Audit rules¶

Generated page

This page is produced from the SMAD-X code (tools/DocGenerator): it lists exactly the 35 rules the application evaluates.

Each failed rule takes points off the score, once whatever the number of objects involved: 12 for a critical rule, 6 high, 3 medium, 1 low. The estimated ANSSI level is the level of the most critical failed control point (5 if none); it is not the official computation of ANSSI's ADS tool.

Kerberos¶

Rule	Severity	ANSSI level	References
KRB-01 Privileged account vulnerable to Kerberoasting	Critical	1	ANSSI · vuln_spn_priv MITRE ATT&CK · T1558.003 NIST · SP 800-53 Rev. 5 AC-6(5) CIS · CIS Controls v8 5.4 Microsoft · Microsoft Learn
KRB-02 User account vulnerable to Kerberoasting	Medium	—	ANSSI · info_spn_present MITRE ATT&CK · T1558.003 NIST · SP 800-53 Rev. 5 IA-5 CIS · CIS Controls v8 5.5 Microsoft · Microsoft Learn
KRB-03 Privileged account without Kerberos preauthentication	Critical	1	ANSSI · vuln_kerberos_properties_preauth_priv MITRE ATT&CK · T1558.004 NIST · SP 800-53 Rev. 5 AC-6(5)
KRB-04 Account without Kerberos preauthentication	High	2	ANSSI · vuln_kerberos_properties_preauth MITRE ATT&CK · T1558.004 NIST · SP 800-53 Rev. 5 IA-5
KRB-05 krbtgt account password too old	High	2	ANSSI · vuln_krbtgt MITRE ATT&CK · T1558.001 NIST · SP 800-53 Rev. 5 IA-5 Microsoft · Microsoft Learn

Delegation¶

Rule	Severity	ANSSI level	References
DLG-01 Unconstrained Kerberos delegation	Critical	1	ANSSI · vuln_delegation_t4d MITRE ATT&CK · T1558 MITRE ATT&CK · T1550.003 NIST · SP 800-53 Rev. 5 AC-6 Microsoft · Microsoft Learn
DLG-02 Constrained delegation with protocol transition to a domain controller	Critical	1	ANSSI · vuln_delegation_t2a4d MITRE ATT&CK · T1558 NIST · SP 800-53 Rev. 5 AC-6 Microsoft · Microsoft Learn
DLG-03 Constrained delegation to a domain controller	Critical	1	ANSSI · vuln_delegation_a2d2 MITRE ATT&CK · T1558 NIST · SP 800-53 Rev. 5 AC-6 Microsoft · Microsoft Learn
DLG-04 Privileged account not protected against delegation	Medium	3	ANSSI · vuln_protected_users MITRE ATT&CK · T1550.003 NIST · SP 800-53 Rev. 5 AC-6(5) Microsoft · Microsoft Learn

Passwords¶

Rule	Severity	ANSSI level	References
PWD-01 Privileged account whose password never expires	Critical	1	ANSSI · vuln_dont_expire_priv NIST · SP 800-53 Rev. 5 AC-6(5) NIST · SP 800-53 Rev. 5 IA-5 NIST · SP 800-63B
PWD-02 Password never expires	High	2	ANSSI · vuln_dont_expire NIST · SP 800-53 Rev. 5 IA-5 NIST · SP 800-63B
PWD-03 Password not required	High	—	MITRE ATT&CK · T1078.002 NIST · SP 800-53 Rev. 5 IA-5 CIS · CIS Controls v8 5.2
PWD-04 Privileged account password unchanged for more than 3 years	Critical	1	ANSSI · vuln_password_change_priv NIST · SP 800-53 Rev. 5 AC-6(5) NIST · SP 800-53 Rev. 5 IA-5
PWD-05 Domain controller machine password unchanged	Critical	1	ANSSI · vuln_password_change_dc_no_change NIST · SP 800-53 Rev. 5 IA-5
PWD-06 Computer account whose password no longer changes	High	2	ANSSI · vuln_password_change_server_no_change_90 NIST · SP 800-53 Rev. 5 AC-2 CIS · CIS Controls v8 5.3
PWD-07 Managed service account whose password no longer changes	High	2	ANSSI · vuln_password_change_msa_no_change_90 NIST · SP 800-53 Rev. 5 IA-5 Microsoft · Microsoft Learn
PWD-08 Domain password policy too short	Medium	—	NIST · SP 800-63B CIS · CIS Controls v8 5.2 NIST · SP 800-53 Rev. 5 IA-5
PWD-09 Privileged account with a weak password policy	High	2	ANSSI · vuln_privileged_members_password NIST · SP 800-63B NIST · SP 800-53 Rev. 5 AC-6(5)

