Skip to content

ROADMAP.md

Latest commit

 

History

History
852 lines (816 loc) · 48.9 KB

ROADMAP.md

File metadata and controls

852 lines (816 loc) · 48.9 KB
Raw

Roadmap

Limitations

Not all SharpHound features have been implemented. Some exist in rusthound-ce and not in SharpHound or BloodHound-Python. Please refer to the roadmap for more information.

Compatibility with SharpHound

Attribute-by-attribute compatibility baseline for rusthound-ce against SharpHound v2.17.1.0 (20261105), using collections from ESSOS.LOCAL on 2026-11-05. The 13 pre-existing object-type scores remain from the SharpHound v2.16.0.0 comparison on 2026-09-30 (after SAMR LocalGroups #69, SMB WebClient #72, and MS-RRP CA flags #97); they have not yet been revalidated field-by-field against v2.17.1.0. The three new Site object types are based on the v2.17.1.0 JSON outputs. Counts every checkbox of the List of attributes section, including nested sub-fields.

Object Attributes ✅ Implemented 🔴 Missing Compatibility
RootCA 28 27 1 ██████████ 96.4%
Gpo 25 24 1 ██████████ 96.0%
NtAuthStore 24 23 1 ██████████ 95.8%
CertTemplate 47 45 2 ██████████ 95.7%
User 70 67 3 ██████████ 95.7%
OU 34 32 2 █████████░ 94.1%
Group 32 30 2 █████████░ 93.8%
AIACA 30 28 2 █████████░ 93.3%
Container 26 24 2 █████████░ 92.3%
Domain 55 50 5 █████████░ 90.9%
IssuancePolicies 27 24 3 █████████░ 88.9%
EnterpriseCA 70 62 8 █████████░ 88.6%
Computer 119 86 33 ███████░░░ 72.3%
Site 27 25 2 █████████░ 92.6%
SiteServer 26 25 1 ██████████ 96.2%
SiteSubnet 25 24 1 ██████████ 96.0%
Total 665 596 69 █████████░ 89.6%

The new Site object types are now exported. Their attribute coverage is high, but full ACE parity and inherited ACE hashes are still pending. Among the existing object types, the lowest scores come from remote collection rather than LDAP parsing. LocalGroups is now collected over SAMR (#69) and IsWebClientRunning over SMB (#72); Computer is still pulled down by NTLMRegistryData, SmbInfo and DCRegistryData, and EnterpriseCA by CARegistryData:EnrollmentAgentRestrictions (the CA registry flags are now read over MS-RRP). Those remaining remote attributes require RPC/SMB access to the hosts.

Authentification

  • LDAP (389) ✅
  • LDAPS (636) ✅
  • BIND ✅
  • NTLM Pass-The-Hash ✅
  • Kerberos ✅
  • PFX,PEM Pass-The-Certificate ✅
  • Prompt for password ✅

Transport

  • LDAP / LDAPS (default) via ldap3 ✅
  • ADWS / SOAP over TCP 9389 (--transport soap), via adws
    • DirectoryTransport trait abstracting the directory read (naming contexts + paged search with SD-flags) ✅
    • LDAP implementation (existing behaviour behind the trait) ✅
    • ADWS implementation (adws, SearchEntry => LdapSearchEntry) ✅
    • Parity validation LDAP vs SOAP (object + ACE counts per NC) ✅

--transport soap or -t adws moves only the directory collection onto ADWS (users, groups, computers, OUs, GPO objects, ACLs, AD CS). The RPC/SMB modules (Session, LocalGroup, SYSVOL GPO, WebClient, CARegistry) keep their own protocols, if you want you can only use ADWS (SOAP) with collection method named -c SOAPOnly.

Outputs

  • users.json ✅
  • groups.json ✅
  • computers.json ✅
  • ous.json ✅
  • gpos.json ✅
  • containers.json ✅
  • domains.json ✅
  • aiacas.json ✅
  • rootcas.json ✅
  • enterprisecas.json ✅
  • certtemplates.json ✅
  • issuancepolicies.json ✅
  • ntauthstores.json ✅
  • sites.json ✅ 🆕
  • siteservers.json ✅ 🆕
  • sitesubnets.json ✅ 🆕
  • all.zip ✅

Modules

  • Retreive LAPS password if your user can read them automatic ✅
  • Retreive LAPSv2 password if your user can read them automatic 🔴
  • Resolve FQDN computers found to IP address --fqdn-resolver ✅
  • Session-collection feature, enumerates active sessions over three native RPC paths (SRVSVC, WKSSVC, WINREG) ✅
  • GPO-based collection from SYSVOL, reads GptTmpl.inf and Groups.xml, GPOChanges (LocalAdmins / RemoteDesktopUsers / DcomUsers / PSRemoteUsers) ✅
  • Local group enumeration over SAMR (LocalGroups, feeds AdminTo / CanRDP / CanPSRemote / ExecuteDCOM) ✅ 🆕
  • Remote registry collection over MS-RRP (\winreg over SMB) 🔴 🆕
    • CARegistryData (IsUserSpecifiesSanEnabled, RoleSeparationEnabled; EnrollmentAgentRestrictions pending) 🆕
    • DCRegistryData (CertificateMappingMethods, StrongCertificateBindingEnforcement, VulnerableNetlogonSecurityDescriptor)
    • NTLMRegistryData (LmCompatibilityLevel, SMB signing, NtlmMinSec, RestrictNtlmTraffic, …)
  • SMB signing probe (SmbInfo) 🔴 🆕
  • WebClient/WebDAV service probe (IsWebClientRunning, prerequisite for ESC8 / coercion paths) ✅
  • HTTP enrollment endpoints probe (HttpEnrollmentEndpoints, ADCS web enrollment over HTTP/HTTPS/EPA) ✅

