539 lines
26 KiB
JSON
539 lines
26 KiB
JSON
{
|
|
"schemaVersion": 1,
|
|
"executiveSummary": "The assessment indicates a critical posture driven by confirmed Tier 0 Active Directory and AD CS exposures. The authoritative summary reports 455 actionable findings, 450 failed results, and overall finding severity totals of 17 critical and 190 high. Critical indicators include AdminSDHolder permission changes, weak privileged password policy, unsafe certificate templates, AD CS web enrollment, an enabled domain-controller print spooler, and a Zerologon finding. Entra ID also shows recurring weaknesses in privileged-role governance, phishing-resistant MFA, risk-based access, legacy authentication, application consent, and external collaboration. Monitoring is weakened by failed centralized security-log and privileged-role alerting controls, while an unusual privileged sign-in warning requires investigation. Windows baseline deviations add legacy-protocol, auditing, firewall, and domain-controller hardening concerns. Coverage is incomplete because 169 checks were not run and 2 findings ended in execution errors; these gaps are not treated as passed or failed.",
|
|
"assessment": {
|
|
"riskLevel": "critical",
|
|
"confidence": "medium",
|
|
"rationale": "Multiple confirmed critical indicators affect Tier 0 identity infrastructure and AD CS, with additional high-risk identity and privilege-control deviations in Entra ID. Confidence is reduced by 169 not-run checks and 2 execution errors, but those gaps do not negate the confirmed critical evidence."
|
|
},
|
|
"environmentOverview": {
|
|
"summary": "Observed context includes Windows Server 2016 domain and forest functional levels, Windows Server 2019 operating-system observations, a single domain controller, PKI certificate-template inventory, disabled AD Recycle Bin, and no WEF configuration observed. These observations provide context only and are not treated as security findings.",
|
|
"factsUsed": [
|
|
"domain.functional_level",
|
|
"forest.functional_level",
|
|
"domain.controller_count",
|
|
"operating_system.name",
|
|
"inventory.sectionpki.certificate.templates.list.row_count",
|
|
"domain.recycle_bin_enabled",
|
|
"logging.wef.configuration_count"
|
|
]
|
|
},
|
|
"themes": [
|
|
{
|
|
"id": "T1",
|
|
"title": "Tier 0 Active Directory exposure",
|
|
"riskLevel": "critical",
|
|
"confidence": "high",
|
|
"summary": "Confirmed deviations affect core domain-control paths, including AdminSDHolder permissions, Zerologon, domain-controller print services, writable RBCD paths, shadow credentials on privileged objects, dangerous GPO user rights, and weak privileged-account password controls.",
|
|
"findingIds": [
|
|
"SI000055",
|
|
"SI000036",
|
|
"SI000077",
|
|
"SI000079",
|
|
"SI000080",
|
|
"SI000351",
|
|
"SI000302",
|
|
"SI000096",
|
|
"SI000067"
|
|
]
|
|
},
|
|
{
|
|
"id": "T2",
|
|
"title": "AD CS certificate abuse paths",
|
|
"riskLevel": "critical",
|
|
"confidence": "high",
|
|
"summary": "Certificate services expose multiple abuse paths: requester-controlled subject alternative names, web enrollment accepting an unsafe authentication path, and templates combining several insecure settings. These findings can undermine privileged authentication and require careful PKI remediation.",
|
|
"findingIds": [
|
|
"SI000157",
|
|
"SI000095",
|
|
"SI000156"
|
|
]
|
|
},
|
|
{
|
|
"id": "T3",
|
|
"title": "Privileged access governance",
|
|
"riskLevel": "high",
|
|
"confidence": "high",
|
|
"summary": "Privileged access is insufficiently separated and time-bound. Findings cover synchronized or mail-enabled administrators, excessive or permanent high privilege, external privileged users, privileged service principals using client secrets, root-scope access, and weak Global Administrator governance.",
