Guerrilla
2.49.0
Minimum PowerShell version
7.0
Installation Options
Owners
Copyright
(c) 2026 Jim Tyler. All rights reserved.
Package Details
Author(s)
- Jim Tyler Microsoft MVP
Tags
GoogleWorkspace ActiveDirectory EntraID AzureAD Intune M365 Security SecurityAssessment ADSecurity CloudSecurity NTLMRelay TierZero GUI WPF Guerrilla
Functions
Set-Safehouse Test-Safehouse Get-Safehouse Invoke-GWSAudit Invoke-ADAudit Invoke-EntraAudit Invoke-Fortification Invoke-Reconnaissance Invoke-Infiltration Invoke-Campaign Get-GuerrillaScore Get-GuerrillaMaturity Get-QuickWins Get-ComplianceCrosswalk Test-GuerrillaConditionalAccess Export-BudgetJustification Export-ExecutiveSummary Export-TechnicalReport Export-RemediationPlaybook Export-RemediationScripts Set-RiskAcceptance Get-RiskAcceptance Get-TrendReport Export-ReportPdf Export-Dashboard Export-BloodHoundData Export-GuerrillaJUnit Get-GuerrillaCIGate Show-Guerrilla Get-ZeroTrustScore
Dependencies
This module has no dependencies.
Release Notes
Guerrilla (formerly PSGuerrilla). v2.49.0: The GUI is rebuilt to look like guerrilla.army and to make running an audit a one-click act. Show-Guerrilla now follows the same design tokens as the website (flat surfaces, pill buttons, near-invisible borders, contrast-verified color pairs) with a light and dark theme whose toggle persists in your config; first launch follows the OS app theme. The window is borderless with its own header navigation and caption buttons instead of standard Windows chrome, with subtle page transitions and a live progress sweep during runs. The former Operations tab is now a Run page with exactly one button per platform: Active Directory, Entra/Azure/M365, Google Workspace, plus Campaign for everything. Scan depth, categories, report style, student OUs, and the output directory moved into an Options drawer with working defaults, so the common path is click and read the report. The add-credential dialog matches the new look and inherits the active theme. Underneath, nothing moved: the GUI still wraps the same public cmdlets, -StartOn accepts the same values, and the CLI remains the cross-platform source of truth. v2.48.0: The K12 Secure Configuration Baseline arrives: a Guerrilla-authored candidate community baseline for school districts, openly published, versioned, open for comment, and clearly labeled as expert opinion rather than a consensus standard. School tenants hold adults and minors in one tenant with legally distinct duties toward each, and the boundary between them is an OU subtree, not the tenant; no consensus baseline assesses that boundary. Ten new Google Workspace checks (GWS-K12-001 through GWS-K12-010) assess ten of its twelve controls: staff-default sharing inheritance, student external Drive sharing, third-party app authorization for students, vendor delegated-access review, delegated admin least privilege, student communication boundaries in Chat and Meet, guardian access integrity, managed Chromebook posture, departed-student account disposition, and an age-banded account security floor that treats missing 2SV as context for young students rather than a blind failure. A new -StudentOU parameter designates which OU subtrees hold student accounts (Invoke-GWSAudit, Invoke-ADAudit, Invoke-Campaign, and a Student OUs field in the GUI); it is a designation, not a collection filter, and OU-scoped checks report Not Assessed without it instead of silently assessing the whole tenant as if it were the student population. The OU scope joins the run-history comparison identity, so a student-scoped run is never diffed against a whole-tenant run; this also fixes a latent issue where -TargetOU runs shared a comparison series with whole-tenant runs (existing whole-tenant baselines are unaffected). Every policy setting type and enum direction was verified against the Policy API catalog and CISA published assessment logic before verdict code was written, and 63 new golden fixtures cover every declared verdict branch, including the required no-scope and OU-absent branches. Chrome policies now additionally resolve per student OU. The baseline document ships in docs/baselines/ and is enforced by a completeness gate: a check claiming an undefined control, or the document overstating coverage, is a red build. v2.47.0: platform-named audits (Invoke-ADAudit / Invoke-EntraAudit / Invoke-GWSAudit, old names as deprecated wrappers), local run history with a what-changed lead section in every report including lost visibility, Campaign's first all-platforms delta, plain risk-ladder score labels, and gate poison self-tests. See CHANGELOG.md for earlier releases.