Arguments

🆕 Planned. A shared SMB / RPC collection option group that paces and bounds every machine-contacting module. These flags MUST be consumed by all scan modules, Session, LocalGroup, WebClient, CARegistry and the future MS-RRP registry collectors, instead of the per-module constants hard-coded today.

  • Multi-value -c / CollectionMethods 🔴 🆕 accept several collection methods at once, comma-separated or repeated (-c LocalGroup,WebClient or -c LocalGroup -c WebClient). Replaces the single-value CollectionMethod enum with a CollectionMethods set; DCOnly / LdapOnly stay dominant no-machine scopes that suppress every member-machine collector even when combined. Today -c takes a single value (All is the only way to run several collectors together).
  • --workers 🔴 🆕 max concurrent in-flight SMB sessions (bounded stream), default 50. Replaces the per-module DEFAULT_CONCURRENCY
  • --throttle 🔴 🆕 base delay before each SMB/RPC connection, ms (SharpHound --Throttle), default 0
  • --jitter 🔴 🆕 random extra delay added on top of --throttle, ms (SharpHound --Jitter), default 0
  • --smb-timeout 🔴 🆕 TCP/445 reachability pre-check timeout, ms, default 1000. Replaces DEFAULT_PORT_TIMEOUT_MS
  • --host-timeout 🔴 🆕 whole per-host budget (connect + auth + probe), ms, default 8000. Replaces DEFAULT_HOST_TIMEOUT_MS
  • --computer-expiry-days 🔴 🆕 only probe computers whose pwdLastSet is within N days (SharpHound ComputerExpiryDays), default 60, replaces DEFAULT_EXPIRY_DAYS
  • --opsec 🔴 🆕 stealth preset: shuffles target order, lowers --workers, adds --throttle/--jitter (without overriding values set explicitly on the CLI)

Centralising these in a single SmbOptions struct (new .next_help_heading("SMB / RPC COLLECTION") block in args.rs) removes the duplicated DEFAULT_CONCURRENCY / DEFAULT_PORT_TIMEOUT_MS / DEFAULT_HOST_TIMEOUT_MS / DEFAULT_EXPIRY_DAYS constants currently living in session, localgroup and webclient, and lets the operator trade speed for stealth across the whole collection at once.

List of attributes

Domain

  • Properties:domain ✅
  • Properties:name ✅
  • Properties:distinguishedname ✅
  • Properties:domainsid ✅
  • Properties:objectguid ✅
  • Properties:doesanyinheritedacegrantownerrights ✅
  • Properties:doesanyacegrantownerrights ✅
  • Properties:isaclprotected ✅ (this value replaces IsACLProtected)
  • Properties:highvalue ✅ (dropped from BloodHound CE, candidate for removal)
  • Properties:description ✅ (not emitted by SharpHound)
  • Properties:whencreated ✅
  • Properties:netbios 🔴 🆕
  • Properties:expirepasswordsonsmartcardonlyaccounts ✅
  • Properties:machineaccountquota ✅
  • Properties:minpwdlength ✅
  • Properties:pwdproperties ✅
  • Properties:pwdhistorylength ✅
  • Properties:lockoutthreshold ✅
  • Properties:minpwdage ✅
  • Properties:maxpwdage ✅
  • Properties:lockoutduration ✅
  • Properties:lockoutobservationwindow ✅
  • Properties:functionallevel ✅
  • Properties:dsheuristics ✅
  • Properties:collected ✅
  • GPOChanges:LocalAdmins ✅
  • GPOChanges:RemoteDesktopUsers ✅
  • GPOChanges:DcomUsers ✅
  • GPOChanges:PSRemoteUsers ✅
  • GPOChanges:AffectedComputers ✅
  • ChildObjects:ObjectIdentifier ✅
  • ChildObjects:ObjectType ✅
  • Trusts:TargetDomainSid ✅
  • Trusts:TargetDomainName ✅
  • Trusts:IsTransitive ✅
  • Trusts:SidFilteringEnabled ✅
  • Trusts:TGTDelegationEnabled 🔴
  • Trusts:TrustAttributes ✅
  • Trusts:TrustDirection ✅
  • Trusts:TrustType ✅
  • Links:GUID ✅
  • Links:IsEnforced ✅
  • InheritanceHashes 🔴 🆕
  • ForestRootIdentifier 🔴 🆕
  • Aces:PrincipalSID ✅
  • Aces:PrincipalType ✅
  • Aces:RightName ✅
  • Aces:IsInherited ✅
  • Aces:InheritanceHash 🔴
  • Aces:IsPermissionForOwnerRightsSid ✅
  • Aces:IsInheritedPermissionForOwnerRightsSid ✅
  • ObjectIdentifier ✅
  • IsDeleted ✅
  • IsACLProtected ✅
  • ContainedBy ✅ (null on the domain root, same as SharpHound)