|
|
"findingIds": [
|
|
"CIS.M365.1.1.1",
|
|
"CIS.M365.1.1.3",
|
|
"MT.1025",
|
|
"MT.1027",
|
|
"MT.1028",
|
|
"MT.1030",
|
|
"MT.1032",
|
|
"MT.1056",
|
|
"CISA.MS.AAD.7.1",
|
|
"CISA.MS.AAD.7.2",
|
|
"CISA.MS.AAD.7.3",
|
|
"CISA.MS.AAD.7.4"
|
|
]
|
|
},
|
|
{
|
|
"id": "T4",
|
|
"title": "Authentication and Conditional Access",
|
|
"riskLevel": "high",
|
|
"confidence": "high",
|
|
"summary": "Identity protection is weakened by failures involving phishing-resistant MFA, administrator MFA, risk-based access, legacy authentication blocking, weak authentication methods, secure MFA registration, and managed-device requirements. Changes should be staged to avoid lockout.",
|
|
"findingIds": [
|
|
"CISA.MS.AAD.2.3",
|
|
"CISA.MS.AAD.3.1",
|
|
"CISA.MS.AAD.3.5",
|
|
"CISA.MS.AAD.3.6",
|
|
"CISA.MS.AAD.3.7",
|
|
"CISA.MS.AAD.3.8",
|
|
"CISA.MS.AAD.1.1",
|
|
"MT.1024.mfaRegistrationV2",
|
|
"MT.1024.signinRiskPolicy",
|
|
"MT.1024.userRiskPolicy",
|
|
"MT.1024.adminMFAV2",
|
|
"MT.1009",
|
|
"MT.1010",
|
|
"MT.1011",
|
|
"MT.1012",
|
|
"MT.1014"
|
|
]
|
|
},
|
|
{
|
|
"id": "T5",
|
|
"title": "Detection and privileged monitoring",
|
|
"riskLevel": "high",
|
|
"confidence": "high",
|
|
"summary": "Central security-log forwarding and privileged-role assignment or activation alerting are not meeting the assessed controls. A warning also identifies unusual privileged sign-in activity, which requires investigation rather than automatic classification as compromise.",
|
|
"findingIds": [
|
|
"CISA.MS.AAD.4.1",
|
|
"CISA.MS.AAD.7.7",
|
|
"CISA.MS.AAD.7.9",
|
|
"MT.INV.001"
|
|
]
|
|
},
|
|
{
|
|
"id": "T6",
|
|
"title": "Application and external access governance",
|
|
"riskLevel": "high",
|
|
"confidence": "high",
|
|
"summary": "Application consent, privileged service principals, expiring application credentials, guest invitations, and SharePoint external sharing show governance weaknesses. Together they increase the likelihood of excessive application or external-party access.",
|
|
"findingIds": [
|
|
"CISA.MS.AAD.5.2",
|
|
"CISA.MS.AAD.5.3",
|
|
"EIDSCA.CR01",
|
|
"MT.1024.applicationCredentialExpiry",
|
|
"MT.1027",
|
|
"CISA.MS.AAD.8.2",
|
|
"CISA.MS.SHAREPOINT.1.3"
|
|
]
|
|
},
|
|
{
|
|
"id": "T7",
|
|
"title": "Windows and domain-controller baseline drift",
|
|
"riskLevel": "medium",
|
|
"confidence": "medium",
|
|
"summary": "Confirmed baseline deviations include legacy LM or NTLM acceptance, missing LDAP channel-binding or signing enforcement, SMBv1 settings, firewall configuration, credential-validation auditing, and SYSVOL or NETLOGON path hardening. Source severity is unknown for several checks, so risk is assessed conservatively.",
|
|
"findingIds": [
|
|
"S-OldNtlm",
|
|
"2.3.5.3",
|
|
"2.3.5.4",
|
|
"18.4.2",
|
|
"18.4.3",
|
|
"9.1.1",
|
|
"17.1.1",
|
|
"18.6.14.1"
|
|
]
|
|
}
|
|
],
|
|
"priorities": [
|
|
{
|
|
"rank": 1,
|
|
"title": "Investigate Tier 0 compromise indicators",
|
|
"timeframe": "immediate",
|
|
"owner": "Incident Response Lead with Active Directory Security Owner",
|
|
"rationale": "AdminSDHolder permission changes are a critical indicator and unusual privileged sign-in activity is separately flagged for investigation. Establish whether changes and sign-ins were authorized before routine configuration work alters evidence.",
|
|
"expectedRiskReduction": "Rapidly distinguishes authorized change from active compromise and enables containment before an attacker can retain or expand privileged access.",
|
|
