Guerrilla
2.51.0
Minimum PowerShell version
7.0
Installation Options
Owners
Copyright
(c) 2026 Jim Tyler. All rights reserved.
Package Details
Author(s)
- Jim Tyler Microsoft MVP
Tags
GoogleWorkspace ActiveDirectory EntraID AzureAD Intune M365 Security SecurityAssessment ADSecurity CloudSecurity NTLMRelay TierZero GUI WPF Guerrilla
Functions
Set-Safehouse Test-Safehouse Get-Safehouse Invoke-GWSAudit Invoke-ADAudit Invoke-EntraAudit Invoke-Fortification Invoke-Reconnaissance Invoke-Infiltration Invoke-Campaign Get-GuerrillaScore Get-GuerrillaMaturity Get-QuickWins Get-ComplianceCrosswalk Test-GuerrillaConditionalAccess Export-BudgetJustification Export-ExecutiveSummary Export-TechnicalReport Export-RemediationPlaybook Export-RemediationScripts Set-RiskAcceptance Get-RiskAcceptance Get-TrendReport Export-ReportPdf Export-Dashboard Export-BloodHoundData Export-GuerrillaJUnit Get-GuerrillaCIGate Show-Guerrilla Get-ZeroTrustScore
Dependencies
This module has no dependencies.
Release Notes
Guerrilla (formerly PSGuerrilla). v2.51.0: The desktop GUI is multilingual, starting with Spanish, on an architecture built to scale. Every user-visible string comes from locale catalogs (English source plus Spanish with per-key translation provenance, the same machine-draft / human-reviewed convention the website uses). A language selector in the header switches the whole window live with no restart, exactly the way the theme toggle works, and the choice persists in config next to the theme; first launch follows the OS display language when a matching catalog exists. Adding a future language is adding one catalog file: the selector discovers catalogs at runtime. Localized labels are decoupled from the canonical values passed to cmdlets, and a new localization gate fails the build if a GUI string is missing from the English catalog or a shipped language is incomplete, with a poison self-test proving the gate can fail. v2.50.0: Every generated report is rebuilt from scratch on the website's design system, so guerrilla.army, the desktop GUI, and the HTML reports read as one product. All ten HTML outputs (the AD, Entra, and Google Workspace reports, the unified Campaign report, the trend report, the dashboard, the technical report, the executive summary, the remediation playbook, and the budget justification) share one theme engine mirroring the site's contrast-verified light and dark tokens, one component stylesheet, and one shared shell: a sticky header with the Guerrilla wordmark and a light/dark toggle, the white-label banner and firm header when branding is configured, and the standard footer. Reports default to following the viewer's OS theme (-ReportStyle Auto) and the in-report toggle switches instantly with the choice remembered per browser; Light and Dark force an initial theme, and the legacy style names keep working everywhere (Professional maps to Light; Guerrilla and Slate map to Dark). Printing and Export-ReportPdf always render the light palette. The interactive findings filter, run comparison, Security Maturity, Indicators of Exposure, Attack-Path Cartography, and attack-path sections carry over restyled; none of their logic changed. v2.49.0: The GUI is rebuilt to look like guerrilla.army and to make running an audit a one-click act. Show-Guerrilla now follows the same design tokens as