Guerrilla
2.47.0
Agentless, read-only, point-in-time security assessment for PowerShell 7 across three platforms: on-premises Active Directory (211 checks across 15 categories including transitive Tier-0 attack-path analysis, certificate-services ESC1-ESC16, NTLM-relay preconditions, telemetry posture, and adversary tradecraft indicators), the Entra ID / Azure / Intune / M365 identity
Agentless, read-only, point-in-time security assessment for PowerShell 7 across three platforms: on-premises Active Directory (211 checks across 15 categories including transitive Tier-0 attack-path analysis, certificate-services ESC1-ESC16, NTLM-relay preconditions, telemetry posture, and adversary tradecraft indicators), the Entra ID / Azure / Intune / M365 identity plane (257 checks including a full 44-control EIDSCA baseline, conditional access, PIM, application and OAuth governance, Exchange Online, SharePoint, Teams, Defender, and entitlement-management hygiene), and Google Workspace (158 checks aligned to the CISA SCuBA baselines). 626 checks total, each mapped to NIST 800-53, MITRE ATT&CK, CIS, EIDSCA, and CISA SCuBA where applicable and carrying a CISA Zero Trust pillar and weight, and each verdict validated by a golden-fixture test (1,754 fixtures). Every run is recorded locally and compared against your previous run: the report opens with what changed, including newly failing checks, confirmed remediations, and any check that went dark. Local history on your machine, no accounts, no telemetry.
Show more
Minimum PowerShell version
7.0
Installation Options
Owners
Copyright
(c) 2026 Jim Tyler. All rights reserved.
Package Details
Author(s)
- Jim Tyler Microsoft MVP
Tags
GoogleWorkspace ActiveDirectory EntraID AzureAD Intune M365 Security SecurityAssessment ADSecurity CloudSecurity NTLMRelay TierZero GUI WPF Guerrilla
Functions
Set-Safehouse Test-Safehouse Get-Safehouse Invoke-GWSAudit Invoke-ADAudit Invoke-EntraAudit Invoke-Fortification Invoke-Reconnaissance Invoke-Infiltration Invoke-Campaign Get-GuerrillaScore Get-GuerrillaMaturity Get-QuickWins Get-ComplianceCrosswalk Test-GuerrillaConditionalAccess Export-BudgetJustification Export-ExecutiveSummary Export-TechnicalReport Export-RemediationPlaybook Export-RemediationScripts Set-RiskAcceptance Get-RiskAcceptance Get-TrendReport Export-ReportPdf Export-Dashboard Export-BloodHoundData Export-GuerrillaJUnit Get-GuerrillaCIGate Show-Guerrilla Get-ZeroTrustScore
Dependencies
This module has no dependencies.
Release Notes
Guerrilla (formerly PSGuerrilla). v2.47.0: The platform audits are now named what they are. Invoke-ADAudit (Active Directory), Invoke-EntraAudit (Entra ID / Azure / Intune / M365), and Invoke-GWSAudit (Google Workspace) replace Invoke-Reconnaissance, Invoke-Infiltration, and Invoke-Fortification; the old names keep working as deprecated wrappers that warn once per session and will be removed in the next major version. The GitHub Action platform input takes AD, Entra, GWS, or Campaign, with the old values accepted and mapped. Report headings, the unified dashboard, and the machine-readable test-summary artifact now name platforms Active Directory, Entra ID / M365, and Google Workspace, and the artifact schema is v2 with a platform field per check. Delta state saved by earlier versions is still read via legacy-name fallbacks, so the first post-upgrade run keeps its baseline. No check verdict logic changed. See CHANGELOG.md for earlier releases.
