diff --git a/website/docs/tests/ad/AD-CFG-01.md b/website/docs/tests/ad/AD-CFG-01.md index dd78fb3f2..7f26a8ef1 100644 --- a/website/docs/tests/ad/AD-CFG-01.md +++ b/website/docs/tests/ad/AD-CFG-01.md @@ -62,6 +62,7 @@ This test retrieves the environment’s configured tombstone lifetime value from | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdTombstoneLifetimeConfig](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-CFG-02.md b/website/docs/tests/ad/AD-CFG-02.md index d416df016..d62caa2d9 100644 --- a/website/docs/tests/ad/AD-CFG-02.md +++ b/website/docs/tests/ad/AD-CFG-02.md @@ -65,6 +65,7 @@ This test queries AD configuration for the dSHeuristics setting(s) and reports a | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDsHeuristicsCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-02.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-CFG-03.md b/website/docs/tests/ad/AD-CFG-03.md index 6fbebf4a9..ca2dc1d87 100644 --- a/website/docs/tests/ad/AD-CFG-03.md +++ b/website/docs/tests/ad/AD-CFG-03.md @@ -60,6 +60,7 @@ This test inspects the SPN mapping configuration exposed by AD, extracts the con | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdSpnMappings](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-03.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-CFG-04.md b/website/docs/tests/ad/AD-CFG-04.md index ef650a6f0..4489682ce 100644 --- a/website/docs/tests/ad/AD-CFG-04.md +++ b/website/docs/tests/ad/AD-CFG-04.md @@ -63,6 +63,7 @@ This test retrieves the set of enabled AD optional feature flags and reports the | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdOptionalFeaturesCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-04.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:msDS-OptionalFeature:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-CFG-05.md b/website/docs/tests/ad/AD-CFG-05.md index 2552a6387..8ed22d459 100644 --- a/website/docs/tests/ad/AD-CFG-05.md +++ b/website/docs/tests/ad/AD-CFG-05.md @@ -62,6 +62,7 @@ This test enumerates AD partitions/paths and reports which ones have Recycle Bin | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdRecycleBinEnabledPaths](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-05.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:msDS-OptionalFeature:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-CFG-06.md b/website/docs/tests/ad/AD-CFG-06.md index 29040553a..b3173e054 100644 --- a/website/docs/tests/ad/AD-CFG-06.md +++ b/website/docs/tests/ad/AD-CFG-06.md @@ -62,6 +62,7 @@ This test reads LDAP query policy configuration from AD and produces a count/vis | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdLdapQueryPolicyCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-06.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-CFG-07.md b/website/docs/tests/ad/AD-CFG-07.md index 2bedca22a..c0e7f1b1a 100644 --- a/website/docs/tests/ad/AD-CFG-07.md +++ b/website/docs/tests/ad/AD-CFG-07.md @@ -62,6 +62,7 @@ This test retrieves the default LDAP query policy values and reports them as an | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDefaultQueryPolicy](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-07.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-CFG-08.md b/website/docs/tests/ad/AD-CFG-08.md index 9745934ab..e8fd731c9 100644 --- a/website/docs/tests/ad/AD-CFG-08.md +++ b/website/docs/tests/ad/AD-CFG-08.md @@ -62,6 +62,7 @@ This test inspects AD authentication policy configuration and reports a count/vi | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdAuthNPolicyConfigCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-08.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-CFG-09.md b/website/docs/tests/ad/AD-CFG-09.md index d479230dc..ddeee8425 100644 --- a/website/docs/tests/ad/AD-CFG-09.md +++ b/website/docs/tests/ad/AD-CFG-09.md @@ -60,6 +60,7 @@ AD-based activation objects are used by Windows for volume activation and relate | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdAdActivationObjectsCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-09.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-CFG-10.md b/website/docs/tests/ad/AD-CFG-10.md index 496344e3c..53300a7c0 100644 --- a/website/docs/tests/ad/AD-CFG-10.md +++ b/website/docs/tests/ad/AD-CFG-10.md @@ -60,6 +60,7 @@ Well-known security principals are built-in identities with special meaning in A | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdWellKnownSecurityPrincipalsCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-10.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-CFG-11.md b/website/docs/tests/ad/AD-CFG-11.md index 35d52bd8f..8576911b2 100644 --- a/website/docs/tests/ad/AD-CFG-11.md +++ b/website/docs/tests/ad/AD-CFG-11.md @@ -60,6 +60,7 @@ DHCP servers registered in Active Directory are authorized to provide IP address | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdRegisteredDhcpServersCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-11.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-CFG-12.md b/website/docs/tests/ad/AD-CFG-12.md index f6c3ce6b6..64ead556e 100644 --- a/website/docs/tests/ad/AD-CFG-12.md +++ b/website/docs/tests/ad/AD-CFG-12.md @@ -61,6 +61,7 @@ Enterprise Certification Authorities (CAs) issue certificates for domain authent | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdEnterpriseCaCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-12.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-CFG-13.md b/website/docs/tests/ad/AD-CFG-13.md index 7147791a5..42f28ed8a 100644 --- a/website/docs/tests/ad/AD-CFG-13.md +++ b/website/docs/tests/ad/AD-CFG-13.md @@ -60,6 +60,7 @@ Certificate templates define which certificate types can be issued and under wha | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdCertificateTemplatesCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-13.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-CFG-14.md b/website/docs/tests/ad/AD-CFG-14.md index 294b73537..a2d28d0ae 100644 --- a/website/docs/tests/ad/AD-CFG-14.md +++ b/website/docs/tests/ad/AD-CFG-14.md @@ -60,6 +60,7 @@ Enrollment templates represent which certificate templates are available for use | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdEnrollmentTemplatesCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-14.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-CFG-15.md b/website/docs/tests/ad/AD-CFG-15.md index c1d0f5e48..e14df0aba 100644 --- a/website/docs/tests/ad/AD-CFG-15.md +++ b/website/docs/tests/ad/AD-CFG-15.md @@ -60,6 +60,7 @@ Enrollment-capable CA certificates include validity periods and other critical p | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdEnrollmentCaCertificateDetails](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-15.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-CFG-16.md b/website/docs/tests/ad/AD-CFG-16.md index 9c9cd6232..596de5261 100644 --- a/website/docs/tests/ad/AD-CFG-16.md +++ b/website/docs/tests/ad/AD-CFG-16.md @@ -60,6 +60,7 @@ Trusted root CAs act as the trust anchors for an entire PKI trust chain. If an a | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdTrustedRootCaCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-16.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-CFG-17.md b/website/docs/tests/ad/AD-CFG-17.md index f6698edc7..91db1bc45 100644 --- a/website/docs/tests/ad/AD-CFG-17.md +++ b/website/docs/tests/ad/AD-CFG-17.md @@ -61,6 +61,7 @@ The test enumerates trusted root CA certificates configured for AD (or in the mo | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdTrustedRootCaDetails](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-17.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-CFG-18.md b/website/docs/tests/ad/AD-CFG-18.md index c2a7d14e8..9a3145c06 100644 --- a/website/docs/tests/ad/AD-CFG-18.md +++ b/website/docs/tests/ad/AD-CFG-18.md @@ -63,6 +63,7 @@ The test queries AD configuration for intermediate CA entries and returns the nu | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdIntermediateCaCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-18.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-CFG-19.md b/website/docs/tests/ad/AD-CFG-19.md index 9b6cd4b22..37275b8ea 100644 --- a/website/docs/tests/ad/AD-CFG-19.md +++ b/website/docs/tests/ad/AD-CFG-19.md @@ -61,6 +61,7 @@ The test enumerates intermediate CA certificates in the AD configuration context | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdIntermediateCaDetails](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-19.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-CFG-20.md b/website/docs/tests/ad/AD-CFG-20.md index b1e1d8983..e9fcf1cfa 100644 --- a/website/docs/tests/ad/AD-CFG-20.md +++ b/website/docs/tests/ad/AD-CFG-20.md @@ -59,6 +59,7 @@ The test inspects AD configuration for CRL distribution point entries, counts th | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdCrlDistributionPointsCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-20.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-CFG-21.md b/website/docs/tests/ad/AD-CFG-21.md index 739b2772b..4ff84f1bd 100644 --- a/website/docs/tests/ad/AD-CFG-21.md +++ b/website/docs/tests/ad/AD-CFG-21.md @@ -59,6 +59,7 @@ The test queries the AD NTAuth certificate container, counts the number of confi | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdNtAuthCertificatesCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-21.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-CFG-22.md b/website/docs/tests/ad/AD-CFG-22.md index 1117805f0..0f907ce1c 100644 --- a/website/docs/tests/ad/AD-CFG-22.md +++ b/website/docs/tests/ad/AD-CFG-22.md @@ -68,6 +68,7 @@ The test enumerates KDS root keys present in Active Directory and evaluates the | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdKdsRootKeysCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-22.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-CFG-23.md b/website/docs/tests/ad/AD-CFG-23.md index 827d0d0d5..23a3b1961 100644 --- a/website/docs/tests/ad/AD-CFG-23.md +++ b/website/docs/tests/ad/AD-CFG-23.md @@ -59,6 +59,7 @@ The test queries AD site link configuration entries that use SMTP as the replica | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdSmtpSiteLinksCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-23.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-CFG-24.md b/website/docs/tests/ad/AD-CFG-24.md index 87d203258..d8ea820af 100644 --- a/website/docs/tests/ad/AD-CFG-24.md +++ b/website/docs/tests/ad/AD-CFG-24.md @@ -62,6 +62,7 @@ The test queries AD site link configuration entries using IP as the replication | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdIpSiteLinksCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-24.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-COMP-01.md b/website/docs/tests/ad/AD-COMP-01.md index 1e836616e..0992f3c7d 100644 --- a/website/docs/tests/ad/AD-COMP-01.md +++ b/website/docs/tests/ad/AD-COMP-01.md @@ -68,6 +68,7 @@ The test returns informational results to help you assess the scope of disabled | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdComputerDisabledCount](https://github.com/maester365/maester/blob/main/tests/ad/computer/Test.AD-COMP-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:computer:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-COMP-02.md b/website/docs/tests/ad/AD-COMP-02.md index bb8bd7aca..f22342d45 100644 --- a/website/docs/tests/ad/AD-COMP-02.md +++ b/website/docs/tests/ad/AD-COMP-02.md @@ -71,6 +71,7 @@ The default 90-day threshold is a common security baseline. Set `DormantThreshol | MITRE ATT&CK | T1078.002 Domain Accounts | | PowerShell test | [Test-MtAdComputerDormantCount](https://github.com/maester365/maester/blob/main/tests/ad/computer/Test.AD-COMP-02.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:computer:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-COMP-03.md b/website/docs/tests/ad/AD-COMP-03.md index 4e17e4059..bc8b67b14 100644 --- a/website/docs/tests/ad/AD-COMP-03.md +++ b/website/docs/tests/ad/AD-COMP-03.md @@ -71,6 +71,7 @@ Note: Not all computer accounts will have this attribute, depending on how they | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdComputerCreatorSidCount](https://github.com/maester365/maester/blob/main/tests/ad/computer/Test.AD-COMP-03.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:computer:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-COMP-04.md b/website/docs/tests/ad/AD-COMP-04.md index b5c82ace6..fedbf17bb 100644 --- a/website/docs/tests/ad/AD-COMP-04.md +++ b/website/docs/tests/ad/AD-COMP-04.md @@ -71,6 +71,7 @@ This test examines the `primaryGroupId` attribute of all enabled computer accoun | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdComputerNonStandardGroup](https://github.com/maester365/maester/blob/main/tests/ad/computer/Test.AD-COMP-04.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:computer:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-COMP-05.md b/website/docs/tests/ad/AD-COMP-05.md index 6bcabff93..21ff6fcf5 100644 --- a/website/docs/tests/ad/AD-COMP-05.md +++ b/website/docs/tests/ad/AD-COMP-05.md @@ -71,6 +71,7 @@ This test counts computer objects where the `SIDHistory` attribute is populated. | MITRE ATT&CK | T1134.005 SID-History Injection | | PowerShell test | [Test-MtAdComputerSidHistoryCount](https://github.com/maester365/maester/blob/main/tests/ad/computer/Test.AD-COMP-05.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:computer:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-COMP-06.md b/website/docs/tests/ad/AD-COMP-06.md index b00a34f3a..a71ad4d1b 100644 --- a/website/docs/tests/ad/AD-COMP-06.md +++ b/website/docs/tests/ad/AD-COMP-06.md @@ -69,6 +69,7 @@ This test identifies enabled computer accounts where the Distinguished Name cont | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdComputerInDefaultContainer](https://github.com/maester365/maester/blob/main/tests/ad/computer/Test.AD-COMP-06.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:computer:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-COMP-07.md b/website/docs/tests/ad/AD-COMP-07.md index 996e0c6d3..fc56a140e 100644 --- a/website/docs/tests/ad/AD-COMP-07.md +++ b/website/docs/tests/ad/AD-COMP-07.md @@ -71,6 +71,7 @@ This test analyzes all enabled computer accounts and counts the distinct organiz | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdComputerOUCount](https://github.com/maester365/maester/blob/main/tests/ad/computer/Test.AD-COMP-07.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:computer:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-COMP-08.md b/website/docs/tests/ad/AD-COMP-08.md index e4fb6a494..97bbb5766 100644 --- a/website/docs/tests/ad/AD-COMP-08.md +++ b/website/docs/tests/ad/AD-COMP-08.md @@ -75,6 +75,7 @@ This test groups all enabled computers by their parent container and calculates: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdComputerPerOUAverage](https://github.com/maester365/maester/blob/main/tests/ad/computer/Test.AD-COMP-08.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:computer:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-COMP-09.md b/website/docs/tests/ad/AD-COMP-09.md index 3e087e0ac..4d2fd6f06 100644 --- a/website/docs/tests/ad/AD-COMP-09.md +++ b/website/docs/tests/ad/AD-COMP-09.md @@ -70,6 +70,7 @@ This test counts computers with different delegation configurations: | MITRE ATT&CK | T1558 Steal or Forge Kerberos Tickets, T1550.003 Pass the Ticket | | PowerShell test | [Test-MtAdComputerDelegationCount](https://github.com/maester365/maester/blob/main/tests/ad/computer/Test.AD-COMP-09.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:computer:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-COMP-10.md b/website/docs/tests/ad/AD-COMP-10.md index ffa29364c..98de49e8a 100644 --- a/website/docs/tests/ad/AD-COMP-10.md +++ b/website/docs/tests/ad/AD-COMP-10.md @@ -75,6 +75,7 @@ This test provides a detailed breakdown of: | MITRE ATT&CK | T1558 Steal or Forge Kerberos Tickets, T1550.003 Pass the Ticket | | PowerShell test | [Test-MtAdComputerDelegationDetails](https://github.com/maester365/maester/blob/main/tests/ad/computer/Test.AD-COMP-10.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:computer:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-DACL-01.md b/website/docs/tests/ad/AD-DACL-01.md index 502494275..67397a5b3 100644 --- a/website/docs/tests/ad/AD-DACL-01.md +++ b/website/docs/tests/ad/AD-DACL-01.md @@ -65,6 +65,7 @@ This test retrieves `$adState.DaclEntries`, extracts the `ObjectDN` value from e | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDaclDistinctObjectCount](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl | | Long running | Yes | ## Source diff --git a/website/docs/tests/ad/AD-DACL-02.md b/website/docs/tests/ad/AD-DACL-02.md index 2c26cf9de..35a7189a0 100644 --- a/website/docs/tests/ad/AD-DACL-02.md +++ b/website/docs/tests/ad/AD-DACL-02.md @@ -65,6 +65,7 @@ This test retrieves `$adState.DaclEntries`, filters entries where `ObjectClass` | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDaclOuObjectCount](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-02.