Computer

  • Properties:domain ✅
  • Properties:name ✅
  • Properties:distinguishedname ✅
  • Properties:domainsid ✅
  • Properties:objectguid ✅
  • Properties:doesanyinheritedacegrantownerrights ✅
  • Properties:doesanyacegrantownerrights ✅
  • Properties:isaclprotected ✅ (this value replaces IsACLProtected)
  • Properties:highvalue ✅ (dropped from BloodHound CE, candidate for removal)
  • Properties:description ✅
  • Properties:whencreated ✅
  • Properties:samaccountname ✅
  • Properties:haslaps ✅
  • Properties:enabled ✅
  • Properties:unconstraineddelegation ✅
  • Properties:trustedtoauth ✅
  • Properties:lastlogon ✅
  • Properties:lastlogontimestamp ✅
  • Properties:pwdlastset ✅
  • Properties:pwdneverexpires ✅
  • Properties:passwordnotreqd ✅
  • Properties:serviceprincipalnames ✅
  • Properties:operatingsystem ✅
  • Properties:supportedencryptiontypes ✅
  • Properties:sidhistory ✅
  • Properties:useraccountcontrol ✅
  • Properties:isdc ✅
  • Properties:isreadonlydc ✅
  • Properties:admincount ✅
  • Properties:adminsdholderprotected ✅ (derived from adminCount, matches SharpHound on the test domain)
  • Properties:lockedout ✅
  • Properties:passwordexpired ✅
  • Properties:usedeskeyonly ✅
  • Properties:encryptedtextpwdallowed ✅
  • Properties:logonscriptenabled ✅
  • Properties:email ✅
  • Properties:ldapavailable 🔴 🆕
  • Properties:ldapsavailable 🔴 🆕
  • Properties:ldapsigning 🔴 🆕
  • Properties:ldapsepa 🔴 🆕
  • PrimaryGroupSID ✅
  • AllowedToDelegate:ObjectIdentifier ✅
  • AllowedToDelegate:ObjectType ✅
  • AllowedToAct:ObjectIdentifier ✅
  • AllowedToAct:ObjectType ✅
  • HasSIDHistory:ObjectIdentifier ✅
  • HasSIDHistory:ObjectType ✅
  • DumpSMSAPassword 🔴 (key is emitted but always empty)
  • Sessions:Results:UserSID ✅
  • Sessions:Results:ComputerSID ✅
  • Sessions:Collected ✅
  • Sessions:FailureReason ✅
  • PrivilegedSessions:Results ✅
  • PrivilegedSessions:Collected ✅
  • PrivilegedSessions:FailureReason ✅
  • RegistrySessions:Results ✅ (read over MS-RRP; password or NT hash only)
  • RegistrySessions:Collected ✅
  • RegistrySessions:FailureReason ✅
  • LocalGroups ✅ (collected over SAMR BUILTIN aliases)
    • LocalGroups:Name ✅ 🆕
    • LocalGroups:ObjectIdentifier ✅ 🆕
    • LocalGroups:Results:ObjectIdentifier ✅ 🆕
    • LocalGroups:Results:ObjectType ✅ 🆕
    • LocalGroups:LocalNames ✅ 🆕
    • LocalGroups:Collected ✅ 🆕
    • LocalGroups:FailureReason ✅ 🆕
  • UserRights:Privilege ✅
  • UserRights:Results:ObjectIdentifier ✅
  • UserRights:Results:ObjectType ✅
  • UserRights:LocalNames ✅ (emitted but always empty, rebuilt from GptTmpl.inf)
  • UserRights:Collected ✅
  • UserRights:FailureReason ✅
  • DCRegistryData 🔴 need RPC call and GetRegistryKeyData src Helper.cs, the keys are emitted as a raw null instead of the {Collected, FailureReason, Value} wrapper
    • CertificateMappingMethods:Value 🔴
    • CertificateMappingMethods:Collected 🔴
    • CertificateMappingMethods:FailureReason 🔴
    • StrongCertificateBindingEnforcement:Value 🔴
    • StrongCertificateBindingEnforcement:Collected 🔴
    • StrongCertificateBindingEnforcement:FailureReason 🔴
    • VulnerableNetlogonSecurityDescriptor:Value 🔴 🆕
    • VulnerableNetlogonSecurityDescriptor:Collected 🔴 🆕
    • VulnerableNetlogonSecurityDescriptor:FailureReason 🔴 🆕
  • NTLMRegistryData 🔴 🆕
    • Result:LmCompatibilityLevel 🔴 🆕
    • Result:RestrictSendingNtlmTraffic 🔴 🆕
    • Result:RestrictReceivingNtlmTraffic 🔴 🆕
    • Result:NtlmMinClientSec 🔴 🆕
    • Result:NtlmMinServerSec 🔴 🆕
    • Result:RequireSecuritySignature 🔴 🆕
    • Result:EnableSecuritySignature 🔴 🆕
    • Result:ClientAllowedNTLMServers 🔴 🆕
    • Result:UseMachineId 🔴 🆕
    • Collected 🔴 🆕
    • FailureReason 🔴 🆕
  • SmbInfo 🔴 🆕
    • Result:SigningEnabled 🔴 🆕
    • Collected 🔴 🆕
    • FailureReason 🔴 🆕
  • IsWebClientRunning ✅ 🆕
    • Result ✅ 🆕
    • Collected ✅ 🆕
    • FailureReason ✅ 🆕
  • NtlmSessions 🔴 🆕
  • Status ✅
  • IsDC ✅
  • UnconstrainedDelegation ✅
  • DomainSID ✅
  • Aces:PrincipalSID ✅
  • Aces:PrincipalType ✅
  • Aces:RightName ✅
  • Aces:IsInherited ✅
  • Aces:InheritanceHash 🔴
  • Aces:IsPermissionForOwnerRightsSid ✅
  • Aces:IsInheritedPermissionForOwnerRightsSid ✅
  • ObjectIdentifier ✅
  • IsDeleted ✅
  • IsACLProtected ✅
  • ContainedBy:ObjectIdentifier ✅
  • ContainedBy:ObjectType ✅