the website (flat surfaces, pill buttons, near-invisible borders, contrast-verified color pairs) with a light and dark theme whose toggle persists in your config; first launch follows the OS app theme. The window is borderless with its own header navigation and caption buttons instead of standard Windows chrome, with subtle page transitions and a live progress sweep during runs. The former Operations tab is now a Run page with exactly one button per platform: Active Directory, Entra/Azure/M365, Google Workspace, plus Campaign for everything. Scan depth, categories, report style, student OUs, and the output directory moved into an Options drawer with working defaults, so the common path is click and read the report. The add-credential dialog matches the new look and inherits the active theme. Underneath, nothing moved: the GUI still wraps the same public cmdlets, -StartOn accepts the same values, and the CLI remains the cross-platform source of truth. v2.48.0: The K12 Secure Configuration Baseline arrives: a Guerrilla-authored candidate community baseline for school districts, openly published, versioned, open for comment, and clearly labeled as expert opinion rather than a consensus standard. School tenants hold adults and minors in one tenant with legally distinct duties toward each, and the boundary between them is an OU subtree, not the tenant; no consensus baseline assesses that boundary. Ten new Google Workspace checks (GWS-K12-001 through GWS-K12-010) assess ten of its twelve controls: staff-default sharing inheritance, student external Drive sharing, third-party app authorization for students, vendor delegated-access review, delegated admin least privilege, student communication boundaries in Chat and Meet, guardian access integrity, managed Chromebook posture, departed-student account disposition, and an age-banded account security floor that treats missing 2SV as context for young students rather than a blind failure. A new -StudentOU parameter designates which OU subtrees hold student accounts (Invoke-GWSAudit, Invoke-ADAudit, Invoke-Campaign, and a Student OUs field in the GUI); it is a designation, not a collection filter, and OU-scoped checks report Not Assessed without it instead of silently assessing the whole tenant as if it were the student population. The OU scope joins the run-history comparison identity, so a student-scoped run is never diffed against a whole-tenant run; this also fixes a latent issue where -TargetOU runs shared a comparison series with whole-tenant runs (existing whole-tenant baselines are unaffected). Every policy setting type and enum direction was verified against the Policy API catalog and CISA published assessment logic before verdict code was written, and 63 new golden fixtures cover every declared verdict branch, including the required no-scope and OU-absent branches. Chrome policies now additionally resolve per student OU. The baseline document ships in docs/baselines/ and is enforced by a completeness gate: a check claiming an undefined control, or the document overstating coverage, is a red build. See CHANGELOG.md for earlier releases.
FileList
- CHANGELOG.md
- Guerrilla.format.ps1xml
- Guerrilla.nuspec
- Guerrilla.psd1
- Guerrilla.psm1
- LICENSE
- README.md
- checks\AD\Invoke-ADAclDelegationChecks.ps1
- checks\AD\Invoke-ADAttackPathChecks.ps1
