Guerrilla

2.54.0

Agentless, read-only, point-in-time security assessment for PowerShell 7 across three platforms: on-premises Active Directory (211 checks across 15 categories including transitive Tier-0 attack-path analysis, certificate-services ESC1-ESC16, NTLM-relay preconditions, telemetry posture, and adversary tradecraft indicators), the Entra ID / Azure / Intune / M365 identity plane (257 checks including a full 44-control EIDSCA baseline, conditional access, PIM, application and OAuth governance, Exchange Online, SharePoint, Teams, Defender, and entitlement-management hygiene), and Google Workspace (179 checks aligned to the CISA SCuBA baselines, plus the K12 candidate baseline checks with student-OU scoping). 647 checks total, each mapped to NIST 800-53, MITRE ATT&CK, CIS, EIDSCA, and CISA SCuBA where applicable and carrying a CISA Zero Trust pillar and weight, and each verdict validated by a golden-fixture test (1,878 fixtures). Every run is recorded locally and compared against your previous run: the report opens with what changed, including newly failing checks, confirmed remediations, and any check that went dark. Local history on your machine, no accounts, no telemetry.

Minimum PowerShell version

7.0

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Module -Name Guerrilla -RequiredVersion 2.54.0

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

Install-PSResource -Name Guerrilla -Version 2.54.0

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More

Owners

PowerShellEngineer

Copyright

Package Details

Author(s)

Jim Tyler Microsoft MVP

Functions

Set-Safehouse Test-Safehouse Get-Safehouse Invoke-GWSAudit Invoke-ADAudit Invoke-EntraAudit Invoke-Fortification Invoke-Reconnaissance Invoke-Infiltration Invoke-Campaign Get-GuerrillaScore Get-GuerrillaMaturity Get-QuickWins Get-ComplianceCrosswalk Test-GuerrillaConditionalAccess Export-BudgetJustification Export-ExecutiveSummary Export-TechnicalReport Export-RemediationPlaybook Export-RemediationScripts Set-RiskAcceptance Get-RiskAcceptance Get-TrendReport Export-ReportPdf Export-Dashboard Export-BloodHoundData Export-GuerrillaJUnit Get-GuerrillaCIGate Show-Guerrilla Get-ZeroTrustScore

Dependencies

This module has no dependencies.