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl | | Long running | Yes | ## Source diff --git a/website/docs/tests/ad/AD-DACL-03.md b/website/docs/tests/ad/AD-DACL-03.md index aa3a7142b..0e9b791e2 100644 --- a/website/docs/tests/ad/AD-DACL-03.md +++ b/website/docs/tests/ad/AD-DACL-03.md @@ -65,6 +65,7 @@ This test retrieves `$adState.DaclEntries`, searches for `CNF` within `ObjectDN` | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDaclConflictObjectCount](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-03.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl | | Long running | Yes | ## Source diff --git a/website/docs/tests/ad/AD-DACL-04.md b/website/docs/tests/ad/AD-DACL-04.md index 58923fa42..3e6a62ab6 100644 --- a/website/docs/tests/ad/AD-DACL-04.md +++ b/website/docs/tests/ad/AD-DACL-04.md @@ -65,6 +65,7 @@ This test retrieves `$adState.DaclEntries`, filters for entries whose `ObjectDN` | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDaclConflictObjectDetails](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-04.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl | | Long running | Yes | ## Source diff --git a/website/docs/tests/ad/AD-DACL-05.md b/website/docs/tests/ad/AD-DACL-05.md index 42d920e1f..de9efe301 100644 --- a/website/docs/tests/ad/AD-DACL-05.md +++ b/website/docs/tests/ad/AD-DACL-05.md @@ -65,6 +65,7 @@ This test retrieves `$adState.DaclEntries`, filters entries where `AccessControl | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDaclDenyAceCount](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-05.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl | | Long running | Yes | ## Source diff --git a/website/docs/tests/ad/AD-DACL-06.md b/website/docs/tests/ad/AD-DACL-06.md index b4808e68c..dfb18aca9 100644 --- a/website/docs/tests/ad/AD-DACL-06.md +++ b/website/docs/tests/ad/AD-DACL-06.md @@ -65,6 +65,7 @@ This test retrieves `$adState.DaclEntries`, filters entries where `AccessControl | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDaclDenyAceDetails](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-06.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl | | Long running | Yes | ## Source diff --git a/website/docs/tests/ad/AD-DACL-07.md b/website/docs/tests/ad/AD-DACL-07.md index 38ee34cf5..2d34e2288 100644 --- a/website/docs/tests/ad/AD-DACL-07.md +++ b/website/docs/tests/ad/AD-DACL-07.md @@ -65,6 +65,7 @@ This test reads `DaclEntries` from `Get-MtADDomainState`, extracts unique `Ident | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDaclDistinctIdentityCount](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-07.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl | | Long running | Yes | ## Source diff --git a/website/docs/tests/ad/AD-DACL-08.md b/website/docs/tests/ad/AD-DACL-08.md index eb406a9d3..bde4a906b 100644 --- a/website/docs/tests/ad/AD-DACL-08.md +++ b/website/docs/tests/ad/AD-DACL-08.md @@ -65,6 +65,7 @@ This test reads `DaclEntries` from `Get-MtADDomainState`, groups entries by `Ide | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDaclIdentityAceDistribution](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-08.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl | | Long running | Yes | ## Source diff --git a/website/docs/tests/ad/AD-DACL-09.md b/website/docs/tests/ad/AD-DACL-09.md index 44ac4280d..974283831 100644 --- a/website/docs/tests/ad/AD-DACL-09.md +++ b/website/docs/tests/ad/AD-DACL-09.md @@ -65,6 +65,7 @@ This test reads `DaclEntries` from `Get-MtADDomainState`, filters to allow ACEs, | MITRE ATT&CK | T1098 Account Manipulation, T1222.001 Windows Permissions | | PowerShell test | [Test-MtAdDaclPrivilegedAllowAceCount](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-09.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl | | Long running | Yes | ## Source diff --git a/website/docs/tests/ad/AD-DACL-10.md b/website/docs/tests/ad/AD-DACL-10.md index b685a851c..96121004a 100644 --- a/website/docs/tests/ad/AD-DACL-10.md +++ b/website/docs/tests/ad/AD-DACL-10.md @@ -65,6 +65,7 @@ This test reads `DaclEntries` from `Get-MtADDomainState`, filters to allow ACEs | MITRE ATT&CK | T1098 Account Manipulation, T1222.001 Windows Permissions | | PowerShell test | [Test-MtAdDaclPrivilegedAllowAceDetails](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-10.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl | | Long running | Yes | ## Source diff --git a/website/docs/tests/ad/AD-DACL-11.md b/website/docs/tests/ad/AD-DACL-11.md index 530b5b474..a04493b13 100644 --- a/website/docs/tests/ad/AD-DACL-11.md +++ b/website/docs/tests/ad/AD-DACL-11.md @@ -65,6 +65,7 @@ This test reads `DaclEntries` from `Get-MtADDomainState`, filters to allow ACEs | MITRE ATT&CK | T1003.006 DCSync, T1098 Account Manipulation | | PowerShell test | [Test-MtAdDaclPrivilegedExtendedRightCount](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-11.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl | | Long running | Yes | ## Source diff --git a/website/docs/tests/ad/AD-DACL-12.md b/website/docs/tests/ad/AD-DACL-12.md index a0fd5de28..a06c23dd1 100644 --- a/website/docs/tests/ad/AD-DACL-12.md +++ b/website/docs/tests/ad/AD-DACL-12.md @@ -65,6 +65,7 @@ This test reads `DaclEntries` from `Get-MtADDomainState`, filters to allow ACEs | MITRE ATT&CK | T1003.006 DCSync, T1098 Account Manipulation | | PowerShell test | [Test-MtAdDaclPrivilegedExtendedRightDetails](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-12.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl | | Long running | Yes | ## Source diff --git a/website/docs/tests/ad/AD-DACL-13.md b/website/docs/tests/ad/AD-DACL-13.md index 3ae07f6ec..5325fe436 100644 --- a/website/docs/tests/ad/AD-DACL-13.md +++ b/website/docs/tests/ad/AD-DACL-13.md @@ -67,6 +67,7 @@ This test reads `$adState.DaclEntries`, filters for allow ACEs with `ActiveDirec | MITRE ATT&CK | T1003.006 DCSync, T1098 Account Manipulation | | PowerShell test | [Test-MtAdDaclPrivilegedExtendedRightIdentity](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-13.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl | | Long running | Yes | ## Source diff --git a/website/docs/tests/ad/AD-DACL-14.md b/website/docs/tests/ad/AD-DACL-14.md index 27b6ac1a5..839a73e9f 100644 --- a/website/docs/tests/ad/AD-DACL-14.md +++ b/website/docs/tests/ad/AD-DACL-14.md @@ -67,6 +67,7 @@ This test reads `$adState.DaclEntries` and counts entries where `IsInherited` is | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDaclNonInheritedAceCount](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-14.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl | | Long running | Yes | ## Source diff --git a/website/docs/tests/ad/AD-DACL-15.md b/website/docs/tests/ad/AD-DACL-15.md index 34bba2e19..00bb14aba 100644 --- a/website/docs/tests/ad/AD-DACL-15.md +++ b/website/docs/tests/ad/AD-DACL-15.md @@ -67,6 +67,7 @@ This test reads `$adState.DaclEntries` and looks for entries whose `IdentityRefe | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDaclUnresolvedSidCount](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-15.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl | | Long running | Yes | ## Source diff --git a/website/docs/tests/ad/AD-DACL-16.md b/website/docs/tests/ad/AD-DACL-16.md index c7dff1e3a..6a7f426ee 100644 --- a/website/docs/tests/ad/AD-DACL-16.md +++ b/website/docs/tests/ad/AD-DACL-16.md @@ -67,6 +67,7 @@ This test reads `$adState.DaclEntries`, filters unresolved `IdentityReference` v | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDaclUnresolvedSidDetails](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-16.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl | | Long running | Yes | ## Source diff --git a/website/docs/tests/ad/AD-DACL-17.md b/website/docs/tests/ad/AD-DACL-17.md index 5bec03803..2e4a289e8 100644 --- a/website/docs/tests/ad/AD-DACL-17.md +++ b/website/docs/tests/ad/AD-DACL-17.md @@ -67,6 +67,7 @@ This test reads `$adState.DaclEntries`, filters for `InheritedObjectType` GUIDs | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDaclInheritedObjectTypeCount](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-17.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl | | Long running | Yes | ## Source diff --git a/website/docs/tests/ad/AD-DACL-18.md b/website/docs/tests/ad/AD-DACL-18.md index 88ad01627..cce0ae5dd 100644 --- a/website/docs/tests/ad/AD-DACL-18.md +++ b/website/docs/tests/ad/AD-DACL-18.md @@ -67,6 +67,7 @@ This test reads `$adState.DaclEntries`, filters out the all-zero `InheritedObjec | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDaclInheritedObjectTypeDetails](https://github.com/maester365/maester/blob/main/tests/ad/dacl/Test.AD-DACL-18.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:*.ntSecurityDescriptor:ReadControl | | Long running | Yes | ## Source diff --git a/website/docs/tests/ad/AD-DC-01.md b/website/docs/tests/ad/AD-DC-01.md index 4d8896b72..b97a444c0 100644 --- a/website/docs/tests/ad/AD-DC-01.md +++ b/website/docs/tests/ad/AD-DC-01.md @@ -68,6 +68,7 @@ This test retrieves all domain controllers and counts the unique sites that cont | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDcSiteCoverageCount](https://github.com/maester365/maester/blob/main/tests/ad/domain-controller/Test.AD-DC-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:nTDSDSA:ReadProperty, ActiveDirectory:Ldap:site:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-DC-02.md b/website/docs/tests/ad/AD-DC-02.md index 6681f7e09..a9de939cf 100644 --- a/website/docs/tests/ad/AD-DC-02.md +++ b/website/docs/tests/ad/AD-DC-02.md @@ -83,6 +83,7 @@ This test queries the SMB server configuration on each domain controller to chec | Supports controls | nist-800-53-r5:CM-7 | | PowerShell test | [Test-MtAdDcSmbv1EnabledCount](https://github.com/maester365/maester/blob/main/tests/ad/domain-controller/Test.AD-DC-02.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\Microsoft\Windows\SMB:MSFT_SmbServerConfiguration:Read | ## Source diff --git a/website/docs/tests/ad/AD-DC-03.md b/website/docs/tests/ad/AD-DC-03.md index 5b6a23772..269c0e615 100644 --- a/website/docs/tests/ad/AD-DC-03.md +++ b/website/docs/tests/ad/AD-DC-03.md @@ -70,6 +70,7 @@ This test queries the SMB server configuration on each domain controller to chec | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDcSmbv311EnabledCount](https://github.com/maester365/maester/blob/main/tests/ad/domain-controller/Test.AD-DC-03.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\Microsoft\Windows\SMB:MSFT_SmbServerConfiguration:Read | ## Source diff --git a/website/docs/tests/ad/AD-DC-04.md b/website/docs/tests/ad/AD-DC-04.md index 7d05932bb..0c8f18ad0 100644 --- a/website/docs/tests/ad/AD-DC-04.md +++ b/website/docs/tests/ad/AD-DC-04.md @@ -83,6 +83,7 @@ This test queries the SMB server configuration on each domain controller to chec | Supports controls | nist-800-53-r5:SC-8 | | PowerShell test | [Test-MtAdDcSmbSigningEnabledCount](https://github.com/maester365/maester/blob/main/tests/ad/domain-controller/Test.AD-DC-04.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\Microsoft\Windows\SMB:MSFT_SmbServerConfiguration:Read | ## Source diff --git a/website/docs/tests/ad/AD-DC-05.md b/website/docs/tests/ad/AD-DC-05.md index e494e6a61..071c2a882 100644 --- a/website/docs/tests/ad/AD-DC-05.md +++ b/website/docs/tests/ad/AD-DC-05.md @@ -78,6 +78,7 @@ This test identifies which domain controllers hold FSMO roles and counts how man | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDcAllFsmoRolesCount](https://github.com/maester365/maester/blob/main/tests/ad/domain-controller/Test.AD-DC-05.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:domainDNS:ReadProperty, ActiveDirectory:Ldap:nTDSDSA:ReadProperty, ActiveDirectory:Ldap:crossRef:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-DC-06.md b/website/docs/tests/ad/AD-DC-06.md index 79d5bdbb1..d632a635f 100644 --- a/website/docs/tests/ad/AD-DC-06.md +++ b/website/docs/tests/ad/AD-DC-06.md @@ -77,6 +77,7 @@ This test retrieves the current FSMO role holders from the domain and forest obj | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDcFsmoRoleHolderDetails](https://github.com/maester365/maester/blob/main/tests/ad/domain-controller/Test.AD-DC-06.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:domainDNS:ReadProperty, ActiveDirectory:Ldap:nTDSDSA:ReadProperty, ActiveDirectory:Ldap:crossRef:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-DC-07.md b/website/docs/tests/ad/AD-DC-07.md index e1e25d884..d0447ee7c 100644 --- a/website/docs/tests/ad/AD-DC-07.md +++ b/website/docs/tests/ad/AD-DC-07.md @@ -82,6 +82,7 @@ This test retrieves the OperatingSystem attribute from all domain controllers an | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDcOperatingSystemCount](https://github.com/maester365/maester/blob/main/tests/ad/domain-controller/Test.AD-DC-07.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:nTDSDSA:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-DC-08.md b/website/docs/tests/ad/AD-DC-08.md index 1d1a6b330..13f6490fe 100644 --- a/website/docs/tests/ad/AD-DC-08.md +++ b/website/docs/tests/ad/AD-DC-08.md @@ -85,6 +85,7 @@ This test retrieves the OperatingSystem attribute from all domain controllers an | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDcOperatingSystemDetails](https://github.com/maester365/maester/blob/main/tests/ad/domain-controller/Test.AD-DC-08.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:nTDSDSA:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-DCD-01.md b/website/docs/tests/ad/AD-DCD-01.md index 50b18aa31..ba27b4db4 100644 --- a/website/docs/tests/ad/AD-DCD-01.md +++ b/website/docs/tests/ad/AD-DCD-01.md @@ -77,6 +77,7 @@ This test retrieves all domain controllers and checks their configured LDAP port | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDcNonStandardLdapPortCount](https://github.com/maester365/maester/blob/main/tests/ad/domain-controller/Test.AD-DCD-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:nTDSDSA:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-DCD-02.md b/website/docs/tests/ad/AD-DCD-02.md index ad7f635f9..9538b6a6c 100644 --- a/website/docs/tests/ad/AD-DCD-02.md +++ b/website/docs/tests/ad/AD-DCD-02.md @@ -77,6 +77,7 @@ This test retrieves all domain controllers and checks their configured LDAPS (SS | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDcNonStandardLdapsPortCount](https://github.com/maester365/maester/blob/main/tests/ad/domain-controller/Test.AD-DCD-02.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:nTDSDSA:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-DCD-03.md b/website/docs/tests/ad/AD-DCD-03.md index 8dd716d33..36882f446 100644 --- a/website/docs/tests/ad/AD-DCD-03.md +++ b/website/docs/tests/ad/AD-DCD-03.md @@ -78,6 +78,7 @@ This test retrieves all domain controllers and identifies which are configured a | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDcReadOnlyCount](https://github.com/maester365/maester/blob/main/tests/ad/domain-controller/Test.AD-DCD-03.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:nTDSDSA:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-DCD-04.md b/website/docs/tests/ad/AD-DCD-04.md index 9aa7c4070..624106667 100644 --- a/website/docs/tests/ad/AD-DCD-04.md +++ b/website/docs/tests/ad/AD-DCD-04.md @@ -82,6 +82,7 @@ The test provides different guidance based on whether the forest is single-domai | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDcNonGlobalCatalogCount](https://github.com/maester365/maester/blob/main/tests/ad/domain-controller/Test.AD-DCD-04.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:nTDSDSA:ReadProperty, ActiveDirectory:Ldap:crossRef:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-DCOMP-01.md b/website/docs/tests/ad/AD-DCOMP-01.md index 1ba643214..7a3209d7e 100644 --- a/website/docs/tests/ad/AD-DCOMP-01.md +++ b/website/docs/tests/ad/AD-DCOMP-01.md @@ -85,6 +85,7 @@ This test counts computers with the `TrustedForDelegation` flag enabled and cate | MITRE ATT&CK | T1558 Steal or Forge Kerberos Tickets, T1550.003 Pass the Ticket | | PowerShell test | [Test-MtAdComputerUnconstrainedDelegationCount](https://github.com/maester365/maester/blob/main/tests/ad/security/Test.AD-DCOMP-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:computer:ReadProperty, ActiveDirectory:Ldap:nTDSDSA:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-DCOMP-02.md b/website/docs/tests/ad/AD-DCOMP-02.md index 2bb8de5f5..3b5692615 100644 --- a/website/docs/tests/ad/AD-DCOMP-02.md +++ b/website/docs/tests/ad/AD-DCOMP-02.md @@ -93,6 +93,7 @@ This test specifically identifies non-DC computers with the `TrustedForDelegatio | Supports controls | nist-800-53-r5:AC-6 | | PowerShell test | [Test-MtAdComputerNonDcUnconstrainedDelegationCount](https://github.com/maester365/maester/blob/main/tests/ad/security/Test.AD-DCOMP-02.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:computer:ReadProperty, ActiveDirectory:Ldap:nTDSDSA:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-DCOMP-03.md b/website/docs/tests/ad/AD-DCOMP-03.md index 7ed73a4f7..6ce0e9483 100644 --- a/website/docs/tests/ad/AD-DCOMP-03.md +++ b/website/docs/tests/ad/AD-DCOMP-03.md @@ -86,6 +86,7 @@ This test counts non-DC computers with the `TrustedToAuthForDelegation` flag ena | MITRE ATT&CK | T1558 Steal or Forge Kerberos Tickets, T1550.003 Pass the Ticket | | PowerShell test | [Test-MtAdComputerNonDcConstrainedDelegationCount](https://github.com/maester365/maester/blob/main/tests/ad/security/Test.AD-DCOMP-03.