FileList
- CHANGELOG.md
- Guerrilla.format.ps1xml
- Guerrilla.nuspec
- Guerrilla.psd1
- Guerrilla.psm1
- LICENSE
- README.md
- checks\AD\Invoke-ADAclDelegationChecks.ps1
- checks\AD\Invoke-ADAttackPathChecks.ps1
- checks\AD\Invoke-ADCertificateServicesChecks.ps1
- checks\AD\Invoke-ADDomainForestChecks.ps1
- checks\AD\Invoke-ADGroupPolicyChecks.ps1
- checks\AD\Invoke-ADKerberosChecks.ps1
- checks\AD\Invoke-ADLoggingChecks.ps1
- checks\AD\Invoke-ADLogonScriptChecks.ps1
- checks\AD\Invoke-ADNetworkChecks.ps1
- checks\AD\Invoke-ADPasswordPolicyChecks.ps1
- checks\AD\Invoke-ADPrivilegedAccountChecks.ps1
- checks\AD\Invoke-ADStaleObjectChecks.ps1
- checks\AD\Invoke-ADTradecraftChecks.ps1
- checks\AD\Invoke-ADTrustChecks.ps1
- checks\AD\Invoke-TierZeroChecks.ps1
- checks\GWS\Invoke-AdminManagementChecks.ps1
- checks\GWS\Invoke-AuthenticationChecks.ps1
- checks\GWS\Invoke-CollaborationChecks.ps1
- checks\GWS\Invoke-DeviceManagementChecks.ps1
- checks\GWS\Invoke-DriveSecurityChecks.ps1
- checks\GWS\Invoke-EmailSecurityChecks.ps1
- checks\GWS\Invoke-GoogleTradecraftChecks.ps1
- checks\GWS\Invoke-GwsServiceChecks.ps1
- checks\GWS\Invoke-K12Checks.ps1
- checks\GWS\Invoke-LoggingAlertingChecks.ps1
- checks\GWS\Invoke-OAuthSecurityChecks.ps1
- checks\Entra\Invoke-AzureIAMChecks.ps1
- checks\Entra\Invoke-EntraAIAgentChecks.ps1
- checks\Entra\Invoke-EntraAppChecks.ps1
- checks\Entra\Invoke-EntraAuthChecks.ps1
- checks\Entra\Invoke-EntraCAChecks.ps1
- checks\Entra\Invoke-EntraEidscaChecks.ps1
- checks\Entra\Invoke-EntraFedChecks.ps1
- checks\Entra\Invoke-EntraGovernanceChecks.ps1
- checks\Entra\Invoke-EntraPIMChecks.ps1
- checks\Entra\Invoke-EntraTenantChecks.ps1
- checks\Entra\Invoke-IntuneChecks.ps1
- checks\Entra\Invoke-M365AuditChecks.ps1
- checks\Entra\Invoke-M365DefenderChecks.ps1
- checks\Entra\Invoke-M365ExchangeChecks.ps1
- checks\Entra\Invoke-M365PowerPlatformChecks.ps1
- checks\Entra\Invoke-M365SharePointChecks.ps1
- checks\Entra\Invoke-M365TeamsChecks.ps1
- internal\Core\Get-GuerrillaScoreCalculation.ps1
- internal\Core\Get-ResourceConstrainedFixes.ps1
- internal\Core\Hide-ConfigSecret.ps1
- internal\Core\Initialize-ConfigMigration.ps1
- internal\Core\Invoke-PendingKeyFileCleanup.ps1
- internal\Core\Write-GuerrillaDeprecation.ps1
- internal\AD\Core\Get-ADAttackPath.ps1
- internal\AD\Core\Get-ADAuditData.ps1
- internal\AD\Core\Get-ADCertificateServices.ps1
- internal\AD\Core\Get-ADDomainControllers.ps1
- internal\AD\Core\Get-ADDomainInfo.ps1
- internal\AD\Core\Get-ADFullDomainAcl.ps1
- internal\AD\Core\Get-ADGroupPolicyObjects.ps1
- internal\AD\Core\Get-ADKerberosConfig.ps1
- internal\AD\Core\Get-ADLogonScripts.ps1
- internal\AD\Core\Get-ADNetworkConfig.ps1
- internal\AD\Core\Get-ADObjectACLs.ps1
- internal\AD\Core\Get-ADPasswordHashQuality.ps1
- internal\AD\Core\Get-ADPasswordPolicies.ps1
- internal\AD\Core\Get-ADPrivilegedMembers.ps1
- internal\AD\Core\Get-ADReplicationHealth.ps1
- internal\AD\Core\Get-ADStaleObjects.ps1
- internal\AD\Core\Get-ADTierZeroSignals.ps1
- internal\AD\Core\Get-ADTradecraftSignals.ps1
- internal\AD\Core\Get-ADTransitiveAttackPath.ps1
- internal\AD\Core\Get-ADTrustRelationships.ps1
- internal\AD\Core\Get-ADUserRightsAssignment.ps1
- internal\AD\Core\Invoke-LdapQuery.ps1
- internal\AD\Core\New-LdapConnection.ps1
- internal\AD\Core\Resolve-ADSid.ps1
- internal\AD\Core\Test-ADModuleAvailability.ps1