"validation": "Document the AdminSDHolder ACL review, correlate privileged sign-in evidence, confirm authorized ownership of observed changes, and record containment or closure decisions.",
|
|
"findingIds": [
|
|
"SI000055",
|
|
"MT.INV.001"
|
|
]
|
|
},
|
|
{
|
|
"rank": 2,
|
|
"title": "Resolve critical domain-controller exposures",
|
|
"timeframe": "immediate",
|
|
"owner": "Active Directory Platform Owner",
|
|
"rationale": "The assessment confirms a Zerologon finding and an enabled print spooler on a domain controller. Both affect Tier 0 infrastructure and should be addressed before lower-severity baseline work.",
|
|
"expectedRiskReduction": "Reduces direct compromise and coercion or relay opportunities against domain-controller services.",
|
|
"validation": "Re-run the two source checks after remediation and verify the affected domain-controller configuration is in the intended state.",
|
|
"findingIds": [
|
|
"SI000036",
|
|
"SI000077"
|
|
]
|
|
},
|
|
{
|
|
"rank": 3,
|
|
"title": "Close AD CS certificate abuse paths",
|
|
"timeframe": "immediate",
|
|
"owner": "PKI Owner with Active Directory Security Owner",
|
|
"rationale": "Critical AD CS findings expose unsafe certificate enrollment and template behavior. Changes must preserve required issuance workflows while removing unnecessary subject-name control and other insecure template settings.",
|
|
"expectedRiskReduction": "Reduces certificate-based privilege escalation and identity impersonation paths.",
|
|
"validation": "Inventory affected templates and enrollment endpoints, document approved business requirements, apply approved changes, and re-run all cited AD CS checks.",
|
|
"findingIds": [
|
|
"SI000095",
|
|
"SI000157",
|
|
"SI000156"
|
|
]
|
|
},
|
|
{
|
|
"rank": 4,
|
|
"title": "Remove writable privilege-escalation paths in Active Directory",
|
|
"timeframe": "immediate",
|
|
"owner": "Active Directory Security Owner",
|
|
"rationale": "Writable RBCD on Tier 0 objects, shadow credentials on privileged objects, and dangerous GPO-granted rights create direct privilege-escalation paths. They should be reviewed and removed unless explicitly required.",
|
|
"expectedRiskReduction": "Eliminates high-impact paths that can convert lower privilege into control of privileged identities or systems.",
|
|
"validation": "Confirm each cited path has an approved owner and purpose, remove unauthorized access, and re-run the source checks to verify closure.",
|
|
"findingIds": [
|
|
"SI000079",
|
|
"SI000080",
|
|
"SI000351",
|
|
"SI000302"
|
|
]
|
|
},
|
|
{
|
|
"rank": 5,
|
|
"title": "Harden privileged account password controls",
|
|
"timeframe": "short_term",
|
|
"owner": "Active Directory Identity Owner",
|
|
"rationale": "Privileged users are reported under a weak password policy and privileged passwords that never expire are also identified. Correcting privileged credential policy reduces persistence and password-based takeover risk.",
|
|
"expectedRiskReduction": "Reduces exposure from weak or indefinitely valid privileged credentials.",
|
|
"validation": "Confirm privileged accounts are covered by the approved stronger policy, remove unsupported non-expiring settings, and re-run the cited checks.",
|
|
"findingIds": [
|
|
"SI000096",
|
|
"SI000067"
|
|
]
|
|
},
|
|
{
|
|
"rank": 6,
|
|
"title": "Rebuild privileged Entra access around least privilege and just-in-time activation",
|
|
"timeframe": "short_term",
|
|
"owner": "Entra ID Identity Governance Owner",
|
|
"rationale": "Multiple high findings show permanent, excessive, synchronized, mail-enabled, external, and service-principal privilege. Design emergency-access exceptions first, then reduce standing privilege and use eligible assignments where supported.",
|