User

  • Properties:domain ✅
  • Properties:name ✅
  • Properties:distinguishedname ✅
  • Properties:domainsid ✅
  • Properties:objectguid ✅
  • Properties:doesanyinheritedacegrantownerrights ✅
  • Properties:doesanyacegrantownerrights ✅
  • Properties:isaclprotected ✅ (this value replaces IsACLProtected)
  • Properties:highvalue ✅ (dropped from BloodHound CE, candidate for removal)
  • Properties:samaccountname ✅
  • Properties:description ✅
  • Properties:whencreated ✅
  • Properties:sensitive ✅
  • Properties:dontreqpreauth ✅
  • Properties:passwordnotreqd ✅
  • Properties:unconstraineddelegation ✅
  • Properties:pwdneverexpires ✅
  • Properties:enabled ✅
  • Properties:trustedtoauth ✅
  • Properties:lastlogon ✅
  • Properties:lastlogontimestamp ✅
  • Properties:pwdlastset ✅
  • Properties:serviceprincipalnames ✅
  • Properties:hasspn ✅
  • Properties:displayname ✅
  • Properties:email ✅
  • Properties:title ✅
  • Properties:homedirectory ✅
  • Properties:userpassword ✅
  • Properties:unixpassword ✅
  • Properties:unicodepassword ✅
  • Properties:sfupassword ✅
  • Properties:logonscript ✅
  • Properties:useraccountcontrol ✅
  • Properties:profilepath ✅
  • Properties:admincount ✅
  • Properties:supportedencryptiontypes ✅
  • Properties:sidhistory ✅
  • Properties:allowedtodelegate ✅
  • Properties:adminsdholderprotected ✅
  • Properties:lockedout ✅
  • Properties:passwordexpired ✅
  • Properties:passwordcantchange 🔴 🆕 (not exposed in userAccountControl, verified on ESSOS; lives in the DACL as two denied Change Password ACEs)
  • Properties:smartcardrequired ✅
  • Properties:usedeskeyonly ✅
  • Properties:encryptedtextpwdallowed ✅
  • Properties:logonscriptenabled ✅
  • Properties:reconcile 🔴 🆕 (emitted by SharpHound on well-known / unresolved principals)
  • PrimaryGroupSID ✅
  • AllowedToDelegate:ObjectIdentifier ✅
  • AllowedToDelegate:ObjectType ✅
  • UnconstrainedDelegation ✅
  • HasSIDHistory:ObjectIdentifier ✅
  • HasSIDHistory:ObjectType ✅
  • SPNTargets:ComputerSID ✅
  • SPNTargets:Port ✅
  • SPNTargets:Service ✅
  • DomainSID ✅
  • Aces:PrincipalSID ✅
  • Aces:PrincipalType ✅
  • Aces:RightName ✅
  • Aces:IsInherited ✅
  • Aces:InheritanceHash 🔴
  • Aces:IsPermissionForOwnerRightsSid ✅
  • Aces:IsInheritedPermissionForOwnerRightsSid ✅
  • ObjectIdentifier ✅
  • IsDeleted ✅
  • IsACLProtected ✅
  • ContainedBy:ObjectIdentifier ✅
  • ContainedBy:ObjectType ✅

Group

  • Properties:domain ✅
  • Properties:name ✅
  • Properties:distinguishedname ✅
  • Properties:domainsid ✅
  • Properties:objectguid ✅
  • Properties:doesanyinheritedacegrantownerrights ✅
  • Properties:doesanyacegrantownerrights ✅
  • Properties:isaclprotected ✅ (this value replaces IsACLProtected)
  • Properties:highvalue ✅ (dropped from BloodHound CE, candidate for removal)
  • Properties:samaccountname ✅
  • Properties:description ✅
  • Properties:whencreated ✅
  • Properties:admincount ✅
  • Properties:groupscope ✅
  • Properties:sidhistory ✅
  • Properties:adminsdholderprotected ✅
  • Properties:reconcile 🔴 🆕 (emitted by SharpHound on well-known / unresolved principals)
  • Members:ObjectIdentifier ✅
  • Members:ObjectType ✅
  • HasSIDHistory ✅
  • Aces:PrincipalSID ✅
  • Aces:PrincipalType ✅
  • Aces:RightName ✅
  • Aces:IsInherited ✅
  • Aces:InheritanceHash 🔴
  • Aces:IsPermissionForOwnerRightsSid ✅
  • Aces:IsInheritedPermissionForOwnerRightsSid ✅
  • ObjectIdentifier ✅
  • IsDeleted ✅
  • IsACLProtected ✅
  • ContainedBy:ObjectIdentifier ✅
  • ContainedBy:ObjectType ✅