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:computer:ReadProperty, ActiveDirectory:Ldap:nTDSDSA:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-DCOMP-04.md b/website/docs/tests/ad/AD-DCOMP-04.md index 60e862f38..3b4e5b0f8 100644 --- a/website/docs/tests/ad/AD-DCOMP-04.md +++ b/website/docs/tests/ad/AD-DCOMP-04.md @@ -87,6 +87,7 @@ This test analyzes computer objects in Active Directory and: | Supports controls | nist-800-53-r5:CM-8 | | PowerShell test | [Test-MtAdComputerOperatingSystemCount](https://github.com/maester365/maester/blob/main/tests/ad/security/Test.AD-DCOMP-04.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:computer:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-DCOMP-05.md b/website/docs/tests/ad/AD-DCOMP-05.md index 6f4d50573..f2350c54a 100644 --- a/website/docs/tests/ad/AD-DCOMP-05.md +++ b/website/docs/tests/ad/AD-DCOMP-05.md @@ -88,6 +88,7 @@ This test provides detailed analysis including: | Supports controls | nist-800-53-r5:CM-8 | | PowerShell test | [Test-MtAdComputerOperatingSystemDetails](https://github.com/maester365/maester/blob/main/tests/ad/security/Test.AD-DCOMP-05.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:computer:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-DCOMP-06.md b/website/docs/tests/ad/AD-DCOMP-06.md index 082901f79..a2f2dc8f0 100644 --- a/website/docs/tests/ad/AD-DCOMP-06.md +++ b/website/docs/tests/ad/AD-DCOMP-06.md @@ -96,6 +96,7 @@ Provides counts and lists affected computers. | Supports controls | nist-800-53-r5:AC-2(3) | | PowerShell test | [Test-MtAdComputerStaleEnabledCount](https://github.com/maester365/maester/blob/main/tests/ad/security/Test.AD-DCOMP-06.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:computer:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-DCOMP-07.md b/website/docs/tests/ad/AD-DCOMP-07.md index 1e1331ea3..8e82a7b1b 100644 --- a/website/docs/tests/ad/AD-DCOMP-07.md +++ b/website/docs/tests/ad/AD-DCOMP-07.md @@ -88,6 +88,7 @@ This test counts computers with and without the `dNSHostName` attribute populate | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdComputerDnsHostNameCount](https://github.com/maester365/maester/blob/main/tests/ad/security/Test.AD-DCOMP-07.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:computer:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-DCOMP-08.md b/website/docs/tests/ad/AD-DCOMP-08.md index 7549705f8..8409ab81e 100644 --- a/website/docs/tests/ad/AD-DCOMP-08.md +++ b/website/docs/tests/ad/AD-DCOMP-08.md @@ -87,6 +87,7 @@ This test extracts DNS zones from computer `dNSHostName` attributes and: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdComputerDnsZoneCount](https://github.com/maester365/maester/blob/main/tests/ad/security/Test.AD-DCOMP-08.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:computer:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-DCOMP-09.md b/website/docs/tests/ad/AD-DCOMP-09.md index 85d1a76e8..5dd016a06 100644 --- a/website/docs/tests/ad/AD-DCOMP-09.md +++ b/website/docs/tests/ad/AD-DCOMP-09.md @@ -88,6 +88,7 @@ This test provides detailed analysis: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdComputerDnsZoneDetails](https://github.com/maester365/maester/blob/main/tests/ad/security/Test.AD-DCOMP-09.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:computer:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-DFSR-01.md b/website/docs/tests/ad/AD-DFSR-01.md index 8b33396fc..19ea983c2 100644 --- a/website/docs/tests/ad/AD-DFSR-01.md +++ b/website/docs/tests/ad/AD-DFSR-01.md @@ -74,6 +74,7 @@ This test counts DFS-R subscription objects and reports: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDfsrSubscriptionCount](https://github.com/maester365/maester/blob/main/tests/ad/replication/Test.AD-DFSR-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:nTDSDSA:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-DNS-01.md b/website/docs/tests/ad/AD-DNS-01.md index dff9e3f72..9cb0eaddd 100644 --- a/website/docs/tests/ad/AD-DNS-01.md +++ b/website/docs/tests/ad/AD-DNS-01.md @@ -66,6 +66,7 @@ This test retrieves all DNS zones and counts those that contain resource records | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDnsZoneCount](https://github.com/maester365/maester/blob/main/tests/ad/dns/Test.AD-DNS-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read | ## Source diff --git a/website/docs/tests/ad/AD-DNS-02.md b/website/docs/tests/ad/AD-DNS-02.md index 842d321be..3dc159fcb 100644 --- a/website/docs/tests/ad/AD-DNS-02.md +++ b/website/docs/tests/ad/AD-DNS-02.md @@ -66,6 +66,7 @@ This test identifies DNS zones that contain only SOA and NS records, with no A, | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDnsZonesWithOnlySoaNs](https://github.com/maester365/maester/blob/main/tests/ad/dns/Test.AD-DNS-02.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read | ## Source diff --git a/website/docs/tests/ad/AD-DNS-03.md b/website/docs/tests/ad/AD-DNS-03.md index 04b074006..12eff25e7 100644 --- a/website/docs/tests/ad/AD-DNS-03.md +++ b/website/docs/tests/ad/AD-DNS-03.md @@ -67,6 +67,7 @@ This test compares configured root server IP addresses against the official IANA | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDnsRootServerIncorrectCount](https://github.com/maester365/maester/blob/main/tests/ad/dns/Test.AD-DNS-03.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read | ## Source diff --git a/website/docs/tests/ad/AD-DNS-04.md b/website/docs/tests/ad/AD-DNS-04.md index d6a60b7ca..600eeb358 100644 --- a/website/docs/tests/ad/AD-DNS-04.md +++ b/website/docs/tests/ad/AD-DNS-04.md @@ -69,6 +69,7 @@ This test provides detailed information about each root server that has an incor | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDnsRootServerIncorrectDetails](https://github.com/maester365/maester/blob/main/tests/ad/dns/Test.AD-DNS-04.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read | ## Source diff --git a/website/docs/tests/ad/AD-DNS-05.md b/website/docs/tests/ad/AD-DNS-05.md index 9abd2dbc3..71538a743 100644 --- a/website/docs/tests/ad/AD-DNS-05.md +++ b/website/docs/tests/ad/AD-DNS-05.md @@ -67,6 +67,7 @@ This test counts DNS records that have timestamps (dynamic) versus those without | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDnsDynamicRecordCount](https://github.com/maester365/maester/blob/main/tests/ad/dns/Test.AD-DNS-05.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read | ## Source diff --git a/website/docs/tests/ad/AD-DNS-06.md b/website/docs/tests/ad/AD-DNS-06.md index af534f18f..666138f95 100644 --- a/website/docs/tests/ad/AD-DNS-06.md +++ b/website/docs/tests/ad/AD-DNS-06.md @@ -63,6 +63,7 @@ This test identifies DNS zones that contain records beyond the default SOA and N | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDnsZonesWithRecordsCount](https://github.com/maester365/maester/blob/main/tests/ad/dns/Test.AD-DNS-06.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read | ## Source diff --git a/website/docs/tests/ad/AD-DNS-07.md b/website/docs/tests/ad/AD-DNS-07.md index 637828ed0..6c719db51 100644 --- a/website/docs/tests/ad/AD-DNS-07.md +++ b/website/docs/tests/ad/AD-DNS-07.md @@ -66,6 +66,7 @@ This test provides a detailed breakdown of record counts per zone, including the | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDnsZoneRecordDetails](https://github.com/maester365/maester/blob/main/tests/ad/dns/Test.AD-DNS-07.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read | ## Source diff --git a/website/docs/tests/ad/AD-DNS-08.md b/website/docs/tests/ad/AD-DNS-08.md index 402a9b042..760e599e1 100644 --- a/website/docs/tests/ad/AD-DNS-08.md +++ b/website/docs/tests/ad/AD-DNS-08.md @@ -65,6 +65,7 @@ This test counts NS records that represent delegations (where the record name is | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDnsZoneDelegationCount](https://github.com/maester365/maester/blob/main/tests/ad/dns/Test.AD-DNS-08.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read | ## Source diff --git a/website/docs/tests/ad/AD-DNS-09.md b/website/docs/tests/ad/AD-DNS-09.md index e4ea58fda..27b75e441 100644 --- a/website/docs/tests/ad/AD-DNS-09.md +++ b/website/docs/tests/ad/AD-DNS-09.md @@ -69,6 +69,7 @@ This test provides detailed information about each zone delegation, including: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDnsZoneDelegationDetails](https://github.com/maester365/maester/blob/main/tests/ad/dns/Test.AD-DNS-09.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read | ## Source diff --git a/website/docs/tests/ad/AD-DNS-10.md b/website/docs/tests/ad/AD-DNS-10.md index 20d515906..895f704f5 100644 --- a/website/docs/tests/ad/AD-DNS-10.md +++ b/website/docs/tests/ad/AD-DNS-10.md @@ -71,6 +71,7 @@ This test retrieves SOA record details for each zone, including primary server, | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDnsSoaDetails](https://github.com/maester365/maester/blob/main/tests/ad/dns/Test.AD-DNS-10.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read | ## Source diff --git a/website/docs/tests/ad/AD-DNS-11.md b/website/docs/tests/ad/AD-DNS-11.md index 359b2b2fe..29c105aaa 100644 --- a/website/docs/tests/ad/AD-DNS-11.md +++ b/website/docs/tests/ad/AD-DNS-11.md @@ -71,6 +71,7 @@ This test counts SRV records used by Active Directory Domain Services, including | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDnsAdSrvRecordCount](https://github.com/maester365/maester/blob/main/tests/ad/dns/Test.AD-DNS-11.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read | ## Source diff --git a/website/docs/tests/ad/AD-DNS-12.md b/website/docs/tests/ad/AD-DNS-12.md index 664b620cf..62fea7c64 100644 --- a/website/docs/tests/ad/AD-DNS-12.md +++ b/website/docs/tests/ad/AD-DNS-12.md @@ -71,6 +71,7 @@ This test provides detailed information about each AD DS SRV record, including: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDnsAdSrvRecordDetails](https://github.com/maester365/maester/blob/main/tests/ad/dns/Test.AD-DNS-12.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read | ## Source diff --git a/website/docs/tests/ad/AD-DNS-13.md b/website/docs/tests/ad/AD-DNS-13.md index fcdc09746..2d359c984 100644 --- a/website/docs/tests/ad/AD-DNS-13.md +++ b/website/docs/tests/ad/AD-DNS-13.md @@ -65,6 +65,7 @@ This test counts DNSSEC trust anchor records configured in the TrustAnchors zone | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDnsDnssecRecordCount](https://github.com/maester365/maester/blob/main/tests/ad/dns/Test.AD-DNS-13.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read | ## Source diff --git a/website/docs/tests/ad/AD-DNS-14.md b/website/docs/tests/ad/AD-DNS-14.md index cc4f7e8fa..813220241 100644 --- a/website/docs/tests/ad/AD-DNS-14.md +++ b/website/docs/tests/ad/AD-DNS-14.md @@ -68,6 +68,7 @@ This test identifies DNS zones that contain zero resource records of any type. | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDnsEmptyZoneCount](https://github.com/maester365/maester/blob/main/tests/ad/dns/Test.AD-DNS-14.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read | ## Source diff --git a/website/docs/tests/ad/AD-DNS-15.md b/website/docs/tests/ad/AD-DNS-15.md index d9c780cfe..4cc5daef4 100644 --- a/website/docs/tests/ad/AD-DNS-15.md +++ b/website/docs/tests/ad/AD-DNS-15.md @@ -67,6 +67,7 @@ This test identifies zones with names containing " CNF:" or "..InProgress-" pref | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDnsDuplicateZoneCount](https://github.com/maester365/maester/blob/main/tests/ad/dns/Test.AD-DNS-15.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read | ## Source diff --git a/website/docs/tests/ad/AD-DNS-16.md b/website/docs/tests/ad/AD-DNS-16.md index 96c3875aa..ff6d120f2 100644 --- a/website/docs/tests/ad/AD-DNS-16.md +++ b/website/docs/tests/ad/AD-DNS-16.md @@ -68,6 +68,7 @@ This test counts reverse lookup zones (zones ending in .in-addr.arpa for IPv4 an | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDnsReverseZoneCount](https://github.com/maester365/maester/blob/main/tests/ad/dns/Test.AD-DNS-16.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read | ## Source diff --git a/website/docs/tests/ad/AD-DNS-17.md b/website/docs/tests/ad/AD-DNS-17.md index d15442b7d..f434c49c0 100644 --- a/website/docs/tests/ad/AD-DNS-17.md +++ b/website/docs/tests/ad/AD-DNS-17.md @@ -67,6 +67,7 @@ This test identifies zones with names that do not comply with RFC standards for | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDnsNonStandardZoneCount](https://github.com/maester365/maester/blob/main/tests/ad/dns/Test.AD-DNS-17.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read | ## Source diff --git a/website/docs/tests/ad/AD-DNS-18.md b/website/docs/tests/ad/AD-DNS-18.md index fc6a11f61..4aefc383a 100644 --- a/website/docs/tests/ad/AD-DNS-18.md +++ b/website/docs/tests/ad/AD-DNS-18.md @@ -68,6 +68,7 @@ This test analyzes reverse lookup zone names to extract and count unique network | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDnsReverseZoneNetworkCount](https://github.com/maester365/maester/blob/main/tests/ad/dns/Test.AD-DNS-18.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read | ## Source diff --git a/website/docs/tests/ad/AD-DNS-19.md b/website/docs/tests/ad/AD-DNS-19.md index 7a5804a5d..a40085294 100644 --- a/website/docs/tests/ad/AD-DNS-19.md +++ b/website/docs/tests/ad/AD-DNS-19.md @@ -73,6 +73,7 @@ This test provides detailed information about each network with a reverse lookup | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDnsReverseZoneNetworkDetails](https://github.com/maester365/maester/blob/main/tests/ad/dns/Test.AD-DNS-19.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read | ## Source diff --git a/website/docs/tests/ad/AD-DOM-01.md b/website/docs/tests/ad/AD-DOM-01.md index 731523d53..1ce56f9aa 100644 --- a/website/docs/tests/ad/AD-DOM-01.md +++ b/website/docs/tests/ad/AD-DOM-01.md @@ -72,6 +72,7 @@ This test retrieves the current domain functional level from Active Directory an | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDomainFunctionalLevel](https://github.com/maester365/maester/blob/main/tests/ad/domain/Test.AD-DOM-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:domainDNS.name:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-DOM-02.md b/website/docs/tests/ad/AD-DOM-02.md index a46d7b1c6..dfe92994c 100644 --- a/website/docs/tests/ad/AD-DOM-02.md +++ b/website/docs/tests/ad/AD-DOM-02.md @@ -77,6 +77,7 @@ This test retrieves the current machine account quota value from Active Director | MITRE ATT&CK | T1136.002 Domain Account | | PowerShell test | [Test-MtAdMachineAccountQuota](https://github.com/maester365/maester/blob/main/tests/ad/domain/Test.AD-DOM-02.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:domainDNS.ms-DS-MachineAccountQuota:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-DOM-03.md b/website/docs/tests/ad/AD-DOM-03.md index 24db181de..df52cd0b9 100644 --- a/website/docs/tests/ad/AD-DOM-03.md +++ b/website/docs/tests/ad/AD-DOM-03.md @@ -66,6 +66,7 @@ This test retrieves all domain controllers from Active Directory and counts them | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDomainControllerCount](https://github.com/maester365/maester/blob/main/tests/ad/domain/Test.AD-DOM-03.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:domainDNS.name:ReadProperty, ActiveDirectory:Ldap:nTDSDSA:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-DOM-04.md b/website/docs/tests/ad/AD-DOM-04.md index a586a60eb..0adeedcc7 100644 --- a/website/docs/tests/ad/AD-DOM-04.md +++ b/website/docs/tests/ad/AD-DOM-04.md @@ -74,6 +74,7 @@ This test retrieves the RID available pool from Active Directory and calculates | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdRidsRemaining](https://github.com/maester365/maester/blob/main/tests/ad/domain/Test.AD-DOM-04.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:domainDNS.rIDAvailablePool:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-DOM-05.md b/website/docs/tests/ad/AD-DOM-05.md index 08a9fd665..1f96971d0 100644 --- a/website/docs/tests/ad/AD-DOM-05.md +++ b/website/docs/tests/ad/AD-DOM-05.md @@ -72,6 +72,7 @@ This test checks all domain names in the forest against RFC 1123 naming standard | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDomainNameStandardCompliance](https://github.com/maester365/maester/blob/main/tests/ad/domain/Test.AD-DOM-05.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:crossRef:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-DOM-06.md b/website/docs/tests/ad/AD-DOM-06.md index 7477f4e4b..5e39fc78f 100644 --- a/website/docs/tests/ad/AD-DOM-06.md +++ b/website/docs/tests/ad/AD-DOM-06.md @@ -68,6 +68,7 @@ This test checks each domain name label against RFC 1123 standards and provides | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDomainNameNonStandardDetails](https://github.com/maester365/maester/blob/main/tests/ad/domain/Test.AD-DOM-06.