Guerrilla.psd1
|
@{ RootModule = 'Guerrilla.psm1' ModuleVersion = '2.53.0' GUID = 'f7a3b2c1-4d5e-6f78-9a0b-1c2d3e4f5a6b' Author = 'Jim Tyler, Microsoft MVP' CompanyName = 'Jim Tyler' Copyright = '(c) 2026 Jim Tyler. All rights reserved.' Description = 'Agentless, read-only, point-in-time security assessment for PowerShell 7 across three platforms: on-premises Active Directory (211 checks across 15 categories including transitive Tier-0 attack-path analysis, certificate-services ESC1-ESC16, NTLM-relay preconditions, telemetry posture, and adversary tradecraft indicators), the Entra ID / Azure / Intune / M365 identity plane (257 checks including a full 44-control EIDSCA baseline, conditional access, PIM, application and OAuth governance, Exchange Online, SharePoint, Teams, Defender, and entitlement-management hygiene), and Google Workspace (175 checks aligned to the CISA SCuBA baselines, plus the K12 candidate baseline checks with student-OU scoping). 643 checks total, each mapped to NIST 800-53, MITRE ATT&CK, CIS, EIDSCA, and CISA SCuBA where applicable and carrying a CISA Zero Trust pillar and weight, and each verdict validated by a golden-fixture test (1,854 fixtures). Every run is recorded locally and compared against your previous run: the report opens with what changed, including newly failing checks, confirmed remediations, and any check that went dark. Local history on your machine, no accounts, no telemetry.' PowerShellVersion = '7.0' FunctionsToExport = @( 'Set-Safehouse' 'Test-Safehouse' 'Get-Safehouse' 'Invoke-GWSAudit' 'Invoke-ADAudit' 'Invoke-EntraAudit' # Deprecated wrappers for the renamed audits; removed in the next major version. 'Invoke-Fortification' 'Invoke-Reconnaissance' 'Invoke-Infiltration' 'Invoke-Campaign' 'Get-GuerrillaScore' 'Get-GuerrillaMaturity' 'Get-QuickWins' 'Get-ComplianceCrosswalk' 'Test-GuerrillaConditionalAccess' 'Export-BudgetJustification' 'Export-ExecutiveSummary' 'Export-TechnicalReport' 'Export-RemediationPlaybook' 'Export-RemediationScripts' 'Set-RiskAcceptance' 'Get-RiskAcceptance' 'Get-TrendReport' 'Export-ReportPdf' 'Export-Dashboard' 'Export-BloodHoundData' 'Export-GuerrillaJUnit' 'Get-GuerrillaCIGate' 'Show-Guerrilla' 'Get-ZeroTrustScore' ) CmdletsToExport = @() VariablesToExport = @() AliasesToExport = @( 'Set-ReconConfig' 'Get-ReconConfig' 'Invoke-ADRecon' 'Invoke-CloudRecon' ) FormatsToProcess = @('Guerrilla.format.ps1xml') PrivateData = @{ PSData = @{ Tags = @('GoogleWorkspace', 'ActiveDirectory', 'EntraID', 'AzureAD', 'Intune', 'M365', 'Security', 'SecurityAssessment', 'ADSecurity', 'CloudSecurity', 'NTLMRelay', 'TierZero', 'GUI', 'WPF', 'Guerrilla') LicenseUri = 'https://creativecommons.org/licenses/by/4.0/' ProjectUri = 'https://guerrilla.army' ReleaseNotes = 'Guerrilla (formerly PSGuerrilla). v2.53.0: Seven new Google Workspace checks plus a service-account key-handling hardening. DRIVE-018 enumerates every shared drive and flags those whose external-sharing restriction (domainUsersOnly) is not enforced, the drive-level gate that permits contents to be shared outside the organization. GTRADE-007 surfaces admin roles assigned to a group rather than a user: every direct or nested member inherits the role and anyone who can edit the group''s membership can grant it to themselves, the Google Workspace analogue of an Active Directory nested-group-to-Tier-0 path; broad-privilege grants FAIL and narrow ones WARN for review. Five more checks extend the K12 candidate baseline (GWS-K12-011 through 015): student Gmail auto-forwarding, Google Takeout data export, legacy IMAP/POP authentication for students, Google Vault export/retention/eDiscovery privilege sprawl, and audit-logging license coverage. Where a control''s state is not exposed by any readable policy surface (Takeout, per-user audit-log SKU), the check reports Not Assessed with a manual-review direction rather than assuming a value it cannot read. Google Workspace coverage is now 175 checks and the total is 643, each validated by a golden-fixture test (1,854 fixtures). Separately, when a scan stages a Google service-account private key to a temporary file, the file is now created with owner-only permissions (mode 0600 on Unix, an inheritance-protected single-user ACL on Windows) locked in before the key is written, under a full-entropy random name, closing a window where the key briefly sat readable in the shared temp directory. v2.52.0: The desktop GUI now speaks 41 languages, four of them right-to-left. Every user-visible string in Show-Guerrilla comes from locale catalogs (English source plus 40 translations, each carrying all 171 keys with per-key translation provenance). A header selector switches the whole window live, the choice persists in config, and first launch follows the OS display language when a matching catalog exists. Right-to-left languages (Arabic, Persian, Hebrew, Urdu) mirror the entire layout from a catalog-declared direction flag, while the run log and source inspector stay left-to-right