Release Notes

Guerrilla (formerly PSGuerrilla). v2.54.0: Four new Google Workspace checks close the conditional external-sharing cluster in the CISA SCuBA Drive baseline, and the golden-fixture gate no longer rots with the calendar. DRIVE-019 (GWS.DRIVEDOCS.1.3) asserts that users are warned before sharing Drive content outside the organization; DRIVE-020 (1.4) that sharing is limited to recipients holding a Google account rather than PIN-based visitor links; DRIVE-021 (1.5) that publishing Drive content to the web is off; DRIVE-022 (1.7) that no one may upload or move content into a shared drive owned by another organization. All four read the drive_and_docs.external_sharing policy the scan already collects, so they need no new API scope, no new domain-wide delegation, and no collector change. These four policies only bind when external sharing is permitted, so each check pairs externalSharingMode with its sub-setting on the same policy value object, per targeted policy: resolving the two fields separately would let one organizational unit's sharing mode answer for another unit's setting. Policies 1.3 and 1.4 each read a different field depending on the mode, so a single-field check would grade half of all tenants against a setting that does not apply to them. Where external sharing is disallowed the check reports that the policy cannot apply rather than returning a bare pass, and where the sub-setting is missing while sharing is permitted it reports Not Assessed rather than crediting a setting it could not read. Field names and enum direction were verified against the published CISA assessment logic before any verdict code was written. Google Workspace coverage is now 179 checks and the total is 647, each validated by a golden-fixture test (1,878 fixtures); SCuBA Google Workspace policy coverage moves from 95 to 99 of 138. Separately, three fixtures pinned a login timestamp to an absolute date authored as 'recent'; it aged past the 90-day inactivity thresholds those checks apply and turned the suite red with no code change. All 151 remaining absolute dates across 76 fixture and generator files are now relative tokens, and a pre-flight guard fails the run outright if any fixture pins a datetime again. v2.53.1: Generated reports now localize into 13 languages. Every HTML report honors a -ReportLanguage code (Invoke-ADAudit, Invoke-EntraAudit, Invoke-GWSAudit, Invoke-Campaign and the Export-TechnicalReport/ExecutiveSummary/RemediationPlaybook/BudgetJustification cmdlets, or output.reportLanguage in config): the report shell and all 643 checks' static content (name, description, recommended value, remediation steps) render in Spanish, French, German, Italian, Hebrew, Portuguese, Dutch, Danish, Russian, Simplified Chinese, Japanese, Korean, and Hindi. The html lang and dir attributes follow the selected language, right-to-left languages mirror the layout, and each translated string carries per-key provenance. Live collected evidence stays as collected: only the check definitions are translated, and any string a language is missing falls back to English. A localization gate of 154 checks fails the build if a shipped language is missing a check, shell key, category label, or format placeholder, with a poison self-test proving the gate can fail. All 13 translations are machine-draft pending native review, and test reports (-TestMode) render in the selected language too. This supersedes the v2.52.0 note that generated reports were English only. v2.53.0: Seven new Google Workspace checks plus a service-account key-handling hardening. DRIVE-018 enumerates every shared drive and flags those whose external-sharing restriction (domainUsersOnly) is not enforced, the drive-level gate that permits contents to be shared outside the organization. GTRADE-007 surfaces admin roles assigned to a group rather than a user: every direct or nested member inherits the role and anyone who can edit the group's membership can grant it to themselves, the Google Workspace analogue of an Active Directory nested-group-to-Tier-0 path; broad-privilege grants FAIL and narrow ones WARN for review. Five more checks extend the K12 candidate baseline (GWS-K12-011 through 015): student Gmail auto-forwarding, Google Takeout data export, legacy IMAP/POP authentication for students, Google Vault export/retention/eDiscovery privilege sprawl, and audit-logging license coverage. Where a control's state is not exposed by any readable policy surface (Takeout, per-user audit-log SKU), the check reports Not Assessed with a manual-review direction rather than assuming a value it cannot read. Google Workspace coverage is now 175 checks and the total is 643, each validated by a golden-fixture test (1,854 fixtures). Separately, when a scan stages a Google service-account private key to a temporary file, the file is now created with owner-only permissions (mode 0600 on Unix, an inheritance-protected single-user ACL on Windows) locked in before the key is written, under a full-entropy random name, closing a window where the key briefly sat readable in the shared temp directory. v2.52.0: The desktop GUI now speaks 41 languages, four of them right-to-left. Every user-visible string in Show-Guerrilla comes from locale catalogs (English source plus 40 translations, each carrying all 171 keys with per-key translation provenance). A header selector switches the whole window live, the choice persists in config, and first launch follows the OS display language when a matching catalog exists. Right-to-left languages (Arabic, Persian, Hebrew, Urdu) mirror the entire layout from a catalog-declared direction flag, while the run log and source inspector stay left-to-right because cmdlet output is English regardless of UI language. Adding a language is adding one catalog file: the selector discovers them at runtime, and codes may be script-qualified (Traditional Chinese ships as zh-Hant alongside Simplified zh). A localization gate of 259 checks fails the build if any string is missing from English, a shipped language is incomplete, a format placeholder is dropped, or a text direction is invalid, with a poison self-test proving the gate can fail. The 40 translations ship as machine-draft pending native review. Generated reports remain English only: this release localizes the application interface, not the HTML output. v2.51.0: The desktop GUI is multilingual, starting with Spanish, on an architecture built to scale. Every user-visible string comes from locale catalogs (English source plus Spanish with per-key translation provenance, the same machine-draft / human-reviewed convention the website uses). A language selector in the header switches the whole window live with no restart, exactly the way the theme toggle works, and the choice persists in config next to the theme; first launch follows the OS display language when a matching catalog exists. Adding a future language is adding one catalog file: the selector discovers catalogs at runtime. Localized labels are decoupled from the canonical values passed to cmdlets, and a new localization gate fails the build if a GUI string is missing from the English catalog or a shipped language is incomplete, with a poison self-test proving the gate can fail. v2.50.0: Every generated report is rebuilt from scratch on the website's design system, so guerrilla.army, the desktop GUI, and the HTML reports read as one product. All ten HTML outputs (the AD, Entra, and Google Workspace reports, the unified Campaign report, the trend report, the dashboard, the technical report, the executive summary, the remediation playbook, and the budget justification) share one theme engine mirroring the site's contrast-verified light and dark tokens, one component stylesheet, and one shared shell: a sticky header with the Guerrilla wordmark and a light/dark toggle, the white-label banner and firm header when branding is configured, and the standard footer. Reports default to following the viewer's OS theme (-ReportStyle Auto) and the in-report toggle switches instantly with the choice remembered per browser; Light and Dark force an initial theme, and the legacy style names keep working everywhere (Professional maps to Light; Guerrilla and Slate map to Dark). Printing and Export-ReportPdf always render the light palette. The interactive findings filter, run comparison, Security Maturity, Indicators of Exposure, Attack-Path Cartography, and attack-path sections carry over restyled; none of their logic changed. See CHANGELOG.md for earlier releases.

FileList

Version History

Version	Downloads	Last updated
2.55.0	24	9/5/2026
2.54.0 (current version)	7	9/5/2026
2.53.1	80	8/3/2026
2.53.0	26	7/26/2026
2.52.0	34	7/16/2026
2.51.0	15	7/16/2026
2.50.0	15	7/15/2026
2.49.0	8	7/14/2026
2.47.0	16	7/12/2026
2.46.5	7	7/11/2026
2.46.4	5	7/9/2026
2.46.3	6	7/9/2026