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:crossRef:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-DOM-07.md b/website/docs/tests/ad/AD-DOM-07.md index fc3db653d..cd642467b 100644 --- a/website/docs/tests/ad/AD-DOM-07.md +++ b/website/docs/tests/ad/AD-DOM-07.md @@ -71,6 +71,7 @@ This test validates NetBIOS names against standard naming conventions, checking | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdNetbiosNameStandardCompliance](https://github.com/maester365/maester/blob/main/tests/ad/domain/Test.AD-DOM-07.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:domainDNS:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-DOM-08.md b/website/docs/tests/ad/AD-DOM-08.md index 7b8d5f0dd..ab4d9857b 100644 --- a/website/docs/tests/ad/AD-DOM-08.md +++ b/website/docs/tests/ad/AD-DOM-08.md @@ -68,6 +68,7 @@ This test checks each NetBIOS name for length compliance (1-15 characters) and i | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdNetbiosNameNonStandardDetails](https://github.com/maester365/maester/blob/main/tests/ad/domain/Test.AD-DOM-08.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:domainDNS:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-DOMS-01.md b/website/docs/tests/ad/AD-DOMS-01.md index e483d26ad..274e5c5b5 100644 --- a/website/docs/tests/ad/AD-DOMS-01.md +++ b/website/docs/tests/ad/AD-DOMS-01.md @@ -70,6 +70,7 @@ This test retrieves the allowed DNS suffixes configuration from the domain using | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdAllowedDnsSuffixesCount](https://github.com/maester365/maester/blob/main/tests/ad/domain/Test.AD-DOMS-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:domainDNS.name:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-FEAT-01.md b/website/docs/tests/ad/AD-FEAT-01.md index 0d32510fb..b504510ec 100644 --- a/website/docs/tests/ad/AD-FEAT-01.md +++ b/website/docs/tests/ad/AD-FEAT-01.md @@ -70,6 +70,7 @@ This test retrieves all Active Directory optional features and counts: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdOptionalFeatureCount](https://github.com/maester365/maester/blob/main/tests/ad/replication/Test.AD-FEAT-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:msDS-OptionalFeature:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-FEAT-02.md b/website/docs/tests/ad/AD-FEAT-02.md index 2e6f476ee..92658693c 100644 --- a/website/docs/tests/ad/AD-FEAT-02.md +++ b/website/docs/tests/ad/AD-FEAT-02.md @@ -72,6 +72,7 @@ This test retrieves detailed information about enabled optional features: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdOptionalFeatureEnabledDetails](https://github.com/maester365/maester/blob/main/tests/ad/replication/Test.AD-FEAT-02.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:msDS-OptionalFeature:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-FGPP-01.md b/website/docs/tests/ad/AD-FGPP-01.md index 76818e041..d4e601cc8 100644 --- a/website/docs/tests/ad/AD-FGPP-01.md +++ b/website/docs/tests/ad/AD-FGPP-01.md @@ -78,6 +78,7 @@ This test retrieves all fine-grained password policies using `Get-ADFineGrainedP | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdFineGrainedPolicyCount](https://github.com/maester365/maester/blob/main/tests/ad/password-policy/Test.AD-FGPP-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:msDS-PasswordSettings:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-FGPP-02.md b/website/docs/tests/ad/AD-FGPP-02.md index 464615c62..9156ca5e4 100644 --- a/website/docs/tests/ad/AD-FGPP-02.md +++ b/website/docs/tests/ad/AD-FGPP-02.md @@ -82,6 +82,7 @@ The test reports the variety of settings across all policies. | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdFineGrainedPolicyValueCount](https://github.com/maester365/maester/blob/main/tests/ad/password-policy/Test.AD-FGPP-02.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:msDS-PasswordSettings:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-FGPP-03.md b/website/docs/tests/ad/AD-FGPP-03.md index 925b37123..d8811b157 100644 --- a/website/docs/tests/ad/AD-FGPP-03.md +++ b/website/docs/tests/ad/AD-FGPP-03.md @@ -84,6 +84,7 @@ This test retrieves all fine-grained password policies using `Get-ADFineGrainedP | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdFineGrainedPolicySettingCounts](https://github.com/maester365/maester/blob/main/tests/ad/password-policy/Test.AD-FGPP-03.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:msDS-PasswordSettings:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-FGPP-04.md b/website/docs/tests/ad/AD-FGPP-04.md index cdac241a8..2d5358279 100644 --- a/website/docs/tests/ad/AD-FGPP-04.md +++ b/website/docs/tests/ad/AD-FGPP-04.md @@ -82,6 +82,7 @@ This test retrieves all fine-grained password policies using `Get-ADFineGrainedP | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdFineGrainedPolicyAppliesTo](https://github.com/maester365/maester/blob/main/tests/ad/password-policy/Test.AD-FGPP-04.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:computer.name:ReadProperty, ActiveDirectory:Ldap:msDS-PasswordSettings:ReadProperty, ActiveDirectory:Ldap:group.name:ReadProperty, ActiveDirectory:Ldap:user.name:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-FOR-01.md b/website/docs/tests/ad/AD-FOR-01.md index 6c15e3aa6..bd651d5e5 100644 --- a/website/docs/tests/ad/AD-FOR-01.md +++ b/website/docs/tests/ad/AD-FOR-01.md @@ -73,6 +73,7 @@ This test retrieves the current forest functional level from Active Directory al | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdForestFunctionalLevel](https://github.com/maester365/maester/blob/main/tests/ad/domain/Test.AD-FOR-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:crossRef:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-FOR-02.md b/website/docs/tests/ad/AD-FOR-02.md index 9b278fb2d..bef11201a 100644 --- a/website/docs/tests/ad/AD-FOR-02.md +++ b/website/docs/tests/ad/AD-FOR-02.md @@ -67,6 +67,7 @@ This test retrieves all domains from the Active Directory forest and counts them | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdForestDomainCount](https://github.com/maester365/maester/blob/main/tests/ad/domain/Test.AD-FOR-02.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:crossRef:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-FOR-03.md b/website/docs/tests/ad/AD-FOR-03.md index e55e4b344..15c68f957 100644 --- a/website/docs/tests/ad/AD-FOR-03.md +++ b/website/docs/tests/ad/AD-FOR-03.md @@ -76,6 +76,7 @@ This test retrieves the tombstone lifetime from the Directory Service configurat | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdTombstoneLifetime](https://github.com/maester365/maester/blob/main/tests/ad/domain/Test.AD-FOR-03.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty, ActiveDirectory:Ldap:crossRef:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-FOR-04.md b/website/docs/tests/ad/AD-FOR-04.md index d1fc7b8c2..4e6761598 100644 --- a/website/docs/tests/ad/AD-FOR-04.md +++ b/website/docs/tests/ad/AD-FOR-04.md @@ -77,6 +77,7 @@ This test checks the optional features in Active Directory to determine if the R | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdRecycleBinStatus](https://github.com/maester365/maester/blob/main/tests/ad/domain/Test.AD-FOR-04.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:crossRef:ReadProperty, ActiveDirectory:Ldap:msDS-OptionalFeature:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-FORS-01.md b/website/docs/tests/ad/AD-FORS-01.md index 07e885a77..2bade266a 100644 --- a/website/docs/tests/ad/AD-FORS-01.md +++ b/website/docs/tests/ad/AD-FORS-01.md @@ -66,6 +66,7 @@ This test retrieves the UPN suffixes configured at the forest level using the `G | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdUpnSuffixesCount](https://github.com/maester365/maester/blob/main/tests/ad/domain/Test.AD-FORS-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:crossRef:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-FORS-02.md b/website/docs/tests/ad/AD-FORS-02.md index 9bc11387a..3276f0757 100644 --- a/website/docs/tests/ad/AD-FORS-02.md +++ b/website/docs/tests/ad/AD-FORS-02.md @@ -68,6 +68,7 @@ This test retrieves the complete list of UPN suffixes configured at the forest l | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdUpnSuffixesDetails](https://github.com/maester365/maester/blob/main/tests/ad/domain/Test.AD-FORS-02.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:crossRef:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-FORS-03.md b/website/docs/tests/ad/AD-FORS-03.md index e835e113a..0878475c0 100644 --- a/website/docs/tests/ad/AD-FORS-03.md +++ b/website/docs/tests/ad/AD-FORS-03.md @@ -67,6 +67,7 @@ This test retrieves the SPN suffixes configured at the forest level using the `G | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdSpnSuffixesCount](https://github.com/maester365/maester/blob/main/tests/ad/domain/Test.AD-FORS-03.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:crossRef:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-FORS-04.md b/website/docs/tests/ad/AD-FORS-04.md index 3213be112..ff0d56484 100644 --- a/website/docs/tests/ad/AD-FORS-04.md +++ b/website/docs/tests/ad/AD-FORS-04.md @@ -70,6 +70,7 @@ This test retrieves cross-forest reference information from the forest configura | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdCrossForestReferencesCount](https://github.com/maester365/maester/blob/main/tests/ad/domain/Test.AD-FORS-04.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:crossRef:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-GCHG-01.md b/website/docs/tests/ad/AD-GCHG-01.md index 2acd6a1a2..d846cc1e6 100644 --- a/website/docs/tests/ad/AD-GCHG-01.md +++ b/website/docs/tests/ad/AD-GCHG-01.md @@ -78,6 +78,7 @@ The analysis helps identify trends and patterns in group management activity. | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGroupChangeAveragePerYear](https://github.com/maester365/maester/blob/main/tests/ad/group/Test.AD-GCHG-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:group:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-GMC-01.md b/website/docs/tests/ad/AD-GMC-01.md index 448e60277..d1764b222 100644 --- a/website/docs/tests/ad/AD-GMC-01.md +++ b/website/docs/tests/ad/AD-GMC-01.md @@ -72,6 +72,7 @@ For performance reasons, the test analyzes the first 100 groups if there are man | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGroupMemberDistinctGroupCount](https://github.com/maester365/maester/blob/main/tests/ad/group/Test.AD-GMC-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:group:ReadProperty, ActiveDirectory:Ldap:group.member:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-GMC-02.md b/website/docs/tests/ad/AD-GMC-02.md index 3fad8cacf..55422f576 100644 --- a/website/docs/tests/ad/AD-GMC-02.md +++ b/website/docs/tests/ad/AD-GMC-02.md @@ -70,6 +70,7 @@ For performance reasons, the test analyzes members from the first 50 groups and | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGroupMemberAccountTypeCount](https://github.com/maester365/maester/blob/main/tests/ad/group/Test.AD-GMC-02.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:group:ReadProperty, ActiveDirectory:Ldap:group.member:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-GMC-03.md b/website/docs/tests/ad/AD-GMC-03.md index d52780f98..a1d493a62 100644 --- a/website/docs/tests/ad/AD-GMC-03.md +++ b/website/docs/tests/ad/AD-GMC-03.md @@ -71,6 +71,7 @@ For performance reasons, the test analyzes members from the first 50 groups and | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGroupMemberAccountTypeDetails](https://github.com/maester365/maester/blob/main/tests/ad/group/Test.AD-GMC-03.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:group:ReadProperty, ActiveDirectory:Ldap:group.member:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-GMC-04.md b/website/docs/tests/ad/AD-GMC-04.md index b7933a255..bef48138f 100644 --- a/website/docs/tests/ad/AD-GMC-04.md +++ b/website/docs/tests/ad/AD-GMC-04.md @@ -71,6 +71,7 @@ For performance reasons, the test analyzes the first 50 groups. | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGroupMemberTrustCount](https://github.com/maester365/maester/blob/main/tests/ad/group/Test.AD-GMC-04.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:domainDNS:ReadProperty, ActiveDirectory:Ldap:group:ReadProperty, ActiveDirectory:Ldap:group.member:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-GMC-05.md b/website/docs/tests/ad/AD-GMC-05.md index e2fb18f8c..31b987629 100644 --- a/website/docs/tests/ad/AD-GMC-05.md +++ b/website/docs/tests/ad/AD-GMC-05.md @@ -72,6 +72,7 @@ For performance reasons, the test analyzes the first 50 groups and limits displa | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGroupMemberTrustDetails](https://github.com/maester365/maester/blob/main/tests/ad/group/Test.AD-GMC-05.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:domainDNS:ReadProperty, ActiveDirectory:Ldap:group:ReadProperty, ActiveDirectory:Ldap:group.member:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-GMC-06.md b/website/docs/tests/ad/AD-GMC-06.md index 8c00ac2c2..10089211f 100644 --- a/website/docs/tests/ad/AD-GMC-06.md +++ b/website/docs/tests/ad/AD-GMC-06.md @@ -73,6 +73,7 @@ For performance reasons, the test analyzes the first 50 groups. | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGroupMemberForeignSidCount](https://github.com/maester365/maester/blob/main/tests/ad/group/Test.AD-GMC-06.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:domainDNS:ReadProperty, ActiveDirectory:Ldap:group:ReadProperty, ActiveDirectory:Ldap:group.member:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-GMC-07.md b/website/docs/tests/ad/AD-GMC-07.md index 3256ae788..278f37c15 100644 --- a/website/docs/tests/ad/AD-GMC-07.md +++ b/website/docs/tests/ad/AD-GMC-07.md @@ -69,6 +69,7 @@ This test examines all group memberships in Active Directory and identifies secu | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGroupMemberForeignSidDetails](https://github.com/maester365/maester/blob/main/tests/ad/group/Test.AD-GMC-07.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:domainDNS:ReadProperty, ActiveDirectory:Ldap:group:ReadProperty, ActiveDirectory:Ldap:group.member:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-GMC-08.md b/website/docs/tests/ad/AD-GMC-08.md index 12af05300..411243667 100644 --- a/website/docs/tests/ad/AD-GMC-08.md +++ b/website/docs/tests/ad/AD-GMC-08.md @@ -74,6 +74,7 @@ The test categorizes groups by their status (empty privileged, empty non-privile | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGroupEmptyNonPrivilegedCount](https://github.com/maester365/maester/blob/main/tests/ad/group/Test.AD-GMC-08.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:group:ReadProperty, ActiveDirectory:Ldap:group.member:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-GMC-09.md b/website/docs/tests/ad/AD-GMC-09.md index 1b1d3804b..6317cf75a 100644 --- a/website/docs/tests/ad/AD-GMC-09.md +++ b/website/docs/tests/ad/AD-GMC-09.md @@ -80,6 +80,7 @@ It then lists these groups with their: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGroupEmptyNonPrivilegedDetails](https://github.com/maester365/maester/blob/main/tests/ad/group/Test.AD-GMC-09.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:group:ReadProperty, ActiveDirectory:Ldap:group.member:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-GMC-10.md b/website/docs/tests/ad/AD-GMC-10.md index 8bca2211b..8d3e15b70 100644 --- a/website/docs/tests/ad/AD-GMC-10.md +++ b/website/docs/tests/ad/AD-GMC-10.md @@ -84,6 +84,7 @@ This test identifies privileged groups (those with adminCount = 1 or well-known | MITRE ATT&CK | T1098.007 Additional Local or Domain Groups, T1078.002 Domain Accounts | | PowerShell test | [Test-MtAdGroupPrivilegedWithMembersCount](https://github.com/maester365/maester/blob/main/tests/ad/group/Test.AD-GMC-10.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:group:ReadProperty, ActiveDirectory:Ldap:group.member:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-GMC-11.md b/website/docs/tests/ad/AD-GMC-11.md index 33eb943b5..9a261359a 100644 --- a/website/docs/tests/ad/AD-GMC-11.md +++ b/website/docs/tests/ad/AD-GMC-11.md @@ -85,6 +85,7 @@ This test lists all privileged groups (those with adminCount = 1 or well-known R | MITRE ATT&CK | T1098.007 Additional Local or Domain Groups, T1078.002 Domain Accounts | | PowerShell test | [Test-MtAdGroupPrivilegedWithMembersDetails](https://github.com/maester365/maester/blob/main/tests/ad/group/Test.AD-GMC-11.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:group:ReadProperty, ActiveDirectory:Ldap:group.member:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-GPO-01.md b/website/docs/tests/ad/AD-GPO-01.md index 22519aa37..9a410b17f 100644 --- a/website/docs/tests/ad/AD-GPO-01.md +++ b/website/docs/tests/ad/AD-GPO-01.md @@ -69,6 +69,7 @@ This test retrieves all Group Policy Objects from Active Directory and counts th | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoTotalCount](https://github.com/maester365/maester/blob/main/tests/ad/gpo/Test.AD-GPO-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPO-02.md b/website/docs/tests/ad/AD-GPO-02.md index 3ee1f1872..139cc442a 100644 --- a/website/docs/tests/ad/AD-GPO-02.md +++ b/website/docs/tests/ad/AD-GPO-02.md @@ -65,6 +65,7 @@ It then filters all GPOs where the `CreationTime` is earlier than **January 1st, | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoCreatedBefore2020Count](https://github.com/maester365/maester/blob/main/tests/ad/gpo/Test.AD-GPO-02.