OU

  • Properties:domain ✅
  • Properties:name ✅
  • Properties:distinguishedname ✅
  • Properties:domainsid ✅
  • Properties:objectguid ✅
  • Properties:doesanyinheritedacegrantownerrights ✅
  • Properties:doesanyacegrantownerrights ✅
  • Properties:isaclprotected ✅ (this value replaces IsACLProtected)
  • Properties:highvalue ✅ (dropped from BloodHound CE, candidate for removal)
  • Properties:description ✅
  • Properties:whencreated ✅
  • Properties:blocksinheritance ✅
  • GPOChanges:LocalAdmins ✅
  • GPOChanges:RemoteDesktopUsers ✅
  • GPOChanges:DcomUsers ✅
  • GPOChanges:PSRemoteUsers ✅
  • GPOChanges:AffectedComputers ✅
  • Links:GUID ✅
  • Links:IsEnforced ✅
  • ChildObjects:ObjectIdentifier ✅
  • ChildObjects:ObjectType ✅
  • InheritanceHashes 🔴 🆕
  • Aces:PrincipalSID ✅
  • Aces:PrincipalType ✅
  • Aces:RightName ✅
  • Aces:IsInherited ✅
  • Aces:InheritanceHash 🔴
  • Aces:IsPermissionForOwnerRightsSid ✅
  • Aces:IsInheritedPermissionForOwnerRightsSid ✅
  • ObjectIdentifier ✅
  • IsDeleted ✅
  • IsACLProtected ✅
  • ContainedBy:ObjectIdentifier ✅
  • ContainedBy:ObjectType ✅

Gpo

  • Properties:domain ✅
  • Properties:name ✅
  • Properties:distinguishedname ✅
  • Properties:domainsid ✅
  • Properties:objectguid ✅
  • Properties:doesanyinheritedacegrantownerrights ✅
  • Properties:doesanyacegrantownerrights ✅
  • Properties:isaclprotected ✅ (this value replaces IsACLProtected)
  • Properties:highvalue ✅ (dropped from BloodHound CE, candidate for removal)
  • Properties:description ✅ (not emitted by SharpHound)
  • Properties:whencreated ✅
  • Properties:gpcpath ✅
  • Properties:gpostatus ✅
  • Aces:PrincipalSID ✅
  • Aces:PrincipalType ✅
  • Aces:RightName ✅
  • Aces:IsInherited ✅
  • Aces:InheritanceHash 🔴
  • Aces:IsPermissionForOwnerRightsSid ✅
  • Aces:IsInheritedPermissionForOwnerRightsSid ✅
  • ObjectIdentifier ✅
  • IsDeleted ✅
  • IsACLProtected ✅
  • ContainedBy:ObjectIdentifier ✅
  • ContainedBy:ObjectType ✅

Container

  • Properties:domain ✅
  • Properties:name ✅
  • Properties:distinguishedname ✅
  • Properties:domainsid ✅
  • Properties:objectguid ✅
  • Properties:doesanyinheritedacegrantownerrights ✅
  • Properties:doesanyacegrantownerrights ✅
  • Properties:isaclprotected ✅ (this value replaces IsACLProtected)
  • Properties:highvalue ✅ (dropped from BloodHound CE, candidate for removal)
  • Properties:description ✅
  • Properties:whencreated ✅
  • ChildObjects:ObjectIdentifier ✅
  • ChildObjects:ObjectType ✅
  • InheritanceHashes 🔴 🆕
  • Aces:PrincipalSID ✅
  • Aces:PrincipalType ✅
  • Aces:RightName ✅
  • Aces:IsInherited ✅
  • Aces:InheritanceHash 🔴
  • Aces:IsPermissionForOwnerRightsSid ✅
  • Aces:IsInheritedPermissionForOwnerRightsSid ✅
  • ObjectIdentifier ✅
  • IsDeleted ✅
  • IsACLProtected ✅
  • ContainedBy:ObjectIdentifier ✅
  • ContainedBy:ObjectType ✅