- internal\Google\ConvertTo-GeminiDerivedSettings.ps1
- internal\Google\Get-GoogleAccessToken.ps1
- internal\Google\Get-GoogleCloudIdentityPolicies.ps1
- internal\Google\Get-GoogleGroupSettings.ps1
- internal\Google\Invoke-GoogleAdminApi.ps1
- internal\Google\Invoke-GoogleReportsApi.ps1
- internal\Google\New-GoogleJwt.ps1
- internal\Graph\Get-GraphAccessToken.ps1
- internal\Graph\Invoke-AzureRMApi.ps1
- internal\Graph\Invoke-GraphApi.ps1
- internal\Graph\Test-GraphModuleAvailability.ps1
- internal\Audit\Compare-GuerrillaRun.ps1
- internal\Audit\Get-AuditCategoryDefinitions.ps1
- internal\Audit\Get-AuditPostureScore.ps1
- internal\Audit\Get-GuerrillaFailedCategoryFinding.ps1
- internal\Audit\Get-GuerrillaSimulatedFindings.ps1
- internal\Audit\Get-GWSAuditData.ps1
- internal\Audit\Get-NotAssessedFinding.ps1
- internal\Audit\New-AuditFinding.ps1
- internal\Audit\New-GuerrillaRunRecord.ps1
- internal\Audit\Resolve-DomainMailSecurity.ps1
- internal\Audit\Resolve-GooglePolicyValue.ps1
- internal\Audit\Resolve-GwsStudentOuScope.ps1
- internal\Audit\Save-GuerrillaRunRecord.ps1
- internal\Gui\Get-GuerrillaGuiTheme.ps1
- internal\Gui\Invoke-GuerrillaGuiAsync.ps1
- internal\Gui\Show-AddCredentialDialog.ps1
- internal\Gui\Show-GuerrillaWindow.ps1
- internal\Entra\Core\Get-AzureIAMData.ps1
- internal\Entra\Core\Get-EntraApplicationData.ps1
- internal\Entra\Core\Get-EntraAuditData.ps1
- internal\Entra\Core\Get-EntraAuthMethodsData.ps1
- internal\Entra\Core\Get-EntraConditionalAccessData.ps1
- internal\Entra\Core\Get-EntraFederationData.ps1
- internal\Entra\Core\Get-EntraGovernanceData.ps1
- internal\Entra\Core\Get-EntraPIMData.ps1
- internal\Entra\Core\Get-EntraTenantData.ps1
- internal\Entra\Core\Get-IntuneData.ps1
- internal\Entra\Core\Get-M365ServiceData.ps1
- internal\Entra\Core\Get-PowerPlatformData.ps1
- internal\Entra\Core\Resolve-CAWhatIf.ps1
- internal\Entra\Core\Resolve-EidscaControl.ps1
- internal\Entra\Core\Test-EntraConnectVersionCurrent.ps1
- internal\Export\Export-ADReportCsv.ps1
- internal\Export\Export-ADReportHtml.ps1
- internal\Export\Export-ADReportJson.ps1
- internal\Export\Export-CampaignReportCsv.ps1
- internal\Export\Export-CampaignReportHtml.ps1
- internal\Export\Export-CampaignReportJson.ps1
- internal\Export\Export-DashboardHtml.ps1
- internal\Export\Export-EntraReportCsv.ps1
- internal\Export\Export-EntraReportHtml.ps1
- internal\Export\Export-EntraReportJson.ps1
- internal\Export\Export-GWSReportCsv.ps1
- internal\Export\Export-GWSReportHtml.ps1
- internal\Export\Export-GWSReportJson.ps1
- internal\Export\Export-TrendReportHtml.ps1
- internal\Export\Get-GuerrillaReportSectionHtml.ps1
- internal\Export\Get-GuerrillaReportTheme.ps1
- internal\Export\Protect-CsvCell.ps1
- internal\Vault\Get-GuerrillaCredential.ps1
- internal\Vault\Get-SafehouseCredentialView.ps1
- internal\Vault\Get-SafehouseSecret.ps1
- internal\Vault\Get-VaultMetadata.ps1
- internal\Vault\Initialize-GuerrillaVault.ps1
- internal\Vault\Read-MissionConfig.ps1
- internal\Vault\Save-SafehouseCredentialSet.ps1
- internal\Vault\Set-GuerrillaCredential.ps1
- internal\Vault\Set-VaultMetadata.ps1
- internal\Vault\Show-SafehouseStatus.ps1
- internal\Vault\Test-CredentialConnectivity.ps1
- internal\Console\Get-AuditScoreLabel.ps1
- internal\Console\Get-GuerrillaScoreLabel.ps1
- internal\Console\Initialize-SpectreCapability.ps1