because cmdlet output is English regardless of UI language. Adding a language is adding one catalog file: the selector discovers them at runtime, and codes may be script-qualified (Traditional Chinese ships as zh-Hant alongside Simplified zh). A localization gate of 259 checks fails the build if any string is missing from English, a shipped language is incomplete, a format placeholder is dropped, or a text direction is invalid, with a poison self-test proving the gate can fail. The 40 translations ship as machine-draft pending native review. Generated reports remain English only: this release localizes the application interface, not the HTML output. v2.51.0: The desktop GUI is multilingual, starting with Spanish, on an architecture built to scale. Every user-visible string comes from locale catalogs (English source plus Spanish with per-key translation provenance, the same machine-draft / human-reviewed convention the website uses). A language selector in the header switches the whole window live with no restart, exactly the way the theme toggle works, and the choice persists in config next to the theme; first launch follows the OS display language when a matching catalog exists. Adding a future language is adding one catalog file: the selector discovers catalogs at runtime. Localized labels are decoupled from the canonical values passed to cmdlets, and a new localization gate fails the build if a GUI string is missing from the English catalog or a shipped language is incomplete, with a poison self-test proving the gate can fail. v2.50.0: Every generated report is rebuilt from scratch on the website''s design system, so guerrilla.army, the desktop GUI, and the HTML reports read as one product. All ten HTML outputs (the AD, Entra, and Google Workspace reports, the unified Campaign report, the trend report, the dashboard, the technical report, the executive summary, the remediation playbook, and the budget justification) share one theme engine mirroring the site''s contrast-verified light and dark tokens, one component stylesheet, and one shared shell: a sticky header with the Guerrilla wordmark and a light/dark toggle, the white-label banner and firm header when branding is configured, and the standard footer. Reports default to following the viewer''s OS theme (-ReportStyle Auto) and the in-report toggle switches instantly with the choice remembered per browser; Light and Dark force an initial theme, and the legacy style names keep working everywhere (Professional maps to Light; Guerrilla and Slate map to Dark). Printing and Export-ReportPdf always render the light palette. The interactive findings filter, run comparison, Security Maturity, Indicators of Exposure, Attack-Path Cartography, and attack-path sections carry over restyled; none of their logic changed. v2.48.0: The K12 Secure Configuration Baseline arrives: a Guerrilla-authored candidate community baseline for school districts, openly published, versioned, open for comment, and clearly labeled as expert opinion rather than a consensus standard. School tenants hold adults and minors in one tenant with legally distinct duties toward each, and the boundary between them is an OU subtree, not the tenant; no consensus baseline assesses that boundary. Ten new Google Workspace checks (GWS-K12-001 through GWS-K12-010) assess ten of its twelve controls: staff-default sharing inheritance, student external Drive sharing, third-party app authorization for students, vendor delegated-access review, delegated admin least privilege, student communication boundaries in Chat and Meet, guardian access integrity, managed Chromebook posture, departed-student account disposition, and an age-banded account security floor that treats missing 2SV as context for young students rather than a blind failure. A new -StudentOU parameter designates which OU subtrees hold student accounts (Invoke-GWSAudit, Invoke-ADAudit, Invoke-Campaign, and a Student OUs field in the GUI); it is a designation, not a collection filter, and OU-scoped checks report Not Assessed without it instead of silently assessing the whole tenant as if it were the student population. The OU scope joins the run-history comparison identity, so a student-scoped run is never diffed against a whole-tenant run; this also fixes a latent issue where -TargetOU runs shared a comparison series with whole-tenant runs (existing whole-tenant baselines are unaffected). Every policy setting type and enum direction was verified against the Policy API catalog and CISA published assessment logic before verdict code was written, and 63 new golden fixtures cover every declared verdict branch, including the required no-scope and OU-absent branches. Chrome policies now additionally resolve per student OU. The baseline document ships in docs/baselines/ and is enforced by a completeness gate: a check claiming an undefined control, or the document overstating coverage, is a red build. See CHANGELOG.md for earlier releases.' } } } |