FileList
- CHANGELOG.md
- Guerrilla.format.ps1xml
- Guerrilla.nuspec
- Guerrilla.psd1
- Guerrilla.psm1
- LICENSE
- README.md
- checks\AD\Invoke-ADAclDelegationChecks.ps1
- checks\AD\Invoke-ADAttackPathChecks.ps1
- checks\AD\Invoke-ADCertificateServicesChecks.ps1
- checks\AD\Invoke-ADDomainForestChecks.ps1
- checks\AD\Invoke-ADGroupPolicyChecks.ps1
- checks\AD\Invoke-ADKerberosChecks.ps1
- checks\AD\Invoke-ADLoggingChecks.ps1
- checks\AD\Invoke-ADLogonScriptChecks.ps1
- checks\AD\Invoke-ADNetworkChecks.ps1
- checks\AD\Invoke-ADPasswordPolicyChecks.ps1
- checks\AD\Invoke-ADPrivilegedAccountChecks.ps1
- checks\AD\Invoke-ADStaleObjectChecks.ps1
- checks\AD\Invoke-ADTradecraftChecks.ps1
- checks\AD\Invoke-ADTrustChecks.ps1
- checks\AD\Invoke-TierZeroChecks.ps1
- checks\GWS\Invoke-AdminManagementChecks.ps1
- checks\GWS\Invoke-AuthenticationChecks.ps1
- checks\GWS\Invoke-CollaborationChecks.ps1
- checks\GWS\Invoke-DeviceManagementChecks.ps1
- checks\GWS\Invoke-DriveSecurityChecks.ps1
- checks\GWS\Invoke-EmailSecurityChecks.ps1
- checks\GWS\Invoke-GoogleTradecraftChecks.ps1
- checks\GWS\Invoke-GwsServiceChecks.ps1
- checks\GWS\Invoke-LoggingAlertingChecks.ps1
- checks\GWS\Invoke-OAuthSecurityChecks.ps1
- checks\Entra\Invoke-AzureIAMChecks.ps1
- checks\Entra\Invoke-EntraAIAgentChecks.ps1
- checks\Entra\Invoke-EntraAppChecks.ps1
- checks\Entra\Invoke-EntraAuthChecks.ps1
- checks\Entra\Invoke-EntraCAChecks.ps1
- checks\Entra\Invoke-EntraEidscaChecks.ps1
- checks\Entra\Invoke-EntraFedChecks.ps1
- checks\Entra\Invoke-EntraGovernanceChecks.ps1
- checks\Entra\Invoke-EntraPIMChecks.ps1
- checks\Entra\Invoke-EntraTenantChecks.ps1
- checks\Entra\Invoke-IntuneChecks.ps1
- checks\Entra\Invoke-M365AuditChecks.ps1
- checks\Entra\Invoke-M365DefenderChecks.ps1
- checks\Entra\Invoke-M365ExchangeChecks.ps1
- checks\Entra\Invoke-M365PowerPlatformChecks.ps1
- checks\Entra\Invoke-M365SharePointChecks.ps1
- checks\Entra\Invoke-M365TeamsChecks.ps1
- internal\Core\Get-GuerrillaScoreCalculation.ps1
- internal\Core\Get-ResourceConstrainedFixes.ps1
- internal\Core\Hide-ConfigSecret.ps1
- internal\Core\Initialize-ConfigMigration.ps1
- internal\Core\Invoke-PendingKeyFileCleanup.ps1
- internal\Core\Write-GuerrillaDeprecation.ps1
- internal\AD\Core\Get-ADAttackPath.ps1
- internal\AD\Core\Get-ADAuditData.ps1
- internal\AD\Core\Get-ADCertificateServices.ps1
- internal\AD\Core\Get-ADDomainControllers.ps1
- internal\AD\Core\Get-ADDomainInfo.ps1
- internal\AD\Core\Get-ADFullDomainAcl.ps1
- internal\AD\Core\Get-ADGroupPolicyObjects.ps1
- internal\AD\Core\Get-ADKerberosConfig.ps1
- internal\AD\Core\Get-ADLogonScripts.ps1
- internal\AD\Core\Get-ADNetworkConfig.ps1
- internal\AD\Core\Get-ADObjectACLs.ps1
- internal\AD\Core\Get-ADPasswordHashQuality.ps1
- internal\AD\Core\Get-ADPasswordPolicies.ps1
- internal\AD\Core\Get-ADPrivilegedMembers.ps1
- internal\AD\Core\Get-ADReplicationHealth.ps1
- internal\AD\Core\Get-ADStaleObjects.ps1
- internal\AD\Core\Get-ADTierZeroSignals.ps1
- internal\AD\Core\Get-ADTradecraftSignals.ps1
- internal\AD\Core\Get-ADTransitiveAttackPath.ps1
- internal\AD\Core\Get-ADTrustRelationships.ps1
- internal\AD\Core\Get-ADUserRightsAssignment.ps1
- internal\AD\Core\Invoke-LdapQuery.ps1
- internal\AD\Core\New-LdapConnection.ps1
- internal\AD\Core\Resolve-ADSid.ps1
- internal\AD\Core\Test-ADModuleAvailability.ps1