- checks\AD\Invoke-ADCertificateServicesChecks.ps1
- checks\AD\Invoke-ADDomainForestChecks.ps1
- checks\AD\Invoke-ADGroupPolicyChecks.ps1
- checks\AD\Invoke-ADKerberosChecks.ps1
- checks\AD\Invoke-ADLoggingChecks.ps1
- checks\AD\Invoke-ADLogonScriptChecks.ps1
- checks\AD\Invoke-ADNetworkChecks.ps1
- checks\AD\Invoke-ADPasswordPolicyChecks.ps1
- checks\AD\Invoke-ADPrivilegedAccountChecks.ps1
- checks\AD\Invoke-ADStaleObjectChecks.ps1
- checks\AD\Invoke-ADTradecraftChecks.ps1
- checks\AD\Invoke-ADTrustChecks.ps1
- checks\AD\Invoke-TierZeroChecks.ps1
- checks\GWS\Invoke-AdminManagementChecks.ps1
- checks\GWS\Invoke-AuthenticationChecks.ps1
- checks\GWS\Invoke-CollaborationChecks.ps1
- checks\GWS\Invoke-DeviceManagementChecks.ps1
- checks\GWS\Invoke-DriveSecurityChecks.ps1
- checks\GWS\Invoke-EmailSecurityChecks.ps1
- checks\GWS\Invoke-GoogleTradecraftChecks.ps1
- checks\GWS\Invoke-GwsServiceChecks.ps1
- checks\GWS\Invoke-K12Checks.ps1
- checks\GWS\Invoke-LoggingAlertingChecks.ps1
- checks\GWS\Invoke-OAuthSecurityChecks.ps1
- checks\Entra\Invoke-AzureIAMChecks.ps1
- checks\Entra\Invoke-EntraAIAgentChecks.ps1
- checks\Entra\Invoke-EntraAppChecks.ps1
- checks\Entra\Invoke-EntraAuthChecks.ps1
- checks\Entra\Invoke-EntraCAChecks.ps1
- checks\Entra\Invoke-EntraEidscaChecks.ps1
- checks\Entra\Invoke-EntraFedChecks.ps1
- checks\Entra\Invoke-EntraGovernanceChecks.ps1
- checks\Entra\Invoke-EntraPIMChecks.ps1
- checks\Entra\Invoke-EntraTenantChecks.ps1
- checks\Entra\Invoke-IntuneChecks.ps1
- checks\Entra\Invoke-M365AuditChecks.ps1
- checks\Entra\Invoke-M365DefenderChecks.ps1
- checks\Entra\Invoke-M365ExchangeChecks.ps1
- checks\Entra\Invoke-M365PowerPlatformChecks.ps1
- checks\Entra\Invoke-M365SharePointChecks.ps1
- checks\Entra\Invoke-M365TeamsChecks.ps1
- internal\Core\Get-GuerrillaScoreCalculation.ps1
- internal\Core\Get-ResourceConstrainedFixes.ps1
- internal\Core\Hide-ConfigSecret.ps1
- internal\Core\Initialize-ConfigMigration.ps1
- internal\Core\Invoke-PendingKeyFileCleanup.ps1
- internal\Core\Write-GuerrillaDeprecation.ps1
- internal\AD\Core\Get-ADAttackPath.ps1
- internal\AD\Core\Get-ADAuditData.ps1
- internal\AD\Core\Get-ADCertificateServices.ps1
- internal\AD\Core\Get-ADDomainControllers.ps1
- internal\AD\Core\Get-ADDomainInfo.ps1
- internal\AD\Core\Get-ADFullDomainAcl.ps1
- internal\AD\Core\Get-ADGroupPolicyObjects.ps1
- internal\AD\Core\Get-ADKerberosConfig.ps1
- internal\AD\Core\Get-ADLogonScripts.ps1
- internal\AD\Core\Get-ADNetworkConfig.ps1
- internal\AD\Core\Get-ADObjectACLs.ps1
- internal\AD\Core\Get-ADPasswordHashQuality.ps1
- internal\AD\Core\Get-ADPasswordPolicies.ps1
- internal\AD\Core\Get-ADPrivilegedMembers.ps1
- internal\AD\Core\Get-ADReplicationHealth.ps1
- internal\AD\Core\Get-ADStaleObjects.ps1
- internal\AD\Core\Get-ADTierZeroSignals.ps1
- internal\AD\Core\Get-ADTradecraftSignals.ps1
- internal\AD\Core\Get-ADTransitiveAttackPath.ps1
- internal\AD\Core\Get-ADTrustRelationships.ps1
- internal\AD\Core\Get-ADUserRightsAssignment.ps1
- internal\AD\Core\Invoke-LdapQuery.ps1
- internal\AD\Core\New-LdapConnection.ps1
- internal\AD\Core\Resolve-ADSid.ps1
- internal\AD\Core\Test-ADModuleAvailability.ps1
- internal\Google\ConvertTo-GeminiDerivedSettings.ps1
- internal\Google\Get-GoogleAccessToken.ps1
- internal\Google\Get-GoogleCloudIdentityPolicies.ps1