Accounts¶

Rule	Severity	ANSSI level	References
ACC-03 Any user can join computers to the domain	Low	4	ANSSI · vuln_user_accounts_machineaccountquota Microsoft · Microsoft Learn MITRE ATT&CK · T1136.002 NIST · SP 800-53 Rev. 5 AC-2
ACC-01 Active Guest account	High	2	ANSSI · vuln_guest NIST · SP 800-53 Rev. 5 AC-2 MITRE ATT&CK · T1078.002
ACC-02 Dormant account	Medium	—	ANSSI · info_user_accounts_dormant CIS · CIS Controls v8 5.3 NIST · SP 800-53 Rev. 5 AC-2 MITRE ATT&CK · T1078.002

Privileged groups¶

Rule	Severity	ANSSI level	References
PRIV-01 Privileged group member without adminCount	High	2	ANSSI · vuln_privileged_members_no_admincount Microsoft · Microsoft Learn NIST · SP 800-53 Rev. 5 AC-6(5)
PRIV-02 Orphaned adminCount	Low	—	ANSSI · warning_admincount Microsoft · Microsoft Learn NIST · SP 800-53 Rev. 5 AC-2
PRIV-03 Privileged group that should be empty	Medium	3	ANSSI · warning_privileged_members_not_empty Microsoft · Microsoft Learn NIST · SP 800-53 Rev. 5 AC-6(5) CIS · CIS Controls v8 5.4
PRIV-04 Non-privileged member of the DnsAdmins group	Critical	1	ANSSI · vuln_dnsadmins Microsoft · Microsoft Learn NIST · SP 800-53 Rev. 5 AC-6
PRIV-05 Protected group classified outside Tier 0	Medium	—	Microsoft · Microsoft Learn ANSSI · ANSSI-PA-099 Microsoft · Microsoft Learn

Owners and permissions¶

Rule	Severity	ANSSI level	References
ACL-01 Critical object with an inappropriate owner	Medium	3	ANSSI · vuln_owner MITRE ATT&CK · T1222.001 MITRE ATT&CK · T1098 NIST · SP 800-53 Rev. 5 AC-6
ACL-02 Control path to the domain through permissions	High	2	ANSSI · vuln_privileged_members_perm ANSSI · vuln_permissions_gpo_container_priv ANSSI · ANSSI-PA-099 MITRE ATT&CK · T1222.001 MITRE ATT&CK · T1098 NIST · SP 800-53 Rev. 5 AC-6 Microsoft · Microsoft Learn
ACL-03 Dangerous permissions on the domain, AdminSDHolder or the domain controllers	Critical	1	ANSSI · vuln_permissions_naming_context ANSSI · vuln_permissions_adminsdholder ANSSI · vuln_permissions_dc MITRE ATT&CK · T1003.006 MITRE ATT&CK · T1222.001 NIST · SP 800-53 Rev. 5 AC-6 Microsoft · Microsoft Learn

Tiering¶

Rule	Severity	ANSSI level	References
TIER-01 Tiering violation: membership in a more sensitive group	High	—	ANSSI · ANSSI-PA-099 Microsoft · Microsoft Learn NIST · SP 800-53 Rev. 5 AC-5 NIST · SP 800-53 Rev. 5 AC-6 CIS · CIS Controls v8 6.8
TIER-02 Tiering violation: GPO from a less sensitive tier	High	—	ANSSI · vuln_permissions_gpo_priv ANSSI · ANSSI-PA-099 MITRE ATT&CK · T1484.001 Microsoft · Microsoft Learn
TIER-03 Tiering violation: delegation to a less sensitive tier	High	—	ANSSI · vuln_privileged_members_perm ANSSI · ANSSI-PA-099 MITRE ATT&CK · T1098 NIST · SP 800-53 Rev. 5 AC-6 Microsoft · Microsoft Learn
TIER-04 Privileged account logged on to a less sensitive machine	High	—	ANSSI · ANSSI-PA-099 ANSSI · vuln_silo_priv MITRE ATT&CK · T1003.001 Microsoft · Microsoft Learn Microsoft · Microsoft Learn NIST · SP 800-53 Rev. 5 AC-5

Workstations and servers¶

Rule	Severity	ANSSI level	References
LAPS-01 Computer without LAPS	Medium	—	Microsoft · Microsoft Learn MITRE ATT&CK · T1078.003 MITRE ATT&CK · T1550.002 CIS · CIS Controls v8 5.2 NIST · SP 800-53 Rev. 5 IA-5

Groups¶

Rule	Severity	ANSSI level	References
GRP-01 Group nesting loop	Low	4	ANSSI · vuln_group_loop NIST · SP 800-53 Rev. 5 AC-2