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPO-03.md b/website/docs/tests/ad/AD-GPO-03.md index 116451563..490edb47c 100644 --- a/website/docs/tests/ad/AD-GPO-03.md +++ b/website/docs/tests/ad/AD-GPO-03.md @@ -67,6 +67,7 @@ It filters GPOs where `ModificationTime` is earlier than `2020-01-01` and calcul | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoChangedBefore2020Count](https://github.com/maester365/maester/blob/main/tests/ad/gpo/Test.AD-GPO-03.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPO-04.md b/website/docs/tests/ad/AD-GPO-04.md index 93ac7afc0..1cc2f8c09 100644 --- a/website/docs/tests/ad/AD-GPO-04.md +++ b/website/docs/tests/ad/AD-GPO-04.md @@ -74,6 +74,7 @@ This test retrieves Active Directory Group Policy state data using `Get-MtADGpoS | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoUnlinkedCount](https://github.com/maester365/maester/blob/main/tests/ad/gpo/Test.AD-GPO-04.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPO-05.md b/website/docs/tests/ad/AD-GPO-05.md index 85feec8af..3d9a723bd 100644 --- a/website/docs/tests/ad/AD-GPO-05.md +++ b/website/docs/tests/ad/AD-GPO-05.md @@ -77,6 +77,7 @@ The table is intended to support quick review during GPO cleanup and maintenance | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoUnlinkedDetails](https://github.com/maester365/maester/blob/main/tests/ad/gpo/Test.AD-GPO-05.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOL-01.md b/website/docs/tests/ad/AD-GPOL-01.md index 7294df6c9..6f80d664f 100644 --- a/website/docs/tests/ad/AD-GPOL-01.md +++ b/website/docs/tests/ad/AD-GPOL-01.md @@ -74,6 +74,7 @@ It then: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoLinkedCount](https://github.com/maester365/maester/blob/main/tests/ad/gpo/Test.AD-GPOL-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOL-02.md b/website/docs/tests/ad/AD-GPOL-02.md index c2bcf40ac..88e710e90 100644 --- a/website/docs/tests/ad/AD-GPOL-02.md +++ b/website/docs/tests/ad/AD-GPOL-02.md @@ -71,6 +71,7 @@ The gPLink attribute is parsed to determine the state of each link. | MITRE ATT&CK | None | | PowerShell test | [Test-MtCheckADGPOL02](https://github.com/maester365/maester/blob/main/tests/ad/gpo/Test.AD-GPOL-02.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOL-03.md b/website/docs/tests/ad/AD-GPOL-03.md index 2a3f833e6..e3af89d1a 100644 --- a/website/docs/tests/ad/AD-GPOL-03.md +++ b/website/docs/tests/ad/AD-GPOL-03.md @@ -76,6 +76,7 @@ This test uses `Get-MtADGpoState` (and its cached `GPOLinks`/AD data) and: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoUnlinkedTargetCount](https://github.com/maester365/maester/blob/main/tests/ad/gpo/Test.AD-GPOL-03.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOL-04.md b/website/docs/tests/ad/AD-GPOL-04.md index 206add7d1..f9089dc9d 100644 --- a/website/docs/tests/ad/AD-GPOL-04.md +++ b/website/docs/tests/ad/AD-GPOL-04.md @@ -68,6 +68,7 @@ This test retrieves Active Directory GPO state from `Get-MtADGpoState` (using `$ | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoEnforcedCount](https://github.com/maester365/maester/blob/main/tests/ad/gpo/Test.AD-GPOL-04.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOL-05.md b/website/docs/tests/ad/AD-GPOL-05.md index a158ed788..532f14586 100644 --- a/website/docs/tests/ad/AD-GPOL-05.md +++ b/website/docs/tests/ad/AD-GPOL-05.md @@ -74,6 +74,7 @@ This test retrieves Organizational Units (OUs) from Active Directory using: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoBlockedInheritanceCount](https://github.com/maester365/maester/blob/main/tests/ad/gpo/Test.AD-GPOL-05.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOL-06.md b/website/docs/tests/ad/AD-GPOL-06.md index c6bc8dee9..c7712e22a 100644 --- a/website/docs/tests/ad/AD-GPOL-06.md +++ b/website/docs/tests/ad/AD-GPOL-06.md @@ -74,6 +74,7 @@ The gPLink attribute is checked to determine if any GPOs are linked to each OU. | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoLinkedOUCount](https://github.com/maester365/maester/blob/main/tests/ad/gpo/Test.AD-GPOL-06.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOREP-01.md b/website/docs/tests/ad/AD-GPOREP-01.md index c7bdc0b63..a8b505a86 100644 --- a/website/docs/tests/ad/AD-GPOREP-01.md +++ b/website/docs/tests/ad/AD-GPOREP-01.md @@ -66,6 +66,7 @@ keywords: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoNoPermissionsCount](https://github.com/maester365/maester/blob/main/tests/ad/gpo-state/Test.AD-GPOREP-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOREP-02.md b/website/docs/tests/ad/AD-GPOREP-02.md index b49871b25..d551e6e12 100644 --- a/website/docs/tests/ad/AD-GPOREP-02.md +++ b/website/docs/tests/ad/AD-GPOREP-02.md @@ -66,6 +66,7 @@ keywords: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoNoPermissionsDetails](https://github.com/maester365/maester/blob/main/tests/ad/gpo-state/Test.AD-GPOREP-02.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOREP-03.md b/website/docs/tests/ad/AD-GPOREP-03.md index 0a09f6fee..47cf45948 100644 --- a/website/docs/tests/ad/AD-GPOREP-03.md +++ b/website/docs/tests/ad/AD-GPOREP-03.md @@ -66,6 +66,7 @@ keywords: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoNoAuthenticatedUsersCount](https://github.com/maester365/maester/blob/main/tests/ad/gpo-state/Test.AD-GPOREP-03.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOREP-04.md b/website/docs/tests/ad/AD-GPOREP-04.md index 298f73ab6..93ff2210f 100644 --- a/website/docs/tests/ad/AD-GPOREP-04.md +++ b/website/docs/tests/ad/AD-GPOREP-04.md @@ -66,6 +66,7 @@ keywords: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoNoAuthenticatedUsersDetails](https://github.com/maester365/maester/blob/main/tests/ad/gpo-state/Test.AD-GPOREP-04.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOREP-05.md b/website/docs/tests/ad/AD-GPOREP-05.md index 6993a3522..9f2d78a15 100644 --- a/website/docs/tests/ad/AD-GPOREP-05.md +++ b/website/docs/tests/ad/AD-GPOREP-05.md @@ -66,6 +66,7 @@ keywords: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoNoEnterpriseDcCount](https://github.com/maester365/maester/blob/main/tests/ad/gpo-state/Test.AD-GPOREP-05.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOREP-06.md b/website/docs/tests/ad/AD-GPOREP-06.md index 6576af18b..ef2d7bbe0 100644 --- a/website/docs/tests/ad/AD-GPOREP-06.md +++ b/website/docs/tests/ad/AD-GPOREP-06.md @@ -67,6 +67,7 @@ keywords: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoNoDomainComputersCount](https://github.com/maester365/maester/blob/main/tests/ad/gpo-state/Test.AD-GPOREP-06.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOREP-07.md b/website/docs/tests/ad/AD-GPOREP-07.md index 2104c808a..6773d342e 100644 --- a/website/docs/tests/ad/AD-GPOREP-07.md +++ b/website/docs/tests/ad/AD-GPOREP-07.md @@ -65,6 +65,7 @@ keywords: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoDenyAceCount](https://github.com/maester365/maester/blob/main/tests/ad/gpo-state/Test.AD-GPOREP-07.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOREP-08.md b/website/docs/tests/ad/AD-GPOREP-08.md index 919e34dbb..cd2f119e4 100644 --- a/website/docs/tests/ad/AD-GPOREP-08.md +++ b/website/docs/tests/ad/AD-GPOREP-08.md @@ -65,6 +65,7 @@ keywords: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoDenyAceDetails](https://github.com/maester365/maester/blob/main/tests/ad/gpo-state/Test.AD-GPOREP-08.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOREP-09.md b/website/docs/tests/ad/AD-GPOREP-09.md index 9a791fb10..dd69c8fc3 100644 --- a/website/docs/tests/ad/AD-GPOREP-09.md +++ b/website/docs/tests/ad/AD-GPOREP-09.md @@ -66,6 +66,7 @@ keywords: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoInheritedPermissionsCount](https://github.com/maester365/maester/blob/main/tests/ad/gpo-state/Test.AD-GPOREP-09.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOREP-10.md b/website/docs/tests/ad/AD-GPOREP-10.md index 73fd2893e..8a3051481 100644 --- a/website/docs/tests/ad/AD-GPOREP-10.md +++ b/website/docs/tests/ad/AD-GPOREP-10.md @@ -63,6 +63,7 @@ keywords: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoNoApplyGroupPolicyAceCount](https://github.com/maester365/maester/blob/main/tests/ad/gpo-state/Test.AD-GPOREP-10.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOREP-11.md b/website/docs/tests/ad/AD-GPOREP-11.md index 7ff7ab509..19a070306 100644 --- a/website/docs/tests/ad/AD-GPOREP-11.md +++ b/website/docs/tests/ad/AD-GPOREP-11.md @@ -63,6 +63,7 @@ keywords: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoNoApplyGroupPolicyAceDetails](https://github.com/maester365/maester/blob/main/tests/ad/gpo-state/Test.AD-GPOREP-11.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOREP-12.md b/website/docs/tests/ad/AD-GPOREP-12.md index 016117305..374e04beb 100644 --- a/website/docs/tests/ad/AD-GPOREP-12.md +++ b/website/docs/tests/ad/AD-GPOREP-12.md @@ -71,6 +71,7 @@ The gPLink attribute is parsed to determine the state of each link. | MITRE ATT&CK | None | | PowerShell test | [Test-MtCheckADGPOREP12](https://github.com/maester365/maester/blob/main/tests/ad/gpo-state/Test.AD-GPOREP-12.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOREP-13.md b/website/docs/tests/ad/AD-GPOREP-13.md index c101c1d4c..f54a567e0 100644 --- a/website/docs/tests/ad/AD-GPOREP-13.md +++ b/website/docs/tests/ad/AD-GPOREP-13.md @@ -64,6 +64,7 @@ keywords: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoDisabledLinkDetails](https://github.com/maester365/maester/blob/main/tests/ad/gpo-state/Test.AD-GPOREP-13.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOREP-14.md b/website/docs/tests/ad/AD-GPOREP-14.md index f0752d35f..3d9997246 100644 --- a/website/docs/tests/ad/AD-GPOREP-14.md +++ b/website/docs/tests/ad/AD-GPOREP-14.md @@ -63,6 +63,7 @@ keywords: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoEnforcementCount](https://github.com/maester365/maester/blob/main/tests/ad/gpo-state/Test.AD-GPOREP-14.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOREP-15.md b/website/docs/tests/ad/AD-GPOREP-15.md index 2690d88f5..3d87ae478 100644 --- a/website/docs/tests/ad/AD-GPOREP-15.md +++ b/website/docs/tests/ad/AD-GPOREP-15.md @@ -65,6 +65,7 @@ keywords: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoVersionMismatchCount](https://github.com/maester365/maester/blob/main/tests/ad/gpo-state/Test.AD-GPOREP-15.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOREP-16.md b/website/docs/tests/ad/AD-GPOREP-16.md index 163590b5f..912021e56 100644 --- a/website/docs/tests/ad/AD-GPOREP-16.md +++ b/website/docs/tests/ad/AD-GPOREP-16.md @@ -65,6 +65,7 @@ keywords: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoVersionMismatchDetails](https://github.com/maester365/maester/blob/main/tests/ad/gpo-state/Test.AD-GPOREP-16.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOREP-17.md b/website/docs/tests/ad/AD-GPOREP-17.md index ca82badaf..715a0386b 100644 --- a/website/docs/tests/ad/AD-GPOREP-17.md +++ b/website/docs/tests/ad/AD-GPOREP-17.md @@ -66,6 +66,7 @@ keywords: | Supports controls | nist-800-53-r5:IA-5(1), nist-800-53-r5:SC-28 | | PowerShell test | [Test-MtAdGpoCpasswordFoundCount](https://github.com/maester365/maester/blob/main/tests/ad/gpo-state/Test.AD-GPOREP-17.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOREP-18.md b/website/docs/tests/ad/AD-GPOREP-18.md index 64006410f..6696bc176 100644 --- a/website/docs/tests/ad/AD-GPOREP-18.md +++ b/website/docs/tests/ad/AD-GPOREP-18.md @@ -67,6 +67,7 @@ keywords: | Supports controls | nist-800-53-r5:IA-5(1), nist-800-53-r5:SC-28 | | PowerShell test | [Test-MtAdGpoCpasswordFoundDetails](https://github.com/maester365/maester/blob/main/tests/ad/gpo-state/Test.AD-GPOREP-18.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOREP-19.md b/website/docs/tests/ad/AD-GPOREP-19.md index 2b73748e5..9d943221e 100644 --- a/website/docs/tests/ad/AD-GPOREP-19.md +++ b/website/docs/tests/ad/AD-GPOREP-19.md @@ -66,6 +66,7 @@ keywords: | Supports controls | nist-800-53-r5:IA-5(1), nist-800-53-r5:SC-28 | | PowerShell test | [Test-MtAdGpoDefaultPasswordFoundCount](https://github.com/maester365/maester/blob/main/tests/ad/gpo-state/Test.AD-GPOREP-19.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOREP-20.md b/website/docs/tests/ad/AD-GPOREP-20.md index 309a27da9..6c3fb105f 100644 --- a/website/docs/tests/ad/AD-GPOREP-20.md +++ b/website/docs/tests/ad/AD-GPOREP-20.md @@ -68,6 +68,7 @@ keywords: | Supports controls | nist-800-53-r5:IA-5(1), nist-800-53-r5:SC-28 | | PowerShell test | [Test-MtAdGpoDefaultPasswordFoundDetails](https://github.com/maester365/maester/blob/main/tests/ad/gpo-state/Test.AD-GPOREP-20.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOS-01.md b/website/docs/tests/ad/AD-GPOS-01.md index 2651eb6d6..7a9077d2a 100644 --- a/website/docs/tests/ad/AD-GPOS-01.md +++ b/website/docs/tests/ad/AD-GPOS-01.md @@ -63,6 +63,7 @@ keywords: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoStateTotalCount](https://github.com/maester365/maester/blob/main/tests/ad/gpo-state/Test.AD-GPOS-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOS-02.md b/website/docs/tests/ad/AD-GPOS-02.md index 3921a516d..81e393845 100644 --- a/website/docs/tests/ad/AD-GPOS-02.md +++ b/website/docs/tests/ad/AD-GPOS-02.md @@ -63,6 +63,7 @@ keywords: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoWmiFilterCount](https://github.com/maester365/maester/blob/main/tests/ad/gpo-state/Test.AD-GPOS-02.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOS-03.md b/website/docs/tests/ad/AD-GPOS-03.md index a92e0fd46..c47f8b53b 100644 --- a/website/docs/tests/ad/AD-GPOS-03.md +++ b/website/docs/tests/ad/AD-GPOS-03.md @@ -63,6 +63,7 @@ keywords: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoWmiFilterDetails](https://github.com/maester365/maester/blob/main/tests/ad/gpo-state/Test.AD-GPOS-03.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOS-04.md b/website/docs/tests/ad/AD-GPOS-04.md index d7d31e77a..809bf84c0 100644 --- a/website/docs/tests/ad/AD-GPOS-04.md +++ b/website/docs/tests/ad/AD-GPOS-04.md @@ -63,6 +63,7 @@ keywords: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoSettingsDisabledCount](https://github.com/maester365/maester/blob/main/tests/ad/gpo-state/Test.AD-GPOS-04.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOS-05.md b/website/docs/tests/ad/AD-GPOS-05.md index 9048720b1..4812ca0c0 100644 --- a/website/docs/tests/ad/AD-GPOS-05.md +++ b/website/docs/tests/ad/AD-GPOS-05.md @@ -63,6 +63,7 @@ keywords: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoComputerSettingsDisabledDetails](https://github.com/maester365/maester/blob/main/tests/ad/gpo-state/Test.AD-GPOS-05.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOS-06.md b/website/docs/tests/ad/AD-GPOS-06.md index 0b9f6539a..0af29184c 100644 --- a/website/docs/tests/ad/AD-GPOS-06.md +++ b/website/docs/tests/ad/AD-GPOS-06.md @@ -63,6 +63,7 @@ keywords: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoUserSettingsDisabledDetails](https://github.com/maester365/maester/blob/main/tests/ad/gpo-state/Test.AD-GPOS-06.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOS-07.md b/website/docs/tests/ad/AD-GPOS-07.md index 0938f6ed0..70bf32c95 100644 --- a/website/docs/tests/ad/AD-GPOS-07.md +++ b/website/docs/tests/ad/AD-GPOS-07.md @@ -63,6 +63,7 @@ keywords: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoAllSettingsDisabledDetails](https://github.com/maester365/maester/blob/main/tests/ad/gpo-state/Test.AD-GPOS-07.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOS-08.md b/website/docs/tests/ad/AD-GPOS-08.md index 533198537..ef07104c0 100644 --- a/website/docs/tests/ad/AD-GPOS-08.md +++ b/website/docs/tests/ad/AD-GPOS-08.md @@ -63,6 +63,7 @@ keywords: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoOwnerDistinctCount](https://github.com/maester365/maester/blob/main/tests/ad/gpo-state/Test.AD-GPOS-08.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GPOS-09.md b/website/docs/tests/ad/AD-GPOS-09.md index 17d4a3808..e23b89080 100644 --- a/website/docs/tests/ad/AD-GPOS-09.md +++ b/website/docs/tests/ad/AD-GPOS-09.md @@ -63,6 +63,7 @@ keywords: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGpoOwnerDetails](https://github.com/maester365/maester/blob/main/tests/ad/gpo-state/Test.AD-GPOS-09.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read | ## Source diff --git a/website/docs/tests/ad/AD-GRP-01.md b/website/docs/tests/ad/AD-GRP-01.md index 180523cee..d4144f064 100644 --- a/website/docs/tests/ad/AD-GRP-01.md +++ b/website/docs/tests/ad/AD-GRP-01.md @@ -70,6 +70,7 @@ This test retrieves all group objects from Active Directory and counts: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGroupAdminCount](https://github.com/maester365/maester/blob/main/tests/ad/group/Test.AD-GRP-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:group:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-GRP-02.md b/website/docs/tests/ad/AD-GRP-02.md index e9b0382b1..55562c52a 100644 --- a/website/docs/tests/ad/AD-GRP-02.md +++ b/website/docs/tests/ad/AD-GRP-02.md @@ -73,6 +73,7 @@ keywords: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGroupInContainerCount](https://github.com/maester365/maester/blob/main/tests/ad/group/Test.AD-GRP-02.