\DefaultOutboundAction",
"SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\DomainProfile\\AllowLocalIPsecPolicyMerge",
"SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\DomainProfile\\AllowLocalPolicyMerge",
"SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\DomainProfile\\DisableNotifications",
"SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile\\Logging\\LogFilePath",
"SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile\\Logging\\LogFileSize",
"SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile\\DefaultOutboundAction",
"SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile\\AllowLocalIPsecPolicyMerge",
"SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile\\AllowLocalPolicyMerge",
"SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\\fPromptForPassword",
"SOFTWARE\\Policies\\Microsoft\\Windows\\EventLog\\Application\\Retention",
"SOFTWARE\\Policies\\Microsoft\\Windows\\EventLog\\Application\\MaxSize",
"SOFTWARE\\Policies\\Microsoft\\MicrosoftAccount\\DisableUserAuth",
"SOFTWARE\\Policies\\Microsoft\\Windows Defender\\SpyNet\\LocalSettingOverrideSpynetReporting",
"SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\\fEncryptRPCTraffic",
"SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\\UserAuthentication",
"SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Scan\\DisableRemovableDriveScanning",
"SOFTWARE\\Policies\\Microsoft\\Windows\\EventLog\\Security\\Retention",
"SOFTWARE\\Policies\\Microsoft\\Windows\\EventLog\\Security\\MaxSize",
"SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent\\DisableWindowsConsumerFeatures",
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\PreXPSP2ShellProtocolBehavior",
"SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring",
"SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\\EnableScriptBlockLogging"
],
"privilegeIds": [
"SeTrustedCredManAccessPrivilege",
"SeNetworkLogonRight",
"SeTcbPrivilege",
"SeMachineAccountPrivilege",
"SeIncreaseQuotaPrivilege",
"SeInteractiveLogonRight",
"SeRemoteInteractiveLogonRight",
"SeBackupPrivilege",
"SeChangeNotifyPrivilege",
"SeSystemtimePrivilege",
"SeTimeZonePrivilege",
"SeCreatePagefilePrivilege",
"SeCreateTokenPrivilege",
"SeCreateGlobalPrivilege",
"SeCreatePermanentPrivilege",
"SeCreateSymbolicLinkPrivilege",
"SeDebugPrivilege",
"SeDenyNetworkLogonRight",
"SeDenyBatchLogonRight",
"SeDenyServiceLogonRight",
"SeDenyInteractiveLogonRight",
"SeDenyRemoteInteractiveLogonRight",
"SeEnableDelegationPrivilege",
"SeRemoteShutdownPrivilege",
"SeAuditPrivilege",
"SeImpersonatePrivilege",
"SeIncreaseWorkingSetPrivilege",
"SeIncreaseBasePriorityPrivilege",
"SeLoadDriverPrivilege",
"SeLockMemoryPrivilege",
"SeBatchLogonRight",
"SeServiceLogonRight",
"SeSecurityPrivilege",
"SeRelabelPrivilege",
"SeSystemEnvironmentPrivilege",
"SeDelegateSessionUserImpersonatePrivilege",
"SeManageVolumePrivilege",
"SeProfileSingleProcessPrivilege",
"SeSystemProfilePrivilege",
"SeUndockPrivilege",
"SeAssignPrimaryTokenPrivilege",
"SeRestorePrivilege",
"SeShutdownPrivilege",
"SeSyncAgentPrivilege",
"SeTakeOwnershipPrivilege"
],
"maesterIds": [
"CISA.MS.EXO.17.3",
"MT.1001",
"MT.1002",
"MT.1003",
"MT.1004",
"MT.1005",
"MT.1006",