- internal\Console\Write-ADReport.ps1
- internal\Console\Write-CampaignReport.ps1
- internal\Console\Write-EntraReport.ps1
- internal\Console\Write-GuerrillaBanner.ps1
- internal\Console\Write-GuerrillaText.ps1
- internal\Console\Write-GWSReport.ps1
- internal\Console\Write-OperationHeader.ps1
- internal\Console\Write-ProgressLine.ps1
- internal\Console\Write-SpectreBarChart.ps1
- internal\Console\Write-SpectrePanel.ps1
- internal\Console\Write-SpectreTable.ps1
- internal\Console\Write-SpectreTree.ps1
- public\DeprecatedCmdlets.ps1
- public\Export-BloodHoundData.ps1
- public\Export-BudgetJustification.ps1
- public\Export-Dashboard.ps1
- public\Export-ExecutiveSummary.ps1
- public\Export-GuerrillaJUnit.ps1
- public\Export-RemediationPlaybook.ps1
- public\Export-RemediationScripts.ps1
- public\Export-ReportPdf.ps1
- public\Export-TechnicalReport.ps1
- public\Get-ComplianceCrosswalk.ps1
- public\Get-GuerrillaCIGate.ps1
- public\Get-GuerrillaMaturity.ps1
- public\Get-GuerrillaScore.ps1
- public\Get-QuickWins.ps1
- public\Get-RiskAcceptance.ps1
- public\Get-Safehouse.ps1
- public\Get-TrendReport.ps1
- public\Get-ZeroTrustScore.ps1
- public\Invoke-ADAudit.ps1
- public\Invoke-Campaign.ps1
- public\Invoke-EntraAudit.ps1
- public\Invoke-GWSAudit.ps1
- public\Set-RiskAcceptance.ps1
- public\Set-Safehouse.ps1
- public\Show-Guerrilla.ps1
- public\Test-GuerrillaConditionalAccess.ps1
- public\Test-Safehouse.ps1
- Data\ComplianceCrosswalk.json
- Data\RemediationCosts.json
- Data\Profiles\Default-Baseline.json
- Data\Profiles\K12-Baseline.json
- Data\AuditChecks\ADAclDelegationChecks.json
- Data\AuditChecks\ADAttackPathChecks.json
- Data\AuditChecks\ADCertificateServicesChecks.json
- Data\AuditChecks\ADDomainForestChecks.json
- Data\AuditChecks\ADGroupPolicyChecks.json
- Data\AuditChecks\ADKerberosChecks.json
- Data\AuditChecks\ADLoggingChecks.json
- Data\AuditChecks\ADLogonScriptChecks.json
- Data\AuditChecks\AdminManagementChecks.json
- Data\AuditChecks\ADNetworkChecks.json
- Data\AuditChecks\ADPasswordPolicyChecks.json
- Data\AuditChecks\ADPrivilegedAccountChecks.json
- Data\AuditChecks\ADStaleObjectChecks.json
- Data\AuditChecks\ADTradecraftChecks.json
- Data\AuditChecks\ADTrustChecks.json
- Data\AuditChecks\AuthenticationChecks.json
- Data\AuditChecks\AzureIAMChecks.json
- Data\AuditChecks\CollaborationChecks.json
- Data\AuditChecks\DeviceManagementChecks.json
- Data\AuditChecks\DriveSecurityChecks.json
- Data\AuditChecks\EidscaChecks.json
- Data\AuditChecks\EmailSecurityChecks.json
- Data\AuditChecks\EntraAIAgentChecks.json
- Data\AuditChecks\EntraAppChecks.json
- Data\AuditChecks\EntraAuthChecks.json
- Data\AuditChecks\EntraCAChecks.json
- Data\AuditChecks\EntraFedChecks.json
- Data\AuditChecks\EntraGovernanceChecks.json
- Data\AuditChecks\EntraPIMChecks.json
- Data\AuditChecks\EntraTenantChecks.json
- Data\AuditChecks\GoogleTradecraftChecks.json
- Data\AuditChecks\GwsServiceChecks.json
- Data\AuditChecks\IntuneChecks.json
- Data\AuditChecks\K12Checks.json
- Data\AuditChecks\LoggingAlertingChecks.json
- Data\AuditChecks\M365AuditChecks.json
- Data\AuditChecks\M365DefenderChecks.json
- Data\AuditChecks\M365ExchangeChecks.json
- Data\AuditChecks\M365PowerPlatformChecks.json
- Data\AuditChecks\M365SharePointChecks.json
- Data\AuditChecks\M365TeamsChecks.json
- Data\AuditChecks\OAuthSecurityChecks.json
- Data\AuditChecks\TierZeroChecks.json