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:group:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-GRP-03.md b/website/docs/tests/ad/AD-GRP-03.md index 4d306f3b3..b4f9b87e9 100644 --- a/website/docs/tests/ad/AD-GRP-03.md +++ b/website/docs/tests/ad/AD-GRP-03.md @@ -76,6 +76,7 @@ This test retrieves all group objects from Active Directory and: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGroupStaleCount](https://github.com/maester365/maester/blob/main/tests/ad/group/Test.AD-GRP-03.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:group:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-GRP-04.md b/website/docs/tests/ad/AD-GRP-04.md index a1410c91f..d2eb842a2 100644 --- a/website/docs/tests/ad/AD-GRP-04.md +++ b/website/docs/tests/ad/AD-GRP-04.md @@ -73,6 +73,7 @@ This test retrieves all group objects from Active Directory and: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGroupWithManagerCount](https://github.com/maester365/maester/blob/main/tests/ad/group/Test.AD-GRP-04.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:group:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-GRP-05.md b/website/docs/tests/ad/AD-GRP-05.md index e77b04a14..5d3ad4250 100644 --- a/website/docs/tests/ad/AD-GRP-05.md +++ b/website/docs/tests/ad/AD-GRP-05.md @@ -77,6 +77,7 @@ keywords: | MITRE ATT&CK | T1134.005 SID-History Injection | | PowerShell test | [Test-MtAdGroupSidHistoryCount](https://github.com/maester365/maester/blob/main/tests/ad/group/Test.AD-GRP-05.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:group:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-GRP-06.md b/website/docs/tests/ad/AD-GRP-06.md index b49b7730d..69a1c1d1f 100644 --- a/website/docs/tests/ad/AD-GRP-06.md +++ b/website/docs/tests/ad/AD-GRP-06.md @@ -75,6 +75,7 @@ The test provides counts and percentages to understand the distribution of group | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGroupDistributionCount](https://github.com/maester365/maester/blob/main/tests/ad/group/Test.AD-GRP-06.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:group:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-GRP-07.md b/website/docs/tests/ad/AD-GRP-07.md index 3b480fb72..5f9912828 100644 --- a/website/docs/tests/ad/AD-GRP-07.md +++ b/website/docs/tests/ad/AD-GRP-07.md @@ -76,6 +76,7 @@ The test provides counts and percentages to understand the proportion of securit | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGroupSecurityCount](https://github.com/maester365/maester/blob/main/tests/ad/group/Test.AD-GRP-07.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:group:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-GRP-08.md b/website/docs/tests/ad/AD-GRP-08.md index b56be478a..494d06098 100644 --- a/website/docs/tests/ad/AD-GRP-08.md +++ b/website/docs/tests/ad/AD-GRP-08.md @@ -76,6 +76,7 @@ The test provides counts and percentages to understand the distribution of group | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGroupDomainLocalCount](https://github.com/maester365/maester/blob/main/tests/ad/group/Test.AD-GRP-08.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:group:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-GRP-09.md b/website/docs/tests/ad/AD-GRP-09.md index 714b04b4c..71c716ef4 100644 --- a/website/docs/tests/ad/AD-GRP-09.md +++ b/website/docs/tests/ad/AD-GRP-09.md @@ -77,6 +77,7 @@ The test provides counts and percentages to understand the distribution of group | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGroupGlobalCount](https://github.com/maester365/maester/blob/main/tests/ad/group/Test.AD-GRP-09.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:group:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-GRP-10.md b/website/docs/tests/ad/AD-GRP-10.md index 3e6d2bcb7..473ca2589 100644 --- a/website/docs/tests/ad/AD-GRP-10.md +++ b/website/docs/tests/ad/AD-GRP-10.md @@ -79,6 +79,7 @@ The test provides counts and percentages to understand the distribution of group | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdGroupUniversalCount](https://github.com/maester365/maester/blob/main/tests/ad/group/Test.AD-GRP-10.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:group:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-KRBTGT-01.md b/website/docs/tests/ad/AD-KRBTGT-01.md index 3116e2c61..0ec235199 100644 --- a/website/docs/tests/ad/AD-KRBTGT-01.md +++ b/website/docs/tests/ad/AD-KRBTGT-01.md @@ -87,6 +87,7 @@ This test retrieves the KRBTGT account from Active Directory and checks: | Supports controls | nist-800-53-r5:IA-5 | | PowerShell test | [Test-MtAdKrbtgtPasswordLastSet](https://github.com/maester365/maester/blob/main/tests/ad/security/Test.AD-KRBTGT-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-KRBTGT-02.md b/website/docs/tests/ad/AD-KRBTGT-02.md index abaf3e6ee..cf531935d 100644 --- a/website/docs/tests/ad/AD-KRBTGT-02.md +++ b/website/docs/tests/ad/AD-KRBTGT-02.md @@ -81,6 +81,7 @@ This test retrieves the KRBTGT account and checks: | MITRE ATT&CK | T1078.001 Default Accounts | | PowerShell test | [Test-MtAdKrbtgtLastLogon](https://github.com/maester365/maester/blob/main/tests/ad/security/Test.AD-KRBTGT-02.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-KRBTGT-03.md b/website/docs/tests/ad/AD-KRBTGT-03.md index 374a5ebda..989cbf657 100644 --- a/website/docs/tests/ad/AD-KRBTGT-03.md +++ b/website/docs/tests/ad/AD-KRBTGT-03.md @@ -86,6 +86,7 @@ This test retrieves the KRBTGT account and: | Supports controls | nist-800-53-r5:CM-6 | | PowerShell test | [Test-MtAdKrbtgtNonStandardUacCount](https://github.com/maester365/maester/blob/main/tests/ad/security/Test.AD-KRBTGT-03.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-MSA-01.md b/website/docs/tests/ad/AD-MSA-01.md index 8cf775f4d..a9a61a974 100644 --- a/website/docs/tests/ad/AD-MSA-01.md +++ b/website/docs/tests/ad/AD-MSA-01.md @@ -92,6 +92,7 @@ This test counts managed service accounts in Active Directory and categorizes th | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdManagedServiceAccountCount](https://github.com/maester365/maester/blob/main/tests/ad/security/Test.AD-MSA-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:msDS-GroupManagedServiceAccount:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-OU-01.md b/website/docs/tests/ad/AD-OU-01.md index 52291a276..50dd5f30e 100644 --- a/website/docs/tests/ad/AD-OU-01.md +++ b/website/docs/tests/ad/AD-OU-01.md @@ -68,6 +68,7 @@ keywords: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdOuOverlappingNameCount](https://github.com/maester365/maester/blob/main/tests/ad/ou/Test.AD-OU-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:organizationalUnit:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-OU-02.md b/website/docs/tests/ad/AD-OU-02.md index 67c7e6c2b..26521b720 100644 --- a/website/docs/tests/ad/AD-OU-02.md +++ b/website/docs/tests/ad/AD-OU-02.md @@ -70,6 +70,7 @@ keywords: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdOuAtDomainRootCount](https://github.com/maester365/maester/blob/main/tests/ad/ou/Test.AD-OU-02.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:domainDNS.distinguishedName:ReadProperty, ActiveDirectory:Ldap:organizationalUnit:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-OU-03.md b/website/docs/tests/ad/AD-OU-03.md index 4b75d99d9..48e90a378 100644 --- a/website/docs/tests/ad/AD-OU-03.md +++ b/website/docs/tests/ad/AD-OU-03.md @@ -70,6 +70,7 @@ keywords: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdOuStaleCount](https://github.com/maester365/maester/blob/main/tests/ad/ou/Test.AD-OU-03.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:organizationalUnit:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-OU-04.md b/website/docs/tests/ad/AD-OU-04.md index a844dd951..36b1b6954 100644 --- a/website/docs/tests/ad/AD-OU-04.md +++ b/website/docs/tests/ad/AD-OU-04.md @@ -76,6 +76,7 @@ keywords: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdOuEmptyCount](https://github.com/maester365/maester/blob/main/tests/ad/ou/Test.AD-OU-04.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:computer:ReadProperty, ActiveDirectory:Ldap:group:ReadProperty, ActiveDirectory:Ldap:organizationalUnit:ReadProperty, ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-OU-05.md b/website/docs/tests/ad/AD-OU-05.md index a28d5ff41..79f0f9832 100644 --- a/website/docs/tests/ad/AD-OU-05.md +++ b/website/docs/tests/ad/AD-OU-05.md @@ -77,6 +77,7 @@ This test retrieves all Organizational Units from Active Directory and: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdOuEmptyDetails](https://github.com/maester365/maester/blob/main/tests/ad/ou/Test.AD-OU-05.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:computer:ReadProperty, ActiveDirectory:Ldap:group:ReadProperty, ActiveDirectory:Ldap:organizationalUnit:ReadProperty, ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-PRINT-01.md b/website/docs/tests/ad/AD-PRINT-01.md index 5784dea7e..dcfa1f34b 100644 --- a/website/docs/tests/ad/AD-PRINT-01.md +++ b/website/docs/tests/ad/AD-PRINT-01.md @@ -75,6 +75,7 @@ This test queries Active Directory for printQueue objects to count published pri | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdPrinterTotalCount](https://github.com/maester365/maester/blob/main/tests/ad/printer/Test.AD-PRINT-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:printQueue:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-PWDPOL-01.md b/website/docs/tests/ad/AD-PWDPOL-01.md index 3c449b84c..1b70c257d 100644 --- a/website/docs/tests/ad/AD-PWDPOL-01.md +++ b/website/docs/tests/ad/AD-PWDPOL-01.md @@ -75,6 +75,7 @@ This test retrieves the default domain password policy using `Get-ADDefaultDomai | MITRE ATT&CK | T1110.004 Credential Stuffing | | PowerShell test | [Test-MtAdPasswordHistoryCount](https://github.com/maester365/maester/blob/main/tests/ad/password-policy/Test.AD-PWDPOL-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:domainDNS.pwdHistoryLength:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-PWDPOL-02.md b/website/docs/tests/ad/AD-PWDPOL-02.md index 43b6b45ff..76b0bb6ce 100644 --- a/website/docs/tests/ad/AD-PWDPOL-02.md +++ b/website/docs/tests/ad/AD-PWDPOL-02.md @@ -75,6 +75,7 @@ This test retrieves the default domain password policy using `Get-ADDefaultDomai | MITRE ATT&CK | T1110.002 Password Cracking, T1078.002 Domain Accounts | | PowerShell test | [Test-MtAdPasswordMaxAge](https://github.com/maester365/maester/blob/main/tests/ad/password-policy/Test.AD-PWDPOL-02.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:domainDNS.maxPwdAge:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-PWDPOL-03.md b/website/docs/tests/ad/AD-PWDPOL-03.md index 2bc9351c6..ebb37abdb 100644 --- a/website/docs/tests/ad/AD-PWDPOL-03.md +++ b/website/docs/tests/ad/AD-PWDPOL-03.md @@ -78,6 +78,7 @@ This test retrieves the default domain password policy using `Get-ADDefaultDomai | MITRE ATT&CK | T1110 Brute Force | | PowerShell test | [Test-MtAdPasswordMinLength](https://github.com/maester365/maester/blob/main/tests/ad/password-policy/Test.AD-PWDPOL-03.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:domainDNS.minPwdLength:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-PWDPOL-04.md b/website/docs/tests/ad/AD-PWDPOL-04.md index 7601714ff..80270cb2c 100644 --- a/website/docs/tests/ad/AD-PWDPOL-04.md +++ b/website/docs/tests/ad/AD-PWDPOL-04.md @@ -80,6 +80,7 @@ This test retrieves the default domain password policy using `Get-ADDefaultDomai | MITRE ATT&CK | T1110 Brute Force | | PowerShell test | [Test-MtAdPasswordComplexityRequired](https://github.com/maester365/maester/blob/main/tests/ad/password-policy/Test.AD-PWDPOL-04.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:domainDNS.pwdProperties:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-PWDPOL-05.md b/website/docs/tests/ad/AD-PWDPOL-05.md index ec5de74a7..fb8a32a2d 100644 --- a/website/docs/tests/ad/AD-PWDPOL-05.md +++ b/website/docs/tests/ad/AD-PWDPOL-05.md @@ -81,6 +81,7 @@ This test retrieves the default domain password policy using `Get-ADDefaultDomai | MITRE ATT&CK | T1556.005 Reversible Encryption | | PowerShell test | [Test-MtAdPasswordReversibleEncryption](https://github.com/maester365/maester/blob/main/tests/ad/password-policy/Test.AD-PWDPOL-05.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:domainDNS.pwdProperties:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-PWDPOL-06.md b/website/docs/tests/ad/AD-PWDPOL-06.md index 6e53a8366..14a16f86e 100644 --- a/website/docs/tests/ad/AD-PWDPOL-06.md +++ b/website/docs/tests/ad/AD-PWDPOL-06.md @@ -72,6 +72,7 @@ This test retrieves the default domain password policy using `Get-ADDefaultDomai | MITRE ATT&CK | T1110 Brute Force | | PowerShell test | [Test-MtAdAccountLockoutDuration](https://github.com/maester365/maester/blob/main/tests/ad/password-policy/Test.AD-PWDPOL-06.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:domainDNS.lockoutDuration:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-PWDPOL-07.md b/website/docs/tests/ad/AD-PWDPOL-07.md index 3052bd3f8..b3717e3a8 100644 --- a/website/docs/tests/ad/AD-PWDPOL-07.md +++ b/website/docs/tests/ad/AD-PWDPOL-07.md @@ -75,6 +75,7 @@ To configure this setting: | MITRE ATT&CK | T1110 Brute Force | | PowerShell test | [Test-MtAdAccountLockoutThreshold](https://github.com/maester365/maester/blob/main/tests/ad/password-policy/Test.AD-PWDPOL-07.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:domainDNS.lockoutThreshold:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-REPL-01.md b/website/docs/tests/ad/AD-REPL-01.md index c1e491699..82e2a4a86 100644 --- a/website/docs/tests/ad/AD-REPL-01.md +++ b/website/docs/tests/ad/AD-REPL-01.md @@ -74,6 +74,7 @@ This test retrieves all Active Directory replication connections and counts: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdDisabledReplicationConnectionCount](https://github.com/maester365/maester/blob/main/tests/ad/replication/Test.AD-REPL-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:nTDSConnection:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-REPL-02.md b/website/docs/tests/ad/AD-REPL-02.md index 0959a5385..8e6cf78fd 100644 --- a/website/docs/tests/ad/AD-REPL-02.md +++ b/website/docs/tests/ad/AD-REPL-02.md @@ -69,6 +69,7 @@ This test retrieves all Active Directory replication connections and identifies: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdNonAutoReplicationConnectionCount](https://github.com/maester365/maester/blob/main/tests/ad/replication/Test.AD-REPL-02.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:nTDSConnection:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-ROOTDSE-01.md b/website/docs/tests/ad/AD-ROOTDSE-01.md index f78112c7e..e927d1766 100644 --- a/website/docs/tests/ad/AD-ROOTDSE-01.md +++ b/website/docs/tests/ad/AD-ROOTDSE-01.md @@ -69,6 +69,7 @@ This test retrieves the Root DSE and counts: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdSupportedSaslMechanismCount](https://github.com/maester365/maester/blob/main/tests/ad/replication/Test.AD-ROOTDSE-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:domainDNS:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-ROOTDSE-02.md b/website/docs/tests/ad/AD-ROOTDSE-02.md index 98e1a8d4c..5b9db74d2 100644 --- a/website/docs/tests/ad/AD-ROOTDSE-02.md +++ b/website/docs/tests/ad/AD-ROOTDSE-02.md @@ -75,6 +75,7 @@ This test retrieves detailed information about each supported SASL mechanism: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdSupportedSaslMechanismDetails](https://github.com/maester365/maester/blob/main/tests/ad/replication/Test.AD-ROOTDSE-02.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:domainDNS:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-ROOTDSE-03.md b/website/docs/tests/ad/AD-ROOTDSE-03.md index ef11b0dc6..bc499c526 100644 --- a/website/docs/tests/ad/AD-ROOTDSE-03.md +++ b/website/docs/tests/ad/AD-ROOTDSE-03.md @@ -74,6 +74,7 @@ This test checks the Root DSE isSynchronized attribute and reports: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdRootDseSynchronizedStatus](https://github.com/maester365/maester/blob/main/tests/ad/replication/Test.AD-ROOTDSE-03.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:domainDNS:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SCH-01.md b/website/docs/tests/ad/AD-SCH-01.md index 0feab08a0..e91fb20c5 100644 --- a/website/docs/tests/ad/AD-SCH-01.md +++ b/website/docs/tests/ad/AD-SCH-01.md @@ -76,6 +76,7 @@ This test retrieves all schema objects and analyzes their creation dates to iden | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdSchemaModificationYearCount](https://github.com/maester365/maester/blob/main/tests/ad/schema/Test.AD-SCH-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:Schema/*:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SCH-02.md b/website/docs/tests/ad/AD-SCH-02.md index def9dae5d..4aecd101f 100644 --- a/website/docs/tests/ad/AD-SCH-02.md +++ b/website/docs/tests/ad/AD-SCH-02.md @@ -77,6 +77,7 @@ This test analyzes schema objects and groups them by creation year, providing: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdSchemaModificationYearDetails](https://github.com/maester365/maester/blob/main/tests/ad/schema/Test.AD-SCH-02.