- internal\Google\Get-GoogleGroupSettings.ps1
- internal\Google\Invoke-GoogleAdminApi.ps1
- internal\Google\Invoke-GoogleReportsApi.ps1
- internal\Google\New-GoogleJwt.ps1
- internal\Graph\Get-GraphAccessToken.ps1
- internal\Graph\Invoke-AzureRMApi.ps1
- internal\Graph\Invoke-GraphApi.ps1
- internal\Graph\Test-GraphModuleAvailability.ps1
- internal\Audit\Compare-GuerrillaRun.ps1
- internal\Audit\Get-AuditCategoryDefinitions.ps1
- internal\Audit\Get-AuditPostureScore.ps1
- internal\Audit\Get-GuerrillaFailedCategoryFinding.ps1
- internal\Audit\Get-GuerrillaSimulatedFindings.ps1
- internal\Audit\Get-GWSAuditData.ps1
- internal\Audit\Get-NotAssessedFinding.ps1
- internal\Audit\New-AuditFinding.ps1
- internal\Audit\New-GuerrillaRunRecord.ps1
- internal\Audit\Resolve-DomainMailSecurity.ps1
- internal\Audit\Resolve-GooglePolicyValue.ps1
- internal\Audit\Resolve-GwsStudentOuScope.ps1
- internal\Audit\Save-GuerrillaRunRecord.ps1
- internal\Gui\Get-GuerrillaGuiLocale.ps1
- internal\Gui\Get-GuerrillaGuiTheme.ps1
- internal\Gui\Invoke-GuerrillaGuiAsync.ps1
- internal\Gui\Show-AddCredentialDialog.ps1
- internal\Gui\Show-GuerrillaWindow.ps1
- internal\Entra\Core\Get-AzureIAMData.ps1
- internal\Entra\Core\Get-EntraApplicationData.ps1
- internal\Entra\Core\Get-EntraAuditData.ps1
- internal\Entra\Core\Get-EntraAuthMethodsData.ps1
- internal\Entra\Core\Get-EntraConditionalAccessData.ps1
- internal\Entra\Core\Get-EntraFederationData.ps1
- internal\Entra\Core\Get-EntraGovernanceData.ps1
- internal\Entra\Core\Get-EntraPIMData.ps1
- internal\Entra\Core\Get-EntraTenantData.ps1
- internal\Entra\Core\Get-IntuneData.ps1
- internal\Entra\Core\Get-M365ServiceData.ps1
- internal\Entra\Core\Get-PowerPlatformData.ps1
- internal\Entra\Core\Resolve-CAWhatIf.ps1
- internal\Entra\Core\Resolve-EidscaControl.ps1
- internal\Entra\Core\Test-EntraConnectVersionCurrent.ps1
- internal\Export\Export-ADReportCsv.ps1
- internal\Export\Export-ADReportHtml.ps1
- internal\Export\Export-ADReportJson.ps1
- internal\Export\Export-CampaignReportCsv.ps1
- internal\Export\Export-CampaignReportHtml.ps1
- internal\Export\Export-CampaignReportJson.ps1
- internal\Export\Export-DashboardHtml.ps1
- internal\Export\Export-EntraReportCsv.ps1
- internal\Export\Export-EntraReportHtml.ps1
- internal\Export\Export-EntraReportJson.ps1
- internal\Export\Export-GWSReportCsv.ps1
- internal\Export\Export-GWSReportHtml.ps1
- internal\Export\Export-GWSReportJson.ps1
- internal\Export\Export-TrendReportHtml.ps1
- internal\Export\Get-GuerrillaReportSectionHtml.ps1
- internal\Export\Get-GuerrillaReportTheme.ps1
- internal\Export\Protect-CsvCell.ps1
- internal\Vault\Get-GuerrillaCredential.ps1
- internal\Vault\Get-SafehouseCredentialView.ps1
- internal\Vault\Get-SafehouseSecret.ps1
- internal\Vault\Get-VaultMetadata.ps1
- internal\Vault\Initialize-GuerrillaVault.ps1
- internal\Vault\Read-MissionConfig.ps1
- internal\Vault\Save-SafehouseCredentialSet.ps1
- internal\Vault\Set-GuerrillaCredential.ps1
- internal\Vault\Set-VaultMetadata.ps1
- internal\Vault\Show-SafehouseStatus.ps1
- internal\Vault\Test-CredentialConnectivity.ps1
- internal\Console\Get-AuditScoreLabel.ps1
- internal\Console\Get-GuerrillaScoreLabel.ps1
- internal\Console\Initialize-SpectreCapability.ps1
- internal\Console\Write-ADReport.ps1
- internal\Console\Write-CampaignReport.ps1
- internal\Console\Write-EntraReport.ps1