IssuancePolicies

  • Properties:domain ✅
  • Properties:name ✅
  • Properties:distinguishedname ✅
  • Properties:domainsid ✅
  • Properties:objectguid ✅
  • Properties:doesanyinheritedacegrantownerrights ✅
  • Properties:doesanyacegrantownerrights ✅
  • Properties:isaclprotected ✅ (this value replaces IsACLProtected)
  • Properties:description ✅ (not emitted by SharpHound)
  • Properties:whencreated ✅
  • Properties:displayname ✅
  • Properties:certtemplateoid ✅
  • Properties:oidgrouplink ✅ (when the linked group is in the collected domain)
  • GroupLink:ObjectIdentifier ✅ (when the linked group is in the collected domain, else null)
  • GroupLink:ObjectType ✅ (when the linked group is in the collected domain, else Base)
  • Aces:PrincipalSID ✅
  • Aces:PrincipalType ✅
  • Aces:RightName ✅
  • Aces:IsInherited ✅
  • Aces:InheritanceHash 🔴
  • Aces:IsPermissionForOwnerRightsSid ✅
  • Aces:IsInheritedPermissionForOwnerRightsSid ✅
  • ObjectIdentifier ✅
  • IsDeleted ✅
  • IsACLProtected ✅
  • ContainedBy:ObjectIdentifier 🔴 (emitted as null; SharpHound resolves it on all policies)
  • ContainedBy:ObjectType 🔴

NtAuthStore

  • Properties:domain ✅
  • Properties:name ✅
  • Properties:distinguishedname ✅
  • Properties:domainsid ✅
  • Properties:objectguid ✅
  • Properties:doesanyinheritedacegrantownerrights ✅
  • Properties:doesanyacegrantownerrights ✅
  • Properties:isaclprotected ✅ (this value replaces IsACLProtected)
  • Properties:description ✅ (not emitted by SharpHound)
  • Properties:whencreated ✅
  • Properties:certthumbprints ✅
  • DomainSID ✅ (not emitted by SharpHound)
  • Aces:PrincipalSID ✅
  • Aces:PrincipalType ✅
  • Aces:RightName ✅
  • Aces:IsInherited ✅
  • Aces:InheritanceHash 🔴
  • Aces:IsPermissionForOwnerRightsSid ✅
  • Aces:IsInheritedPermissionForOwnerRightsSid ✅
  • ObjectIdentifier ✅
  • IsDeleted ✅
  • IsACLProtected ✅
  • ContainedBy:ObjectIdentifier ✅
  • ContainedBy:ObjectType ✅

AIACA

  • Properties:domain ✅
  • Properties:name ✅
  • Properties:distinguishedname ✅
  • Properties:domainsid ✅
  • Properties:objectguid ✅
  • Properties:doesanyinheritedacegrantownerrights ✅
  • Properties:doesanyacegrantownerrights ✅
  • Properties:isaclprotected ✅ (this value replaces IsACLProtected)
  • Properties:description ✅ (not emitted by SharpHound)
  • Properties:whencreated ✅
  • Properties:crosscertificatepair 🔴 What value should be added to the output? (x509 cert)
  • Properties:hascrosscertificatepair ✅
  • Properties:certthumbprint ✅
  • Properties:certname ✅
  • Properties:certchain ✅
  • Properties:hasbasicconstraints ✅
  • Properties:basicconstraintpathlength ✅
  • DomainSID ✅ (not emitted by SharpHound)
  • Aces:PrincipalSID ✅
  • Aces:PrincipalType ✅
  • Aces:RightName ✅
  • Aces:IsInherited ✅
  • Aces:InheritanceHash 🔴
  • Aces:IsPermissionForOwnerRightsSid ✅
  • Aces:IsInheritedPermissionForOwnerRightsSid ✅
  • ObjectIdentifier ✅
  • IsDeleted ✅
  • IsACLProtected ✅
  • ContainedBy:ObjectIdentifier ✅
  • ContainedBy:ObjectType ✅

RootCA

  • Properties:domain ✅
  • Properties:name ✅
  • Properties:distinguishedname ✅
  • Properties:domainsid ✅
  • Properties:objectguid ✅
  • Properties:doesanyinheritedacegrantownerrights ✅
  • Properties:doesanyacegrantownerrights ✅
  • Properties:isaclprotected ✅ (this value replaces IsACLProtected)
  • Properties:description ✅ (not emitted by SharpHound)
  • Properties:whencreated ✅
  • Properties:certthumbprint ✅
  • Properties:certname ✅
  • Properties:certchain ✅
  • Properties:hasbasicconstraints ✅
  • Properties:basicconstraintpathlength ✅
  • DomainSID ✅ (not emitted by SharpHound)
  • Aces:PrincipalSID ✅
  • Aces:PrincipalType ✅
  • Aces:RightName ✅
  • Aces:IsInherited ✅
  • Aces:InheritanceHash 🔴
  • Aces:IsPermissionForOwnerRightsSid ✅
  • Aces:IsInheritedPermissionForOwnerRightsSid ✅
  • ObjectIdentifier ✅
  • IsDeleted ✅
  • IsACLProtected ✅
  • ContainedBy:ObjectIdentifier ✅
  • ContainedBy:ObjectType ✅