"MT.1007",
"MT.1008",
"MT.1009",
"MT.1010",
"MT.1011",
"MT.1012",
"MT.1013",
"MT.1014",
"MT.1015",
"MT.1016",
"MT.1017",
"MT.1018",
"MT.1019",
"MT.1020",
"MT.1022",
"MT.1023",
"MT.1025",
"MT.1026",
"MT.1027",
"MT.1028",
"MT.1029",
"MT.1030",
"MT.1031",
"MT.1033",
"MT.1034",
"MT.1035",
"MT.1036",
"MT.1037",
"MT.1038",
"MT.1041",
"MT.1042",
"MT.1043",
"MT.1044",
"MT.1045",
"MT.1047",
"MT.1048",
"MT.1049",
"MT.1050",
"MT.1051",
"MT.1052",
"MT.1054",
"MT.1055",
"MT.1056",
"MT.1057",
"MT.1058",
"MT.1059",
"MT.1061",
"MT.1062",
"MT.1063",
"MT.1064",
"MT.1065",
"MT.1066",
"MT.1067",
"MT.1068",
"MT.1069",
"MT.1070",
"MT.1071",
"MT.1072",
"MT.1073",
"MT.1074",
"MT.1075",
"MT.1076",
"MT.1077",
"MT.1078",
"MT.1079",
"MT.1080",
"MT.1081",
"MT.1083",
"MT.1084",
"MT.1085",
"MT.1086",
"MT.1087",
"MT.1088",
"MT.1089",
"MT.1090",
"MT.1091",
"MT.1092",
"MT.1093",
"MT.1094",
"MT.1095",
"MT.1096",
"MT.1097",
"MT.1098",
"MT.1099",
"MT.1100",
"MT.1101",
"MT.1102",
"MT.1103",
"MT.1105",
"MT.1106",
"MT.1107",
"MT.1108",
"MT.1109",
"MT.1110",
"MT.1111",
"MT.1112",
"MT.1113",
"MT.1114",
"MT.1115",
"MT.1116",
"MT.1117",
"MT.1118",
"MT.1119",
"MT.1120",
"MT.1121",
"MT.1122",
"MT.1123",
"MT.1147",
"MT.1148",
"MT.1149",
"MT.1150",
"MT.1151",
"MT.1152",
"MT.1153",
"MT.1154",
"MT.1155",
"MT.1156",
"MT.1157",
"MT.1158",
"MT.1159",
"MT.1160",
"MT.1161",
"MT.1162",
"MT.1163",
"MT.1164",
"MT.1165",
"MT.1166",
"MT.1167",
"MT.1168",
"MT.1169",
"MT.1170",
"MT.1171",
"MT.1172",
"MT.1173",
"MT.1174",
"MT.1175",
"MT.1176",
"MT.1177",
"MT.1178",
"MT.1179",
"MT.1180",
"MT.1182",
"MT.1183",
"MT.1184",
"MT.1185",
"MT.1186",
"MT.1187",
"MT.1188",
"MT.1189",
"MT.1190",
"MT.1191",
"MT.1192",
"MT.1193",
"MT.1194",
"MT.1195"
],
"pingcastleIds": [
"A-AdminSDHolder",
"A-AnonymousAuthorizedGPO",
"A-AuditDC",
"A-AuditPowershell",
"A-BackupMetadata",
"A-CertEnrollChannelBinding",
"A-CertEnrollHttp",
"A-CertROCA",
"A-CertTempAgent",
"A-CertTempAnyone",
"A-CertTempAnyPurpose",
"A-CertTempCustomSubject",
"A-CertTempNoSecurity",
"A-CertWeakDSA",
"A-CertWeakRsaComponent",
"A-DC-Coerce",
"A-DC-Spooler",
"A-DC-WebClient",
"A-DCLdapsChannelBinding",
"A-DCLdapSign",
"A-DCLdapsProtocol",
"A-DCLdapsProtocolAdvanced",
"A-DCRefuseComputerPwdChange",
"A-DnsZoneAUCreateChild",
"A-DnsZoneTransfert",
"A-DnsZoneUpdate1",
"A-DnsZoneUpdate2",
"A-DsHeuristicsAllowAnonNSPI",
"A-DsHeuristicsAnonymous",
"A-DsHeuristicsDoNotVerifyUniqueness",
"A-DsHeuristicsLDAPSecurity",
"A-Guest",
"A-HardenedPaths",
"A-Krbtgt",
"A-LAPS-Joined-Computers",
"A-LAPS-Not-Installed",
"A-LDAPSigningDisabled",
"A-LimitBlankPasswordUse",
"A-LMHashAuthorized",
"A-MD2IntermediateCert",
"A-MD2RootCert",
"A-MD4IntermediateCert",
"A-MD4RootCert",
"A-MD5IntermediateCert",
"A-MD5RootCert",
"A-MembershipEveryone",
"A-MinPwdLen",
"A-NoGPOLLMNR",
"A-NoNetSessionHardening",
"A-NoServicePolicy",
"A-NotEnoughDC",
"A-NTFRSOnSysvol",
"A-NullSession",
"A-PreWin2000Anonymous",
"A-PreWin2000AuthenticatedUsers",
"A-PreWin2000Other",
"A-ProtectedUsers",
"A-PwdGPO",
"A-ReversiblePwd",
"A-RootDseAnonBinding",
"A-SHA0IntermediateCert",
"A-SHA0RootCert",
"A-SHA1IntermediateCert",
"A-SHA1RootCert",
"A-SmartCardPwdRotation",
"A-SmartCardRequired",
"A-SMB2SignatureNotEnabled",