|
"expectedRiskReduction": "Shrinks the standing cloud control-plane attack surface and limits blast radius from a compromised privileged identity.",
|
|
"validation": "Review privileged assignments, document approved exceptions, verify least-privilege role mapping, and re-run all cited privileged-access checks.",
|
|
"findingIds": [
|
|
"CIS.M365.1.1.1",
|
|
"MT.1025",
|
|
"MT.1027",
|
|
"MT.1028",
|
|
"MT.1030",
|
|
"MT.1032",
|
|
"MT.1056",
|
|
"CISA.MS.AAD.7.2",
|
|
"CISA.MS.AAD.7.3",
|
|
"CISA.MS.AAD.7.4"
|
|
]
|
|
},
|
|
{
|
|
"rank": 7,
|
|
"title": "Stage phishing-resistant MFA and risk-based Conditional Access",
|
|
"timeframe": "short_term",
|
|
"owner": "Entra ID Conditional Access Owner",
|
|
"rationale": "High findings show gaps in MFA strength, administrator MFA, risky sign-in handling, legacy authentication blocking, secure registration, and device requirements. Use staged testing with emergency-access exclusions and rollback planning.",
|
|
"expectedRiskReduction": "Substantially reduces account takeover from phishing, legacy authentication, risky sessions, and unauthorized MFA registration.",
|
|
"validation": "Test policies with pilot populations, confirm emergency access remains usable, review sign-in impact, then re-run the cited controls after staged enforcement.",
|
|
"findingIds": [
|
|
"CISA.MS.AAD.2.3",
|
|
"CISA.MS.AAD.3.1",
|
|
"CISA.MS.AAD.3.5",
|
|
"CISA.MS.AAD.3.6",
|
|
"MT.1024.adminMFAV2",
|
|
"MT.1009",
|
|
"MT.1010",
|
|
"MT.1011",
|
|
"MT.1012",
|
|
"MT.1014"
|
|
]
|
|
},
|
|
{
|
|
"rank": 8,
|
|
"title": "Restore centralized identity monitoring and privilege alerts",
|
|
"timeframe": "short_term",
|
|
"owner": "Security Operations Lead",
|
|
"rationale": "The assessment reports failed centralized Entra security-log collection and missing privileged-role assignment or activation alerting. These gaps delay detection and investigation of identity attacks.",
|
|
"expectedRiskReduction": "Improves detection, triage, and forensic visibility for sign-in, risk, application, and privileged-role events.",
|
|
"validation": "Verify required Entra logs reach the monitored security platform, generate test privileged-role events, and confirm alerts are received and triaged.",
|
|
"findingIds": [
|
|
"CISA.MS.AAD.4.1",
|
|
"CISA.MS.AAD.7.7",
|
|
"CISA.MS.AAD.7.9"
|
|
]
|
|
},
|
|
{
|
|
"rank": 9,
|
|
"title": "Tighten application consent, service-principal credentials, and external sharing",
|
|
"timeframe": "medium_term",
|
|
"owner": "Cloud Security and Microsoft 365 Governance Owner",
|
|
"rationale": "High findings cover user consent, missing admin-consent workflow, privileged service principals using secrets, expiring credentials, guest invitations, and broad SharePoint external sharing. Remediation should preserve required integrations.",
|
|
"expectedRiskReduction": "Reduces illicit consent, long-lived application credential abuse, and unintended external data access.",
|
|
"validation": "Review approved applications and collaboration requirements, validate credential rotations, test consent workflow, and re-run the cited checks.",
|
|
"findingIds": [
|
|
"CISA.MS.AAD.5.2",
|
|
"CISA.MS.AAD.5.3",
|
|
"MT.1027",
|
|
"MT.1024.applicationCredentialExpiry",
|
|
"CISA.MS.AAD.8.2",
|
|
"CISA.MS.SHAREPOINT.1.3"
|
|
]
|
|
},
|
|
{
|
|
"rank": 10,
|
|
"title": "Harden Windows and domain-controller security baselines",
|
|
"timeframe": "medium_term",
|
|
"owner": "Windows Platform Security Owner",
|
|
"rationale": "Confirmed baseline deviations include legacy authentication, LDAP protections, SMBv1, firewall state, auditing, and hardened domain paths. Apply changes in dependency order with compatibility testing, especially for legacy protocols.",