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:Schema/*:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SCH-03.md b/website/docs/tests/ad/AD-SCH-03.md index fb2d2976a..4a30eca44 100644 --- a/website/docs/tests/ad/AD-SCH-03.md +++ b/website/docs/tests/ad/AD-SCH-03.md @@ -79,6 +79,7 @@ This test retrieves the objectVersion attribute from the schema container to det | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdSchemaVersionEntryCount](https://github.com/maester365/maester/blob/main/tests/ad/schema/Test.AD-SCH-03.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:Schema/*.objectVersion:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SCH-04.md b/website/docs/tests/ad/AD-SCH-04.md index 0209e0a57..fcdb1aa65 100644 --- a/website/docs/tests/ad/AD-SCH-04.md +++ b/website/docs/tests/ad/AD-SCH-04.md @@ -79,6 +79,7 @@ This test retrieves detailed information from the schema container including: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdSchemaVersionDetails](https://github.com/maester365/maester/blob/main/tests/ad/schema/Test.AD-SCH-04.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:Schema/*.objectVersion:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SCH-05.md b/website/docs/tests/ad/AD-SCH-05.md index 5345b54c6..61f83a728 100644 --- a/website/docs/tests/ad/AD-SCH-05.md +++ b/website/docs/tests/ad/AD-SCH-05.md @@ -80,6 +80,7 @@ This test checks for the presence of LAPS schema attributes (ms-Mcs-AdmPwd) to d | Supports controls | nist-800-53-r5:IA-5, nist-800-53-r5:AC-6(2) | | PowerShell test | [Test-MtAdLapsInstalledStatus](https://github.com/maester365/maester/blob/main/tests/ad/schema/Test.AD-SCH-05.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:Schema/*:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SITE-01.md b/website/docs/tests/ad/AD-SITE-01.md index 4ca271e2c..779bd6023 100644 --- a/website/docs/tests/ad/AD-SITE-01.md +++ b/website/docs/tests/ad/AD-SITE-01.md @@ -70,6 +70,7 @@ This test retrieves all Active Directory sites using `Get-ADReplicationSite` and | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdSiteTotalCount](https://github.com/maester365/maester/blob/main/tests/ad/site/Test.AD-SITE-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:site:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SITE-02.md b/website/docs/tests/ad/AD-SITE-02.md index ca7c7b14d..f10e65038 100644 --- a/website/docs/tests/ad/AD-SITE-02.md +++ b/website/docs/tests/ad/AD-SITE-02.md @@ -70,6 +70,7 @@ This test compares the list of sites with domain controllers against all sites i | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdSiteWithoutDcCount](https://github.com/maester365/maester/blob/main/tests/ad/site/Test.AD-SITE-02.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:nTDSDSA:ReadProperty, ActiveDirectory:Ldap:site:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SITE-03.md b/website/docs/tests/ad/AD-SITE-03.md index d7e4d9444..50af41143 100644 --- a/website/docs/tests/ad/AD-SITE-03.md +++ b/website/docs/tests/ad/AD-SITE-03.md @@ -70,6 +70,7 @@ This test retrieves all sites and domain controllers, then identifies and lists | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdSiteWithoutDcDetails](https://github.com/maester365/maester/blob/main/tests/ad/site/Test.AD-SITE-03.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:nTDSDSA:ReadProperty, ActiveDirectory:Ldap:site:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SITE-04.md b/website/docs/tests/ad/AD-SITE-04.md index 19cf95500..afc4418f1 100644 --- a/website/docs/tests/ad/AD-SITE-04.md +++ b/website/docs/tests/ad/AD-SITE-04.md @@ -69,6 +69,7 @@ This test analyzes subnet-to-site associations to identify sites that have no su | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdSiteWithoutSubnetCount](https://github.com/maester365/maester/blob/main/tests/ad/site/Test.AD-SITE-04.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:site:ReadProperty, ActiveDirectory:Ldap:subnet:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SITE-05.md b/website/docs/tests/ad/AD-SITE-05.md index 30eb06764..be6a08f15 100644 --- a/website/docs/tests/ad/AD-SITE-05.md +++ b/website/docs/tests/ad/AD-SITE-05.md @@ -71,6 +71,7 @@ This test retrieves all sites and subnets, identifies sites with no subnet assoc | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdSiteWithoutSubnetDetails](https://github.com/maester365/maester/blob/main/tests/ad/site/Test.AD-SITE-05.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:site:ReadProperty, ActiveDirectory:Ldap:subnet:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SPN-01.md b/website/docs/tests/ad/AD-SPN-01.md index 4704bc6aa..ed54ae4c7 100644 --- a/website/docs/tests/ad/AD-SPN-01.md +++ b/website/docs/tests/ad/AD-SPN-01.md @@ -70,6 +70,7 @@ This test retrieves all computer objects from Active Directory, extracts their S | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdComputerSpnServiceClassCount](https://github.com/maester365/maester/blob/main/tests/ad/spn/Test.AD-SPN-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:computer:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SPN-02.md b/website/docs/tests/ad/AD-SPN-02.md index 36712f0d8..38754a3f0 100644 --- a/website/docs/tests/ad/AD-SPN-02.md +++ b/website/docs/tests/ad/AD-SPN-02.md @@ -70,6 +70,7 @@ This test analyzes all computer SPNs, groups them by service class, and provides | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdComputerSpnServiceClassUsage](https://github.com/maester365/maester/blob/main/tests/ad/spn/Test.AD-SPN-02.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:computer:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SPN-03.md b/website/docs/tests/ad/AD-SPN-03.md index 5bee4f5cb..3e3ab9d85 100644 --- a/website/docs/tests/ad/AD-SPN-03.md +++ b/website/docs/tests/ad/AD-SPN-03.md @@ -71,6 +71,7 @@ This test compares discovered SPN service classes against a database of known SP | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdComputerSpnUnknownCount](https://github.com/maester365/maester/blob/main/tests/ad/spn/Test.AD-SPN-03.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:computer:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SPN-04.md b/website/docs/tests/ad/AD-SPN-04.md index b67c56c19..924032dc2 100644 --- a/website/docs/tests/ad/AD-SPN-04.md +++ b/website/docs/tests/ad/AD-SPN-04.md @@ -71,6 +71,7 @@ This test analyzes all computer SPNs, compares service classes against a known d | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdComputerSpnUnknownDetails](https://github.com/maester365/maester/blob/main/tests/ad/spn/Test.AD-SPN-04.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:computer:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SPN-05.md b/website/docs/tests/ad/AD-SPN-05.md index b37d71de9..739fe3170 100644 --- a/website/docs/tests/ad/AD-SPN-05.md +++ b/website/docs/tests/ad/AD-SPN-05.md @@ -67,6 +67,7 @@ This test parses all computer SPNs and checks if the host portion contains a dot | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdComputerSpnNonFqdnHosts](https://github.com/maester365/maester/blob/main/tests/ad/spn/Test.AD-SPN-05.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:computer:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SPN-06.md b/website/docs/tests/ad/AD-SPN-06.md index 289dc6486..5fba1b19f 100644 --- a/website/docs/tests/ad/AD-SPN-06.md +++ b/website/docs/tests/ad/AD-SPN-06.md @@ -71,6 +71,7 @@ This test retrieves all user objects from Active Directory, extracts their SPNs, | MITRE ATT&CK | T1558.003 Kerberoasting | | PowerShell test | [Test-MtAdUserSpnTotalCount](https://github.com/maester365/maester/blob/main/tests/ad/spn/Test.AD-SPN-06.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SPN-07.md b/website/docs/tests/ad/AD-SPN-07.md index cb9c05126..7d351253c 100644 --- a/website/docs/tests/ad/AD-SPN-07.md +++ b/website/docs/tests/ad/AD-SPN-07.md @@ -70,6 +70,7 @@ This test retrieves all user objects with SPNs, extracts the service class from | MITRE ATT&CK | T1558.003 Kerberoasting | | PowerShell test | [Test-MtAdUserSpnServiceClassCount](https://github.com/maester365/maester/blob/main/tests/ad/spn/Test.AD-SPN-07.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SPN-08.md b/website/docs/tests/ad/AD-SPN-08.md index 5e69154d7..660da063e 100644 --- a/website/docs/tests/ad/AD-SPN-08.md +++ b/website/docs/tests/ad/AD-SPN-08.md @@ -70,6 +70,7 @@ This test analyzes all user SPNs, groups them by service class, and provides a c | MITRE ATT&CK | T1558.003 Kerberoasting | | PowerShell test | [Test-MtAdUserSpnServiceClassUsage](https://github.com/maester365/maester/blob/main/tests/ad/spn/Test.AD-SPN-08.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SPN-09.md b/website/docs/tests/ad/AD-SPN-09.md index a6ccd4e0e..1674fe01b 100644 --- a/website/docs/tests/ad/AD-SPN-09.md +++ b/website/docs/tests/ad/AD-SPN-09.md @@ -71,6 +71,7 @@ This test compares discovered user SPN service classes against a database of kno | MITRE ATT&CK | T1558.003 Kerberoasting | | PowerShell test | [Test-MtAdUserSpnUnknownCount](https://github.com/maester365/maester/blob/main/tests/ad/spn/Test.AD-SPN-09.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SPN-10.md b/website/docs/tests/ad/AD-SPN-10.md index 8c47edb74..bed4209a2 100644 --- a/website/docs/tests/ad/AD-SPN-10.md +++ b/website/docs/tests/ad/AD-SPN-10.md @@ -71,6 +71,7 @@ This test analyzes all user SPNs, identifies unknown service classes, and provid | MITRE ATT&CK | T1558.003 Kerberoasting | | PowerShell test | [Test-MtAdUserSpnUnknownDetails](https://github.com/maester365/maester/blob/main/tests/ad/spn/Test.AD-SPN-10.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SPN-11.md b/website/docs/tests/ad/AD-SPN-11.md index afd8a5e5b..d24297551 100644 --- a/website/docs/tests/ad/AD-SPN-11.md +++ b/website/docs/tests/ad/AD-SPN-11.md @@ -69,6 +69,7 @@ This test parses all user SPNs and checks if the host portion contains a dot (in | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdUserSpnNonFqdnHosts](https://github.com/maester365/maester/blob/main/tests/ad/spn/Test.AD-SPN-11.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SPN-12.md b/website/docs/tests/ad/AD-SPN-12.md index 8cd4c5c3f..8361a56bb 100644 --- a/website/docs/tests/ad/AD-SPN-12.md +++ b/website/docs/tests/ad/AD-SPN-12.md @@ -79,6 +79,7 @@ This test identifies domain administrator accounts (using the well-known RID 500 | Supports controls | nist-800-53-r5:AC-6(5), nist-800-53-r5:IA-5 | | PowerShell test | [Test-MtAdUserSpnDomainAdminCount](https://github.com/maester365/maester/blob/main/tests/ad/spn/Test.AD-SPN-12.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:domainDNS:ReadProperty, ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SPN-13.md b/website/docs/tests/ad/AD-SPN-13.md index 64f34d3db..c8bfd66b5 100644 --- a/website/docs/tests/ad/AD-SPN-13.md +++ b/website/docs/tests/ad/AD-SPN-13.md @@ -80,6 +80,7 @@ This test identifies domain administrator accounts and provides detailed informa | Supports controls | nist-800-53-r5:AC-6(5), nist-800-53-r5:IA-5 | | PowerShell test | [Test-MtAdUserSpnDomainAdminDetails](https://github.com/maester365/maester/blob/main/tests/ad/spn/Test.AD-SPN-13.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:domainDNS:ReadProperty, ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SUB-01.md b/website/docs/tests/ad/AD-SUB-01.md index 9e46354d5..2797054d8 100644 --- a/website/docs/tests/ad/AD-SUB-01.md +++ b/website/docs/tests/ad/AD-SUB-01.md @@ -69,6 +69,7 @@ This test retrieves all Active Directory subnets using `Get-ADReplicationSubnet` | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdSubnetTotalCount](https://github.com/maester365/maester/blob/main/tests/ad/site/Test.AD-SUB-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:subnet:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SUB-02.md b/website/docs/tests/ad/AD-SUB-02.md index 8bcfe37a1..34e579427 100644 --- a/website/docs/tests/ad/AD-SUB-02.md +++ b/website/docs/tests/ad/AD-SUB-02.md @@ -69,6 +69,7 @@ This test analyzes subnet-to-site associations to count how many sites have at l | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdSubnetSiteAssociationCount](https://github.com/maester365/maester/blob/main/tests/ad/site/Test.AD-SUB-02.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:site:ReadProperty, ActiveDirectory:Ldap:subnet:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SUB-03.md b/website/docs/tests/ad/AD-SUB-03.md index 59316852d..700adb04a 100644 --- a/website/docs/tests/ad/AD-SUB-03.md +++ b/website/docs/tests/ad/AD-SUB-03.md @@ -69,6 +69,7 @@ This test identifies subnets with overly broad CIDR notation that could encompas | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdSubnetCatchAllCount](https://github.com/maester365/maester/blob/main/tests/ad/site/Test.AD-SUB-03.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:subnet:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SUB-04.md b/website/docs/tests/ad/AD-SUB-04.md index 732b60f71..b604fc462 100644 --- a/website/docs/tests/ad/AD-SUB-04.md +++ b/website/docs/tests/ad/AD-SUB-04.md @@ -69,6 +69,7 @@ This test counts subnets that use IPv6 address format (containing colons). | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdSubnetIpv6Count](https://github.com/maester365/maester/blob/main/tests/ad/site/Test.AD-SUB-04.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:subnet:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SUB-05.md b/website/docs/tests/ad/AD-SUB-05.md index 3c51e92ff..ccbcaedf8 100644 --- a/website/docs/tests/ad/AD-SUB-05.md +++ b/website/docs/tests/ad/AD-SUB-05.md @@ -69,6 +69,7 @@ This test identifies IPv6 subnets with overly broad prefixes (/48 or smaller). | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdSubnetIpv6CatchAllCount](https://github.com/maester365/maester/blob/main/tests/ad/site/Test.AD-SUB-05.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:subnet:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SUB-06.md b/website/docs/tests/ad/AD-SUB-06.md index 4224b7f66..22395d067 100644 --- a/website/docs/tests/ad/AD-SUB-06.md +++ b/website/docs/tests/ad/AD-SUB-06.md @@ -69,6 +69,7 @@ This test identifies subnets that use public IP address ranges outside of RFC191 | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdSubnetNonInternalCount](https://github.com/maester365/maester/blob/main/tests/ad/site/Test.AD-SUB-06.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:subnet:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SUB-07.md b/website/docs/tests/ad/AD-SUB-07.md index 2b328fdd2..90e0a394e 100644 --- a/website/docs/tests/ad/AD-SUB-07.md +++ b/website/docs/tests/ad/AD-SUB-07.md @@ -71,6 +71,7 @@ This test retrieves all subnets, identifies those using public IP ranges, and li | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdSubnetNonInternalDetails](https://github.com/maester365/maester/blob/main/tests/ad/site/Test.AD-SUB-07.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:subnet:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SUB-08.md b/website/docs/tests/ad/AD-SUB-08.md index c01cd5e29..0adf5d74a 100644 --- a/website/docs/tests/ad/AD-SUB-08.md +++ b/website/docs/tests/ad/AD-SUB-08.md @@ -69,6 +69,7 @@ This test extracts the first octet from all IPv4 subnets and counts the distinct | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdSubnetFirstOctetCount](https://github.com/maester365/maester/blob/main/tests/ad/site/Test.AD-SUB-08.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:subnet:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SUB-09.md b/website/docs/tests/ad/AD-SUB-09.md index 7dfd5d353..ae3bad18c 100644 --- a/website/docs/tests/ad/AD-SUB-09.md +++ b/website/docs/tests/ad/AD-SUB-09.md @@ -69,6 +69,7 @@ This test extracts the first two octets from all IPv4 subnets and counts the dis | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdSubnetFirstTwoOctetsCount](https://github.com/maester365/maester/blob/main/tests/ad/site/Test.AD-SUB-09.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:subnet:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SUB-10.md b/website/docs/tests/ad/AD-SUB-10.md index 5c4644870..65b679473 100644 --- a/website/docs/tests/ad/AD-SUB-10.md +++ b/website/docs/tests/ad/AD-SUB-10.md @@ -69,6 +69,7 @@ This test extracts the first three octets from all IPv4 subnets and counts the d | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdSubnetFirstThreeOctetsCount](https://github.com/maester365/maester/blob/main/tests/ad/site/Test.AD-SUB-10.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:subnet:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-SUB-11.md b/website/docs/tests/ad/AD-SUB-11.md index 841cd2f84..05d8f7788 100644 --- a/website/docs/tests/ad/AD-SUB-11.md +++ b/website/docs/tests/ad/AD-SUB-11.md @@ -69,6 +69,7 @@ This test identifies subnets that have no site association (SiteObject is null). | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdSubnetWithoutSiteCount](https://github.com/maester365/maester/blob/main/tests/ad/site/Test.AD-SUB-11.