EnterpriseCA

  • Properties:domain ✅
  • Properties:name ✅
  • Properties:distinguishedname ✅
  • Properties:domainsid ✅
  • Properties:objectguid ✅
  • Properties:doesanyinheritedacegrantownerrights ✅
  • Properties:doesanyacegrantownerrights ✅
  • Properties:isaclprotected ✅ (this value replaces IsACLProtected)
  • Properties:description ✅ (not emitted by SharpHound)
  • Properties:whencreated ✅
  • Properties:flags 🔴 (key is emitted but always an empty string)
  • Properties:caname ✅
  • Properties:dnshostname ✅
  • Properties:certthumbprint ✅
  • Properties:certname ✅
  • Properties:certchain ✅
  • Properties:hasbasicconstraints ✅
  • Properties:basicconstraintpathlength ✅
  • Properties:unresolvedpublishedtemplates 🔴
  • Properties:casecuritycollected ✅
  • Properties:enrollmentagentrestrictionscollected 🔴 linked to RPC for CARegistryData:EnrollmentAgentRestrictions (currently hardcoded to false)
  • Properties:isuserspecifiessanenabledcollected ✅ set from the MS-RRP read of CARegistryData:IsUserSpecifiesSanEnabled
  • Properties:roleseparationenabledcollected ✅ set from the MS-RRP read of CARegistryData:RoleSeparationEnabled
  • HostingComputer ✅
  • EnabledCertTemplates:ObjectIdentifier ✅
  • EnabledCertTemplates:ObjectType ✅
  • CARegistryData:CASecurity ✅ (rebuilt from the LDAP DACL instead of the remote registry)
    • Data:PrincipalSID ✅
    • Data:PrincipalType ✅
    • Data:RightName ✅
    • Data:IsInherited ✅
    • Data:InheritanceHash ✅
    • Data:IsPermissionForOwnerRightsSid ✅
    • Data:IsInheritedPermissionForOwnerRightsSid ✅
    • Collected ✅
    • FailureReason ✅
  • CARegistryData:EnrollmentAgentRestrictions 🔴 src ObjectProcessors.cs (not read yet; emitted as Collected: false with an empty list)
    • Restrictions 🔴
    • Collected 🔴
    • FailureReason 🔴
  • CARegistryData:IsUserSpecifiesSanEnabled ✅ 🆕 src ObjectProcessors.cs (policy module EditFlags read over MS-RRP; password or NT hash only)
    • Value ✅
    • Collected ✅
    • FailureReason ✅
  • CARegistryData:RoleSeparationEnabled ✅ 🆕 (CA configuration RoleSeparationEnabled read over MS-RRP; password or NT hash only)
    • Value ✅
    • Collected ✅
    • FailureReason ✅
  • HttpEnrollmentEndpoints ✅
    • Result:Url ✅
    • Result:Type ✅ (always WebEnrollmentApplication)
    • Result:Status ✅
    • Result:ADCSWebEnrollmentHTTP ✅
    • Result:ADCSWebEnrollmentHTTPS ✅
    • Result:ADCSWebEnrollmentEPA ✅
    • Collected ✅ (true when the port answered or is closed, false when the HTTP exchange failed)
    • FailureReason ✅
    • CES endpoints, /{CAName}_CES_{Kerberos,NTLM}/service.svc/CES with Type: CertificateEnrollmentWebService ✅
  • Aces:PrincipalSID ✅
  • Aces:PrincipalType ✅
  • Aces:RightName ✅
  • Aces:IsInherited ✅
  • Aces:InheritanceHash 🔴
  • Aces:IsPermissionForOwnerRightsSid ✅
  • Aces:IsInheritedPermissionForOwnerRightsSid ✅
  • ObjectIdentifier ✅
  • IsDeleted ✅
  • IsACLProtected ✅
  • ContainedBy:ObjectIdentifier ✅
  • ContainedBy:ObjectType ✅

CertTemplate

  • Properties:domain ✅
  • Properties:name ✅
  • Properties:distinguishedname ✅
  • Properties:domainsid ✅
  • Properties:objectguid ✅
  • Properties:doesanyinheritedacegrantownerrights ✅
  • Properties:doesanyacegrantownerrights ✅
  • Properties:isaclprotected ✅ (this value replaces IsACLProtected)
  • Properties:description ✅ (not emitted by SharpHound)
  • Properties:whencreated ✅
  • Properties:validityperiod ✅
  • Properties:renewalperiod ✅
  • Properties:schemaversion ✅
  • Properties:displayname ✅
  • Properties:oid ✅
  • Properties:enrollmentflag ✅
  • Properties:requiresmanagerapproval ✅
  • Properties:nosecurityextension ✅
  • Properties:certificatenameflag ✅
  • Properties:enrolleesuppliessubject ✅
  • Properties:subjectaltrequireupn ✅
  • Properties:ekus ✅
  • Properties:certificateapplicationpolicy ✅
  • Properties:authorizedsignatures ✅
  • Properties:applicationpolicies ✅
  • Properties:issuancepolicies ✅
  • Properties:effectiveekus ✅
  • Properties:authenticationenabled ✅
  • Properties:subjectaltrequiredns ✅
  • Properties:subjectaltrequiredomaindns ✅
  • Properties:subjectaltrequireemail ✅
  • Properties:subjectaltrequirespn ✅
  • Properties:subjectrequireemail ✅
  • Properties:schannelauthenticationenabled 🔴
  • Properties:certificatepolicy ✅
  • Aces:PrincipalSID ✅
  • Aces:PrincipalType ✅
  • Aces:RightName ✅
  • Aces:IsInherited ✅
  • Aces:InheritanceHash 🔴
  • Aces:IsPermissionForOwnerRightsSid ✅
  • Aces:IsInheritedPermissionForOwnerRightsSid ✅
  • ObjectIdentifier ✅
  • IsDeleted ✅
  • IsACLProtected ✅
  • ContainedBy:ObjectIdentifier ✅
  • ContainedBy:ObjectType ✅