- internal\Console\Write-GuerrillaBanner.ps1
- internal\Console\Write-GuerrillaText.ps1
- internal\Console\Write-GWSReport.ps1
- internal\Console\Write-OperationHeader.ps1
- internal\Console\Write-ProgressLine.ps1
- internal\Console\Write-SpectreBarChart.ps1
- internal\Console\Write-SpectrePanel.ps1
- internal\Console\Write-SpectreTable.ps1
- internal\Console\Write-SpectreTree.ps1
- public\DeprecatedCmdlets.ps1
- public\Export-BloodHoundData.ps1
- public\Export-BudgetJustification.ps1
- public\Export-Dashboard.ps1
- public\Export-ExecutiveSummary.ps1
- public\Export-GuerrillaJUnit.ps1
- public\Export-RemediationPlaybook.ps1
- public\Export-RemediationScripts.ps1
- public\Export-ReportPdf.ps1
- public\Export-TechnicalReport.ps1
- public\Get-ComplianceCrosswalk.ps1
- public\Get-GuerrillaCIGate.ps1
- public\Get-GuerrillaMaturity.ps1
- public\Get-GuerrillaScore.ps1
- public\Get-QuickWins.ps1
- public\Get-RiskAcceptance.ps1
- public\Get-Safehouse.ps1
- public\Get-TrendReport.ps1
- public\Get-ZeroTrustScore.ps1
- public\Invoke-ADAudit.ps1
- public\Invoke-Campaign.ps1
- public\Invoke-EntraAudit.ps1
- public\Invoke-GWSAudit.ps1
- public\Set-RiskAcceptance.ps1
- public\Set-Safehouse.ps1
- public\Show-Guerrilla.ps1
- public\Test-GuerrillaConditionalAccess.ps1
- public\Test-Safehouse.ps1
- Data\ComplianceCrosswalk.json
- Data\RemediationCosts.json
- Data\Locales\gui.en.json
- Data\Locales\gui.es.json
- Data\Profiles\Default-Baseline.json
- Data\Profiles\K12-Baseline.json
- Data\AuditChecks\ADAclDelegationChecks.json
- Data\AuditChecks\ADAttackPathChecks.json
- Data\AuditChecks\ADCertificateServicesChecks.json
- Data\AuditChecks\ADDomainForestChecks.json
- Data\AuditChecks\ADGroupPolicyChecks.json
- Data\AuditChecks\ADKerberosChecks.json
- Data\AuditChecks\ADLoggingChecks.json
- Data\AuditChecks\ADLogonScriptChecks.json
- Data\AuditChecks\AdminManagementChecks.json
- Data\AuditChecks\ADNetworkChecks.json
- Data\AuditChecks\ADPasswordPolicyChecks.json
- Data\AuditChecks\ADPrivilegedAccountChecks.json
- Data\AuditChecks\ADStaleObjectChecks.json
- Data\AuditChecks\ADTradecraftChecks.json
- Data\AuditChecks\ADTrustChecks.json
- Data\AuditChecks\AuthenticationChecks.json
- Data\AuditChecks\AzureIAMChecks.json
- Data\AuditChecks\CollaborationChecks.json
- Data\AuditChecks\DeviceManagementChecks.json
- Data\AuditChecks\DriveSecurityChecks.json
- Data\AuditChecks\EidscaChecks.json
- Data\AuditChecks\EmailSecurityChecks.json
- Data\AuditChecks\EntraAIAgentChecks.json
- Data\AuditChecks\EntraAppChecks.json
- Data\AuditChecks\EntraAuthChecks.json
- Data\AuditChecks\EntraCAChecks.json
- Data\AuditChecks\EntraFedChecks.json
- Data\AuditChecks\EntraGovernanceChecks.json
- Data\AuditChecks\EntraPIMChecks.json
- Data\AuditChecks\EntraTenantChecks.json
- Data\AuditChecks\GoogleTradecraftChecks.json
- Data\AuditChecks\GwsServiceChecks.json
- Data\AuditChecks\IntuneChecks.json
- Data\AuditChecks\K12Checks.json
- Data\AuditChecks\LoggingAlertingChecks.json
- Data\AuditChecks\M365AuditChecks.json
- Data\AuditChecks\M365DefenderChecks.json
- Data\AuditChecks\M365ExchangeChecks.json
- Data\AuditChecks\M365PowerPlatformChecks.json
- Data\AuditChecks\M365SharePointChecks.json
- Data\AuditChecks\M365TeamsChecks.json
- Data\AuditChecks\OAuthSecurityChecks.json
- Data\AuditChecks\TierZeroChecks.json