|
|
"expectedRiskReduction": "Reduces credential relay, downgrade, lateral-movement, and visibility risks across the Windows identity infrastructure.",
|
|
"validation": "Pilot baseline changes, review authentication and application impact, deploy approved settings, and re-run the cited checks.",
|
|
"findingIds": [
|
|
"S-OldNtlm",
|
|
"2.3.5.3",
|
|
"2.3.5.4",
|
|
"18.4.2",
|
|
"18.4.3",
|
|
"9.1.1",
|
|
"17.1.1",
|
|
"18.6.14.1"
|
|
]
|
|
}
|
|
],
|
|
"roadmap": [
|
|
{
|
|
"phase": 0,
|
|
"title": "Contain and validate Tier 0 risk",
|
|
"tasks": [
|
|
"Investigate AdminSDHolder and privileged sign-in anomalies before configuration cleanup.",
|
|
"Resolve or formally disposition critical domain-controller and AD CS exposures.",
|
|
"Remove unauthorized Tier 0 write paths and preserve investigation evidence."
|
|
],
|
|
"completionCriteria": [
|
|
"All Tier 0 items cited in immediate priorities have documented owners, disposition, and re-test evidence.",
|
|
"Any suspected compromise has a recorded incident decision and containment status.",
|
|
"No critical change is closed solely on configuration intent without a successful validation check."
|
|
]
|
|
},
|
|
{
|
|
"phase": 1,
|
|
"title": "Secure privileged identities and authentication",
|
|
"tasks": [
|
|
"Strengthen privileged account credential policy.",
|
|
"Redesign Entra privileged assignments around least privilege and eligible activation.",
|
|
"Pilot phishing-resistant MFA, risk policies, legacy-authentication blocking, and secure registration controls."
|
|
],
|
|
"completionCriteria": [
|
|
"Privileged role assignments have documented business justification and approved exceptions.",
|
|
"Emergency-access paths are tested before broad Conditional Access enforcement.",
|
|
"Pilot authentication policies show acceptable sign-in impact and have rollback procedures."
|
|
]
|
|
},
|
|
{
|
|
"phase": 2,
|
|
"title": "Improve monitoring and cloud governance",
|
|
"tasks": [
|
|
"Send required identity security logs to the monitored security platform.",
|
|
"Enable and test privileged assignment and activation alerts.",
|
|
"Tighten application consent, service-principal credentials, guest invitation, and external sharing governance."
|
|
],
|
|
"completionCriteria": [
|
|
"Test identity and privileged-role events are visible to security operations.",
|
|
"Application and external-access exceptions have named owners and review dates.",
|
|
"Cited monitoring and governance findings are re-tested after changes."
|
|
]
|
|
},
|
|
{
|
|
"phase": 3,
|
|
"title": "Harden platform baselines and close coverage gaps",
|
|
"tasks": [
|
|
"Remediate high-impact Windows and domain-controller baseline deviations with compatibility testing.",
|
|
"Re-run failed execution checks and grouped not-run control areas with the required permissions, licensing, or data access.",
|
|
"Address remaining confirmed medium and lower-priority deviations in risk order."
|
|
],
|
|
"completionCriteria": [
|
|
"Legacy protocol and domain-controller hardening changes pass technical validation.",
|
|
"Execution-error checks return a definitive assessed outcome.",
|
|
"Not-run areas have either evidence, a documented technical limitation, or an accepted coverage exception."
|
|
]
|
|
},
|
|
{
|
|
"phase": 4,
|
|
"title": "Institutionalize identity security governance",
|
|
"tasks": [
|
|
"Establish recurring privileged-access reviews and certificate-template reviews.",
|
|
"Maintain tested emergency-access procedures and Conditional Access change control.",
|
|
"Schedule repeat assessments and track deviations to closure or formal risk acceptance."