- internal\Google\ConvertTo-GeminiDerivedSettings.ps1
- internal\Google\Get-GoogleAccessToken.ps1
- internal\Google\Get-GoogleCloudIdentityPolicies.ps1
- internal\Google\Get-GoogleGroupSettings.ps1
- internal\Google\Invoke-GoogleAdminApi.ps1
- internal\Google\Invoke-GoogleReportsApi.ps1
- internal\Google\New-GoogleJwt.ps1
- internal\Graph\Get-GraphAccessToken.ps1
- internal\Graph\Invoke-AzureRMApi.ps1
- internal\Graph\Invoke-GraphApi.ps1
- internal\Graph\Test-GraphModuleAvailability.ps1
- internal\Audit\Compare-GuerrillaRun.ps1
- internal\Audit\Get-AuditCategoryDefinitions.ps1
- internal\Audit\Get-AuditPostureScore.ps1
- internal\Audit\Get-GuerrillaSimulatedFindings.ps1
- internal\Audit\Get-GWSAuditData.ps1
- internal\Audit\Get-NotAssessedFinding.ps1
- internal\Audit\New-AuditFinding.ps1
- internal\Audit\New-GuerrillaRunRecord.ps1
- internal\Audit\Resolve-DomainMailSecurity.ps1
- internal\Audit\Resolve-GooglePolicyValue.ps1
- internal\Audit\Save-GuerrillaRunRecord.ps1
- internal\Gui\Get-GuerrillaGuiTheme.ps1
- internal\Gui\Invoke-GuerrillaGuiAsync.ps1
- internal\Gui\Show-AddCredentialDialog.ps1
- internal\Gui\Show-GuerrillaWindow.ps1
- internal\Entra\Core\Get-AzureIAMData.ps1
- internal\Entra\Core\Get-EntraApplicationData.ps1
- internal\Entra\Core\Get-EntraAuditData.ps1
- internal\Entra\Core\Get-EntraAuthMethodsData.ps1
- internal\Entra\Core\Get-EntraConditionalAccessData.ps1
- internal\Entra\Core\Get-EntraFederationData.ps1
- internal\Entra\Core\Get-EntraGovernanceData.ps1
- internal\Entra\Core\Get-EntraPIMData.ps1
- internal\Entra\Core\Get-EntraTenantData.ps1
- internal\Entra\Core\Get-IntuneData.ps1
- internal\Entra\Core\Get-M365ServiceData.ps1
- internal\Entra\Core\Get-PowerPlatformData.ps1
- internal\Entra\Core\Resolve-CAWhatIf.ps1
- internal\Entra\Core\Resolve-EidscaControl.ps1
- internal\Entra\Core\Test-EntraConnectVersionCurrent.ps1
- internal\Export\Export-ADReportCsv.ps1
- internal\Export\Export-ADReportHtml.ps1
- internal\Export\Export-ADReportJson.ps1
- internal\Export\Export-CampaignReportCsv.ps1
- internal\Export\Export-CampaignReportHtml.ps1
- internal\Export\Export-CampaignReportJson.ps1
- internal\Export\Export-DashboardHtml.ps1
- internal\Export\Export-EntraReportCsv.ps1
- internal\Export\Export-EntraReportHtml.ps1
- internal\Export\Export-EntraReportJson.ps1
- internal\Export\Export-GWSReportCsv.ps1
- internal\Export\Export-GWSReportHtml.ps1
- internal\Export\Export-GWSReportJson.ps1
- internal\Export\Export-TrendReportHtml.ps1
- internal\Export\Get-GuerrillaReportSectionHtml.ps1
- internal\Export\Get-GuerrillaReportTheme.ps1
- internal\Vault\Get-GuerrillaCredential.ps1
- internal\Vault\Get-SafehouseCredentialView.ps1
- internal\Vault\Get-SafehouseSecret.ps1
- internal\Vault\Get-VaultMetadata.ps1
- internal\Vault\Initialize-GuerrillaVault.ps1
- internal\Vault\Read-MissionConfig.ps1
- internal\Vault\Save-SafehouseCredentialSet.ps1
- internal\Vault\Set-GuerrillaCredential.ps1
- internal\Vault\Set-VaultMetadata.ps1
- internal\Vault\Show-SafehouseStatus.ps1
- internal\Vault\Test-CredentialConnectivity.ps1
- internal\Console\Get-AuditScoreLabel.ps1
- internal\Console\Get-GuerrillaScoreLabel.ps1
- internal\Console\Initialize-SpectreCapability.ps1
- internal\Console\Write-ADReport.ps1
- internal\Console\Write-CampaignReport.ps1
- internal\Console\Write-EntraReport.ps1
- internal\Console\Write-GuerrillaBanner.ps1