"A-SMB2SignatureNotRequired",
"A-UnixPwd",
"A-WeakRSARootCert",
"A-WeakRSARootCert2",
"A-WSUS-SslProtocol",
"P-AdminEmailOn",
"P-AdminLogin",
"P-AdminNum",
"P-AdminPwdTooOld",
"P-ControlPathIndirectEveryone",
"P-ControlPathIndirectMany",
"P-DangerousExtendedRight",
"P-DCOwner",
"P-Delegated",
"P-DelegationDCa2d2",
"P-DelegationDCsourcedeleg",
"P-DelegationDCt2a4d",
"P-DelegationEveryone",
"P-DelegationFileDeployed",
"P-DelegationGPOData",
"P-DelegationKeyAdmin",
"P-DelegationLoginScript",
"P-DisplaySpecifier",
"P-DNSAdmin",
"P-DNSDelegation",
"P-DsHeuristicsAdminSDExMask",
"P-DsHeuristicsDoListObject",
"P-ExchangeAdminSDHolder",
"P-ExchangePrivEsc",
"P-Inactive",
"P-Kerberoasting",
"P-LoginDCEveryone",
"P-LogonDenied",
"P-OperatorsEmpty",
"P-PrivilegeEveryone",
"P-ProtectedUsers",
"P-RecoveryModeUnprotected",
"P-RecycleBin",
"P-RODCAdminRevealed",
"P-RODCAllowedGroup",
"P-RODCDeniedGroup",
"P-RODCKrbtgtOrphan",
"P-RODCNeverReveal",
"P-RODCRevealOnDemand",
"P-RODCSYSVOLWrite",
"P-SchemaAdmin",
"P-ServiceDomainAdmin",
"P-TrustedCredManAccessPrivilege",
"P-UnconstrainedDelegation",
"P-UnkownDelegation",
"P-UnprotectedOU",
"S-ADRegistration",
"S-ADRegistrationSchema",
"S-AesNotEnabled",
"S-C-Inactive",
"S-C-PrimaryGroup",
"S-C-Reversible",
"S-DC-2000",
"S-DC-2003",
"S-DC-2008",
"S-DC-2012",
"S-DC-Inactive",
"S-DC-NotUpdated",
"S-DC-SubnetMissing",
"S-DCRegistration",
"S-DefaultOUChanged",
"S-DefenderASR",
"S-DesEnabled",
"S-Duplicate",
"S-FirewallScript",
"S-FolderOptions",
"S-FunctionalLevel1",
"S-FunctionalLevel3",
"S-FunctionalLevel4",
"S-Inactive",
"S-JavaSchema",
"S-KerberosArmoring",
"S-KerberosArmoringDC",
"S-NoPreAuth",
"S-NoPreAuthAdmin",
"S-OldNtlm",
"S-OS-2000",
"S-OS-2003",
"S-OS-2008",
"S-OS-2012",
"S-OS-NT",
"S-OS-Vista",
"S-OS-W10",
"S-OS-Win7",
"S-OS-Win8",
"S-OS-XP",
"S-PrimaryGroup",
"S-PwdLastSet-45",
"S-PwdLastSet-90",
"S-PwdLastSet-Cluster",
"S-PwdLastSet-DC",
"S-PwdNeverExpires",
"S-PwdNotRequired",
"S-Reversible",
"S-SIDHistory",
"S-SMB-v1",
"S-TerminalServicesGPO",
"S-Vuln-MS14-068",
"S-Vuln-MS17_010",
"S-WSUS-HTTP",
"S-WSUS-NoPinning",
"S-WSUS-UserProxy",
"T-AlgsAES",
"T-AzureADSSO",
"T-Downlevel",
"T-FileDeployedOutOfDomain",
"T-Inactive",
"T-ScriptOutOfDomain",
"T-SIDFiltering",
"T-SIDHistoryDangerous",
"T-SIDHistorySameDomain",
"T-SIDHistoryUnknownDomain",
"T-TGTDelegation"
],
"asrIds": [
"56a863a9-875e-4185-98a7-b882c64b5ce5",
"9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2",
"e6db77e5-3df2-4cf1-b95a-636979351e5b",
"7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c",
"d4f940ab-401b-4efc-aadc-ad5f3c50688a",
"be9ba2d9-53ea-4cdc-84e5-9b1eeee46550",
"01443614-cd74-433a-b99e-2ecdc07bfc25",
"5beb7efe-fd9a-4556-801d-275e5ffc04cc",
"d3e037e1-3eb8-44c8-a917-57927947596d",
"3b576869-a4ec-4529-8536-b80a7769e899",
"75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84",
"26190899-1602-49e8-8b27-eb1d0a1ce869",
"d1e49aac-8f56-4280-b9ba-993a6d77406c",
"33ddedf1-c6e0-47cb-833e-de6133960387",
"b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4",
"c0033c00-d16d-4114-a5a0-dc9b3a7d2ceb",
"a8f5898e-1dc8-49a9-9878-85004b8a61e6",
"92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b",
"c1db55ab-c21a-4637-bb3f-a12568109d35"
]
}