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:subnet:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-TRUST-01.md b/website/docs/tests/ad/AD-TRUST-01.md index 1344693c6..e7adde2e1 100644 --- a/website/docs/tests/ad/AD-TRUST-01.md +++ b/website/docs/tests/ad/AD-TRUST-01.md @@ -74,6 +74,7 @@ This test retrieves all trust objects from Active Directory using `Get-ADTrust` | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdTrustTotalCount](https://github.com/maester365/maester/blob/main/tests/ad/trust/Test.AD-TRUST-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:trustedDomain:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-TRUST-02.md b/website/docs/tests/ad/AD-TRUST-02.md index 70f1d302a..01483b845 100644 --- a/website/docs/tests/ad/AD-TRUST-02.md +++ b/website/docs/tests/ad/AD-TRUST-02.md @@ -76,6 +76,7 @@ This test analyzes all trust objects and identifies those where `IntraForest` is | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdTrustInterForestCount](https://github.com/maester365/maester/blob/main/tests/ad/trust/Test.AD-TRUST-02.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:trustedDomain:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-TRUST-03.md b/website/docs/tests/ad/AD-TRUST-03.md index a152fe046..46e3a2628 100644 --- a/website/docs/tests/ad/AD-TRUST-03.md +++ b/website/docs/tests/ad/AD-TRUST-03.md @@ -87,6 +87,7 @@ The test returns: | MITRE ATT&CK | T1134.005 SID-History Injection | | PowerShell test | [Test-MtAdTrustQuarantinedCount](https://github.com/maester365/maester/blob/main/tests/ad/trust/Test.AD-TRUST-03.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:trustedDomain:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-TRUST-04.md b/website/docs/tests/ad/AD-TRUST-04.md index 76d2e5ff2..a22db8f26 100644 --- a/website/docs/tests/ad/AD-TRUST-04.md +++ b/website/docs/tests/ad/AD-TRUST-04.md @@ -109,6 +109,7 @@ The test displays: | Supports controls | nist-800-53-r5:AC-4, nist-800-53-r5:SC-7 | | PowerShell test | [Test-MtAdTrustNonQuarantinedDetails](https://github.com/maester365/maester/blob/main/tests/ad/trust/Test.AD-TRUST-04.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:trustedDomain:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-TRUST-05.md b/website/docs/tests/ad/AD-TRUST-05.md index 87987319b..6127d97ae 100644 --- a/website/docs/tests/ad/AD-TRUST-05.md +++ b/website/docs/tests/ad/AD-TRUST-05.md @@ -95,6 +95,7 @@ This test retrieves all trust properties from LDAP and derives display values: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdTrustDetails](https://github.com/maester365/maester/blob/main/tests/ad/trust/Test.AD-TRUST-05.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:trustedDomain:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-TRUST-06.md b/website/docs/tests/ad/AD-TRUST-06.md index dedc50e83..63258b1e2 100644 --- a/website/docs/tests/ad/AD-TRUST-06.md +++ b/website/docs/tests/ad/AD-TRUST-06.md @@ -94,6 +94,7 @@ The test returns: | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdTrustStaleCount](https://github.com/maester365/maester/blob/main/tests/ad/trust/Test.AD-TRUST-06.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:trustedDomain:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-TRUST-07.md b/website/docs/tests/ad/AD-TRUST-07.md index ce5151b74..a089abe1c 100644 --- a/website/docs/tests/ad/AD-TRUST-07.md +++ b/website/docs/tests/ad/AD-TRUST-07.md @@ -103,6 +103,7 @@ Results are sorted by last validation date (oldest first). | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdTrustStaleDetails](https://github.com/maester365/maester/blob/main/tests/ad/trust/Test.AD-TRUST-07.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:trustedDomain:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-USER-01.md b/website/docs/tests/ad/AD-USER-01.md index 6c3b31cc9..6efef848c 100644 --- a/website/docs/tests/ad/AD-USER-01.md +++ b/website/docs/tests/ad/AD-USER-01.md @@ -59,6 +59,7 @@ This test retrieves cached Active Directory user data from `Get-MtADDomainState` | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdUserDisabledCount](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-01.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-USER-02.md b/website/docs/tests/ad/AD-USER-02.md index a13282666..8e230ec4a 100644 --- a/website/docs/tests/ad/AD-USER-02.md +++ b/website/docs/tests/ad/AD-USER-02.md @@ -65,6 +65,7 @@ This test retrieves Active Directory user data from `Get-MtADDomainState`, filte | Supports controls | nist-800-53-r5:AC-2(3) | | PowerShell test | [Test-MtAdUserDormantEnabledCount](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-02.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-USER-03.md b/website/docs/tests/ad/AD-USER-03.md index 19b26a446..f452b894b 100644 --- a/website/docs/tests/ad/AD-USER-03.md +++ b/website/docs/tests/ad/AD-USER-03.md @@ -63,6 +63,7 @@ This test retrieves Active Directory user data from `Get-MtADDomainState`, filte | MITRE ATT&CK | T1078.002 Domain Accounts | | PowerShell test | [Test-MtAdUserPasswordNeverExpiresCount](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-03.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-USER-04.md b/website/docs/tests/ad/AD-USER-04.md index b8e1788b0..ecb180c45 100644 --- a/website/docs/tests/ad/AD-USER-04.md +++ b/website/docs/tests/ad/AD-USER-04.md @@ -64,6 +64,7 @@ This test retrieves Active Directory user data from `Get-MtADDomainState` and co | MITRE ATT&CK | T1556.005 Reversible Encryption | | PowerShell test | [Test-MtAdUserReversibleEncryptionCount](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-04.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-USER-05.md b/website/docs/tests/ad/AD-USER-05.md index ba95fa77d..01f16255c 100644 --- a/website/docs/tests/ad/AD-USER-05.md +++ b/website/docs/tests/ad/AD-USER-05.md @@ -64,6 +64,7 @@ This test retrieves Active Directory user data from `Get-MtADDomainState` and co | MITRE ATT&CK | T1558 Steal or Forge Kerberos Tickets, T1550.003 Pass the Ticket | | PowerShell test | [Test-MtAdUserDelegationAllowedCount](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-05.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-USER-06.md b/website/docs/tests/ad/AD-USER-06.md index 79984711b..f1b0dd070 100644 --- a/website/docs/tests/ad/AD-USER-06.md +++ b/website/docs/tests/ad/AD-USER-06.md @@ -64,6 +64,7 @@ This test retrieves Active Directory user data from `Get-MtADDomainState` and co | MITRE ATT&CK | T1558 Steal or Forge Kerberos Tickets | | PowerShell test | [Test-MtAdUserKerberosDesOnlyCount](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-06.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-USER-07.md b/website/docs/tests/ad/AD-USER-07.md index 703c2e036..fcf6599bd 100644 --- a/website/docs/tests/ad/AD-USER-07.md +++ b/website/docs/tests/ad/AD-USER-07.md @@ -64,6 +64,7 @@ This test retrieves Active Directory user data from `Get-MtADDomainState` and co | MITRE ATT&CK | T1558.004 AS-REP Roasting | | PowerShell test | [Test-MtAdUserNoPreAuthCount](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-07.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-USER-08.md b/website/docs/tests/ad/AD-USER-08.md index 29c248f1a..7cb61433e 100644 --- a/website/docs/tests/ad/AD-USER-08.md +++ b/website/docs/tests/ad/AD-USER-08.md @@ -59,6 +59,7 @@ This test retrieves Active Directory user data from `Get-MtADDomainState`, filte | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdUserNeverLoggedInCount](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-08.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-USER-09.md b/website/docs/tests/ad/AD-USER-09.md index a21d1d49c..64578fbed 100644 --- a/website/docs/tests/ad/AD-USER-09.md +++ b/website/docs/tests/ad/AD-USER-09.md @@ -59,6 +59,7 @@ This test retrieves Active Directory user data from `Get-MtADDomainState` and co | MITRE ATT&CK | T1078.002 Domain Accounts | | PowerShell test | [Test-MtAdUserPasswordNotRequiredCount](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-09.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-USER-10.md b/website/docs/tests/ad/AD-USER-10.md index df5690230..ace4fc04a 100644 --- a/website/docs/tests/ad/AD-USER-10.md +++ b/website/docs/tests/ad/AD-USER-10.md @@ -59,6 +59,7 @@ This test retrieves Active Directory user data from `Get-MtADDomainState` and co | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdUserWorkstationRestrictionCount](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-10.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-USER-11.md b/website/docs/tests/ad/AD-USER-11.md index 6db3954b4..64847079e 100644 --- a/website/docs/tests/ad/AD-USER-11.md +++ b/website/docs/tests/ad/AD-USER-11.md @@ -64,6 +64,7 @@ This test counts user objects where the `AdminCount` attribute equals `1`. | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdUserAdminCountCount](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-11.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-USER-12.md b/website/docs/tests/ad/AD-USER-12.md index eb02f27e7..0ad0911aa 100644 --- a/website/docs/tests/ad/AD-USER-12.md +++ b/website/docs/tests/ad/AD-USER-12.md @@ -69,6 +69,7 @@ This test counts user objects where `primaryGroupId` is populated and not equal | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdUserNonStandardPrimaryGroupCount](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-12.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-USER-13.md b/website/docs/tests/ad/AD-USER-13.md index 64d34b8ac..af1460fd6 100644 --- a/website/docs/tests/ad/AD-USER-13.md +++ b/website/docs/tests/ad/AD-USER-13.md @@ -69,6 +69,7 @@ This test counts user objects where the `SIDHistory` attribute contains one or m | MITRE ATT&CK | T1134.005 SID-History Injection | | PowerShell test | [Test-MtAdUserSidHistoryCount](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-13.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-USER-14.md b/website/docs/tests/ad/AD-USER-14.md index 1ed08e63a..b34b48741 100644 --- a/website/docs/tests/ad/AD-USER-14.md +++ b/website/docs/tests/ad/AD-USER-14.md @@ -64,6 +64,7 @@ This test counts user objects where the `ServicePrincipalName` attribute contain | MITRE ATT&CK | T1558.003 Kerberoasting | | PowerShell test | [Test-MtAdUserSpnSetCount](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-14.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-USER-15.md b/website/docs/tests/ad/AD-USER-15.md index 5cea232e2..9c44b8ae5 100644 --- a/website/docs/tests/ad/AD-USER-15.md +++ b/website/docs/tests/ad/AD-USER-15.md @@ -64,6 +64,7 @@ This test counts user objects where the `Manager` attribute contains a non-empty | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdUserManagerSetCount](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-15.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-USER-16.md b/website/docs/tests/ad/AD-USER-16.md index 1ab1e532f..593457020 100644 --- a/website/docs/tests/ad/AD-USER-16.md +++ b/website/docs/tests/ad/AD-USER-16.md @@ -64,6 +64,7 @@ This test counts user objects where the `HomeDirectory` attribute contains a non | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdUserHomeDirectoryCount](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-16.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-USER-17.md b/website/docs/tests/ad/AD-USER-17.md index c7a1165c7..4fb117eac 100644 --- a/website/docs/tests/ad/AD-USER-17.md +++ b/website/docs/tests/ad/AD-USER-17.md @@ -64,6 +64,7 @@ This test counts user objects where the `ProfilePath` attribute contains a non-e | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdUserProfilePathCount](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-17.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-USER-18.md b/website/docs/tests/ad/AD-USER-18.md index 82af42fdf..f6ebc2336 100644 --- a/website/docs/tests/ad/AD-USER-18.md +++ b/website/docs/tests/ad/AD-USER-18.md @@ -64,6 +64,7 @@ This test counts user objects where the `ScriptPath` attribute contains a non-em | MITRE ATT&CK | T1037.003 Network Logon Script | | PowerShell test | [Test-MtAdUserScriptPathCount](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-18.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-USER-19.md b/website/docs/tests/ad/AD-USER-19.md index f6e27e202..15d7a4dd1 100644 --- a/website/docs/tests/ad/AD-USER-19.md +++ b/website/docs/tests/ad/AD-USER-19.md @@ -64,6 +64,7 @@ This test counts user objects whose distinguished names indicate they are beneat | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdUserInContainerCount](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-19.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-USER-20.md b/website/docs/tests/ad/AD-USER-20.md index e47fa99a2..0906b1364 100644 --- a/website/docs/tests/ad/AD-USER-20.md +++ b/website/docs/tests/ad/AD-USER-20.md @@ -64,6 +64,7 @@ This test counts user objects whose `SamAccountName` or `Name` matches common se | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdUserKnownServiceAccountCount](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-20.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-USER-21.md b/website/docs/tests/ad/AD-USER-21.md index d744df068..3130cf124 100644 --- a/website/docs/tests/ad/AD-USER-21.md +++ b/website/docs/tests/ad/AD-USER-21.md @@ -66,6 +66,7 @@ This test reviews AD user objects and flags accounts whose `SamAccountName` or ` | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdUserKnownServiceAccountDetails](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-21.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-USER-22.md b/website/docs/tests/ad/AD-USER-22.md index 90db7a161..cc36d4d7a 100644 --- a/website/docs/tests/ad/AD-USER-22.md +++ b/website/docs/tests/ad/AD-USER-22.md @@ -66,6 +66,7 @@ This test counts user objects whose SID ends in `-500` or are marked as `isCriti | MITRE ATT&CK | T1078.001 Default Accounts | | PowerShell test | [Test-MtAdUserBuiltInAdminCount](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-22.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-USER-23.md b/website/docs/tests/ad/AD-USER-23.md index cc1f06f68..8d160c8db 100644 --- a/website/docs/tests/ad/AD-USER-23.md +++ b/website/docs/tests/ad/AD-USER-23.md @@ -64,6 +64,7 @@ This test returns enabled user accounts that match the built-in administrator RI | MITRE ATT&CK | T1078.001 Default Accounts | | PowerShell test | [Test-MtAdUserBuiltInAdminEnabledDetails](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-23.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-USER-24.md b/website/docs/tests/ad/AD-USER-24.md index bb18f487d..51b54b026 100644 --- a/website/docs/tests/ad/AD-USER-24.md +++ b/website/docs/tests/ad/AD-USER-24.md @@ -64,6 +64,7 @@ This test lists built-in administrator style accounts and returns their `LastLog | MITRE ATT&CK | T1078.001 Default Accounts | | PowerShell test | [Test-MtAdUserBuiltInAdminLastLogonDetails](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-24.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-USER-25.md b/website/docs/tests/ad/AD-USER-25.md index 71874a9dd..a96979cce 100644 --- a/website/docs/tests/ad/AD-USER-25.md +++ b/website/docs/tests/ad/AD-USER-25.md @@ -64,6 +64,7 @@ This test lists built-in administrator style accounts and reports `PasswordLastS | MITRE ATT&CK | T1078.001 Default Accounts, T1110.003 Password Spraying | | PowerShell test | [Test-MtAdUserBuiltInAdminPasswordAgeDetails](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-25.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-USER-26.md b/website/docs/tests/ad/AD-USER-26.md index c5054038b..9b16648ee 100644 --- a/website/docs/tests/ad/AD-USER-26.md +++ b/website/docs/tests/ad/AD-USER-26.md @@ -64,6 +64,7 @@ This test counts non-system user accounts whose names match attractive terms suc | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdUserHoneyPotCount](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-26.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-USER-27.md b/website/docs/tests/ad/AD-USER-27.md index 05c26cdf3..0ed7e1618 100644 --- a/website/docs/tests/ad/AD-USER-27.md +++ b/website/docs/tests/ad/AD-USER-27.md @@ -64,6 +64,7 @@ This test returns non-system users whose names match attacker-attractive terms a | MITRE ATT&CK | None | | PowerShell test | [Test-MtAdUserHoneyPotDetails](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-27.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-USER-28.md b/website/docs/tests/ad/AD-USER-28.md index 8e72f2d27..a16f7c4cb 100644 --- a/website/docs/tests/ad/AD-USER-28.md +++ b/website/docs/tests/ad/AD-USER-28.md @@ -65,6 +65,7 @@ This test counts user accounts with either `TrustedForDelegation` or `TrustedToA | MITRE ATT&CK | T1558 Steal or Forge Kerberos Tickets, T1550.003 Pass the Ticket | | PowerShell test | [Test-MtAdUserDelegationConfiguredCount](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-28.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/docs/tests/ad/AD-USER-29.md b/website/docs/tests/ad/AD-USER-29.md index 7bc3b949f..04e430f95 100644 --- a/website/docs/tests/ad/AD-USER-29.md +++ b/website/docs/tests/ad/AD-USER-29.md @@ -68,6 +68,7 @@ This test lists each user with `TrustedForDelegation` or `TrustedToAuthForDelega | Supports controls | nist-800-53-r5:AC-6 | | PowerShell test | [Test-MtAdUserDelegationDetails](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-29.ps1) | | Services | ActiveDirectory | +| Permissions | ActiveDirectory:Ldap:user:ReadProperty | ## Source diff --git a/website/src/data/contributors.json b/website/src/data/contributors.json index 1961e9b1a..e26fe49a8 100644 --- a/website/src/data/contributors.json +++ b/website/src/data/contributors.json @@ -2801,7 +2801,7 @@ "MT.1227" ], "initials": "MF", - "recentCommits": 185 + "recentCommits": 186 } ], "attributions": {