- internal\Console\Write-GuerrillaText.ps1
- internal\Console\Write-GWSReport.ps1
- internal\Console\Write-OperationHeader.ps1
- internal\Console\Write-ProgressLine.ps1
- internal\Console\Write-SpectreBarChart.ps1
- internal\Console\Write-SpectrePanel.ps1
- internal\Console\Write-SpectreTable.ps1
- internal\Console\Write-SpectreTree.ps1
- public\DeprecatedCmdlets.ps1
- public\Export-BloodHoundData.ps1
- public\Export-BudgetJustification.ps1
- public\Export-Dashboard.ps1
- public\Export-ExecutiveSummary.ps1
- public\Export-GuerrillaJUnit.ps1
- public\Export-RemediationPlaybook.ps1
- public\Export-RemediationScripts.ps1
- public\Export-ReportPdf.ps1
- public\Export-TechnicalReport.ps1
- public\Get-ComplianceCrosswalk.ps1
- public\Get-GuerrillaCIGate.ps1
- public\Get-GuerrillaMaturity.ps1
- public\Get-GuerrillaScore.ps1
- public\Get-QuickWins.ps1
- public\Get-RiskAcceptance.ps1
- public\Get-Safehouse.ps1
- public\Get-TrendReport.ps1
- public\Get-ZeroTrustScore.ps1
- public\Invoke-ADAudit.ps1
- public\Invoke-Campaign.ps1
- public\Invoke-EntraAudit.ps1
- public\Invoke-GWSAudit.ps1
- public\Set-RiskAcceptance.ps1
- public\Set-Safehouse.ps1
- public\Show-Guerrilla.ps1
- public\Test-GuerrillaConditionalAccess.ps1
- public\Test-Safehouse.ps1
- Data\ComplianceCrosswalk.json
- Data\RemediationCosts.json
- Data\Profiles\Default-Baseline.json
- Data\Profiles\K12-Baseline.json
- Data\AuditChecks\ADAclDelegationChecks.json
- Data\AuditChecks\ADAttackPathChecks.json
- Data\AuditChecks\ADCertificateServicesChecks.json
- Data\AuditChecks\ADDomainForestChecks.json
- Data\AuditChecks\ADGroupPolicyChecks.json
- Data\AuditChecks\ADKerberosChecks.json
- Data\AuditChecks\ADLoggingChecks.json
- Data\AuditChecks\ADLogonScriptChecks.json
- Data\AuditChecks\AdminManagementChecks.json
- Data\AuditChecks\ADNetworkChecks.json
- Data\AuditChecks\ADPasswordPolicyChecks.json
- Data\AuditChecks\ADPrivilegedAccountChecks.json
- Data\AuditChecks\ADStaleObjectChecks.json
- Data\AuditChecks\ADTradecraftChecks.json
- Data\AuditChecks\ADTrustChecks.json
- Data\AuditChecks\AuthenticationChecks.json
- Data\AuditChecks\AzureIAMChecks.json
- Data\AuditChecks\CollaborationChecks.json
- Data\AuditChecks\DeviceManagementChecks.json
- Data\AuditChecks\DriveSecurityChecks.json
- Data\AuditChecks\EidscaChecks.json
- Data\AuditChecks\EmailSecurityChecks.json
- Data\AuditChecks\EntraAIAgentChecks.json
- Data\AuditChecks\EntraAppChecks.json
- Data\AuditChecks\EntraAuthChecks.json
- Data\AuditChecks\EntraCAChecks.json
- Data\AuditChecks\EntraFedChecks.json
- Data\AuditChecks\EntraGovernanceChecks.json
- Data\AuditChecks\EntraPIMChecks.json
- Data\AuditChecks\EntraTenantChecks.json
- Data\AuditChecks\GoogleTradecraftChecks.json
- Data\AuditChecks\GwsServiceChecks.json
- Data\AuditChecks\IntuneChecks.json
- Data\AuditChecks\LoggingAlertingChecks.json
- Data\AuditChecks\M365AuditChecks.json
- Data\AuditChecks\M365DefenderChecks.json
- Data\AuditChecks\M365ExchangeChecks.json
- Data\AuditChecks\M365PowerPlatformChecks.json
- Data\AuditChecks\M365SharePointChecks.json
- Data\AuditChecks\M365TeamsChecks.json
- Data\AuditChecks\OAuthSecurityChecks.json
- Data\AuditChecks\TierZeroChecks.json
Version History
| Version | Downloads | Last updated |
|---|---|---|
| 2.47.0 (current version) | 8 | 7/12/2026 |
| 2.46.5 | 6 | 7/11/2026 |
| 2.46.4 | 4 | 7/9/2026 |
| 2.46.3 | 5 | 7/9/2026 |