|
|
],
|
|
"completionCriteria": [
|
|
"Recurring reviews have defined owners, cadence, and evidence retention.",
|
|
"Critical identity controls are included in change monitoring and incident procedures.",
|
|
"Repeat assessment results show documented disposition for previously cited priority findings."
|
|
]
|
|
}
|
|
],
|
|
"coverageGaps": [
|
|
{
|
|
"title": "Exchange and email threat protection not assessed",
|
|
"impact": "Malware scanning, Safe Attachments, spam and phishing defenses, SMTP AUTH, DKIM or DMARC enforcement, and related mail controls remain unknown.",
|
|
"nextStep": "Re-run the Exchange and Defender checks with the required service access and licensing, then classify each result independently.",
|
|
"evidenceIds": [
|
|
"CIS.M365.2.1.4",
|
|
"CIS.M365.2.1.5",
|
|
"CIS.M365.2.1.9",
|
|
"CISA.MS.EXO.10.1",
|
|
"CISA.MS.EXO.10.2",
|
|
"CISA.MS.EXO.11.1",
|
|
"CISA.MS.EXO.14.1",
|
|
"CISA.MS.EXO.5.1"
|
|
]
|
|
},
|
|
{
|
|
"title": "Microsoft 365 audit and alert coverage not assessed",
|
|
"impact": "Mailbox auditing, audit-log availability, security alerts, and Purview audit coverage cannot be confirmed from this run.",
|
|
"nextStep": "Provide the scanner access needed to query audit and alert configuration, then re-run the affected controls.",
|
|
"evidenceIds": [
|
|
"CIS.M365.3.1.1",
|
|
"CISA.MS.EXO.13.1",
|
|
"CISA.MS.EXO.16.1",
|
|
"CISA.MS.EXO.17.1"
|
|
]
|
|
},
|
|
{
|
|
"title": "Data loss prevention coverage not assessed",
|
|
"impact": "The presence and effectiveness of email DLP controls for sensitive data remain unknown.",
|
|
"nextStep": "Run the DLP checks with access to the applicable Microsoft 365 or Purview configuration and capture definitive results.",
|
|
"evidenceIds": [
|
|
"CISA.MS.EXO.8.1",
|
|
"CISA.MS.EXO.8.2",
|
|
"CISA.MS.EXO.8.3",
|
|
"CISA.MS.EXO.8.4"
|
|
]
|
|
},
|
|
{
|
|
"title": "Application attack-path checks not assessed",
|
|
"impact": "High-risk application permissions, paths to Global Administrator, app-owner MFA, and group-owner consent controls remain unknown.",
|
|
"nextStep": "Re-run application governance and attack-path checks with sufficient Graph and directory read permissions.",
|
|
"evidenceIds": [
|
|
"CISA.MS.AAD.5.4",
|
|
"MT.1050",
|
|
"MT.1051",
|
|
"MT.1063"
|
|
]
|
|
},
|
|
{
|
|
"title": "Device and credential exposure checks not assessed",
|
|
"impact": "Exposure of vulnerable devices and protection of critical credentials by endpoint controls cannot be confirmed.",
|
|
"nextStep": "Provide the required endpoint-security telemetry and re-run the device and credential-protection checks.",
|
|
"evidenceIds": [
|
|
"MT.1087",
|
|
"MT.1080",
|
|
"MT.1088",
|
|
"MT.1089"
|
|
]
|
|
},
|
|
{
|
|
"title": "Teams collaboration controls not assessed",
|
|
"impact": "Presenter, anonymous participant, lobby, external control, reporting, and unmanaged-user restrictions remain partially unknown.",
|
|
"nextStep": "Re-run Teams policy checks with access to the tenant collaboration configuration.",
|
|
"evidenceIds": [
|
|
"MT.1037",
|
|
"CIS.M365.8.2.2",
|
|
"CIS.M365.8.5.3",
|
|
"MT.1042",
|
|
"MT.1046",
|
|
"MT.1047",
|
|
"MT.1048"
|
|
]
|
|
},
|
|
{
|
|
"title": "Authentication control coverage remains incomplete",
|
|
"impact": "Security Defaults, FIDO2 restrictions, modern Exchange authentication, and some legacy-authentication user checks were not assessed.",
|
|