Site

  • Properties:objectclass ✅ 🆕
  • Properties:whencreated ✅ 🆕
  • Properties:objectguid ✅ 🆕
  • Properties:domain ✅ 🆕
  • Properties:name ✅ 🆕
  • Properties:distinguishedname ✅ 🆕
  • Properties:domainsid ✅ 🆕
  • Properties:doesanyacegrantownerrights ✅ 🆕
  • Properties:doesanyinheritedacegrantownerrights ✅ 🆕
  • Properties:isaclprotected ✅ 🆕
  • ChildObjects:ObjectIdentifier ✅ 🆕
  • ChildObjects:ObjectType ✅ 🆕
  • Links:GUID ✅ 🆕
  • Links:IsEnforced ✅ 🆕
  • InheritanceHashes 🔴 🆕
  • Aces:PrincipalSID ✅ 🆕
  • Aces:PrincipalType ✅ 🆕
  • Aces:RightName ✅ 🆕
  • Aces:IsInherited ✅ 🆕
  • Aces:InheritanceHash 🔴 🆕
  • Aces:IsPermissionForOwnerRightsSid ✅ 🆕
  • Aces:IsInheritedPermissionForOwnerRightsSid ✅ 🆕
  • ObjectIdentifier ✅ 🆕
  • IsDeleted ✅ 🆕
  • IsACLProtected ✅ 🆕
  • ContainedBy:ObjectIdentifier ✅ 🆕
  • ContainedBy:ObjectType ✅ 🆕

SiteServer

  • Properties:objectclass ✅ 🆕
  • Properties:whencreated ✅ 🆕
  • Properties:objectguid ✅ 🆕
  • Properties:dnshostname ✅ 🆕
  • Properties:serverreference ✅ 🆕
  • Properties:domain ✅ 🆕
  • Properties:name ✅ 🆕
  • Properties:distinguishedname ✅ 🆕
  • Properties:domainsid ✅ 🆕
  • Properties:doesanyacegrantownerrights ✅ 🆕
  • Properties:doesanyinheritedacegrantownerrights ✅ 🆕
  • Properties:isaclprotected ✅ 🆕
  • ServerIs:ObjectIdentifier ✅ 🆕
  • ServerIs:ObjectType ✅ 🆕
  • Aces:PrincipalSID ✅ 🆕
  • Aces:PrincipalType ✅ 🆕
  • Aces:RightName ✅ 🆕
  • Aces:IsInherited ✅ 🆕
  • Aces:InheritanceHash 🔴 🆕
  • Aces:IsPermissionForOwnerRightsSid ✅ 🆕
  • Aces:IsInheritedPermissionForOwnerRightsSid ✅ 🆕
  • ObjectIdentifier ✅ 🆕
  • IsDeleted ✅ 🆕
  • IsACLProtected ✅ 🆕
  • ContainedBy:ObjectIdentifier ✅ 🆕
  • ContainedBy:ObjectType ✅ 🆕

SiteSubnet

  • Properties:objectclass ✅ 🆕
  • Properties:description ✅ 🆕
  • Properties:whencreated ✅ 🆕
  • Properties:objectguid ✅ 🆕
  • Properties:cn ✅ 🆕
  • Properties:siteobject ✅ 🆕
  • Properties:domain ✅ 🆕
  • Properties:name ✅ 🆕
  • Properties:distinguishedname ✅ 🆕
  • Properties:domainsid ✅ 🆕
  • Properties:doesanyacegrantownerrights ✅ 🆕
  • Properties:doesanyinheritedacegrantownerrights ✅ 🆕
  • Properties:isaclprotected ✅ 🆕
  • Aces:PrincipalSID ✅ 🆕
  • Aces:PrincipalType ✅ 🆕
  • Aces:RightName ✅ 🆕
  • Aces:IsInherited ✅ 🆕
  • Aces:InheritanceHash 🔴 🆕
  • Aces:IsPermissionForOwnerRightsSid ✅ 🆕
  • Aces:IsInheritedPermissionForOwnerRightsSid ✅ 🆕
  • ObjectIdentifier ✅ 🆕
  • IsDeleted ✅ 🆕
  • IsACLProtected ✅ 🆕
  • ContainedBy:ObjectIdentifier ✅ 🆕
  • ContainedBy:ObjectType ✅ 🆕

ACE right names (edges)

Right names produced in the Aces arrays. Existing edge parity is based on SharpHound v2.16.0.0 on the same domain; revalidation against v2.17.1.0 is pending.

  • GenericAll ✅
  • GenericWrite ✅
  • WriteDacl ✅
  • WriteOwner ✅
  • Owns ✅
  • AllExtendedRights ✅
  • AddKeyCredentialLink ✅
  • GetChanges ✅
  • GetChangesAll ✅
  • GetChangesInFilteredSet ✅
  • Enroll ✅
  • AutoEnroll ✅ (not emitted by SharpHound v2.16.0.0)
  • ManageCA ✅
  • ManageCertificates ✅
  • WriteAccountRestrictions 🔴 🆕