"nextStep": "Resolve permission or licensing prerequisites and re-run the authentication checks without treating current not-run states as compliant.",
|
|
"evidenceIds": [
|
|
"MT.1021",
|
|
"EIDSCA.AF05",
|
|
"MT.1044",
|
|
"MT.1033.0",
|
|
"MT.1033.1",
|
|
"MT.1033.2",
|
|
"MT.1033.3"
|
|
]
|
|
},
|
|
{
|
|
"title": "Hybrid identity checks failed to execute",
|
|
"impact": "Seamless SSO hardening and synchronized-object matching protections remain unknown because their checks returned execution errors.",
|
|
"nextStep": "Correct the scanner data or execution prerequisites and re-run both checks to obtain definitive outcomes.",
|
|
"evidenceIds": [
|
|
"MT.1084",
|
|
"MT.1073"
|
|
]
|
|
}
|
|
],
|
|
"quickWins": [
|
|
{
|
|
"title": "Investigate the unusual privileged sign-in warning using existing sign-in logs",
|
|
"findingIds": [
|
|
"MT.INV.001"
|
|
]
|
|
},
|
|
{
|
|
"title": "Review AdminSDHolder ACL changes against approved change records",
|
|
"findingIds": [
|
|
"SI000055"
|
|
]
|
|
},
|
|
{
|
|
"title": "Disable the domain-controller Print Spooler where it is not required",
|
|
"findingIds": [
|
|
"SI000077"
|
|
]
|
|
},
|
|
{
|
|
"title": "Enable privileged-role assignment and activation alert recipients",
|
|
"findingIds": [
|
|
"CISA.MS.AAD.7.7",
|
|
"CISA.MS.AAD.7.9"
|
|
]
|
|
},
|
|
{
|
|
"title": "Require write permission for creation of new management groups",
|
|
"findingIds": [
|
|
"MT.1064"
|
|
]
|
|
},
|
|
{
|
|
"title": "Start NTLM auditing before any deny policy is introduced",
|
|
"findingIds": [
|
|
"2.3.11.11",
|
|
"2.3.11.12",
|
|
"2.3.11.13"
|
|
]
|
|
}
|
|
],
|
|
"questions": [
|
|
"Were the AdminSDHolder permission changes authorized, and is there a corresponding approved change record?",
|
|
"What evidence supports or contradicts active exploitation of the Zerologon and AD CS findings?",
|
|
"Which certificate templates and web-enrollment services are business-critical, and what existing mitigations are documented?",
|
|
"Which privileged Entra assignments must remain permanent because of emergency-access or non-interactive service requirements?",
|
|
"Are Entra ID P1 or P2 and Privileged Identity Management capabilities licensed and operationally available?",
|
|
"Are any Conditional Access policies currently in report-only mode or excluded from the scanner view?",
|
|
"Are Entra security logs already forwarded to another monitored platform through a path the assessment could not observe?",
|
|
"Which external collaboration and SharePoint sharing scenarios are formally approved by the business?",
|
|
"Which applications depend on client secrets or privileged service-principal roles, and what rotation constraints apply?",
|
|
"What caused the not-run and execution-error checks: permissions, licensing, connectivity, missing telemetry, or scanner limitations?"
|
|
],
|
|
"assumptions": [
|
|
"The summary object is treated as authoritative for all assessment counts.",
|
|
"Failed results and deviation flags are treated as confirmed configuration deviations, not proof of successful exploitation.",
|
|
"Indicators of exposure are prioritized above comparable non-IoE deviations.",
|
|
"Warnings require investigation and are not treated as confirmed compromise.",
|
|
"Not-run checks and execution errors are treated only as coverage gaps.",
|
|
"Environment facts are used only for context and are not promoted into findings.",
|
|
"No missing description or recommendation is inferred beyond the evidence provided."
|
|
]
|
|
} |