itm4n-PrivescCheck/data/Checks.csv

"Id",                              "Command",                                     "Category",                      "DisplayName",                                      "Severity", "Format", "Type",         "RunIfAdmin", "Risky", "Description"
"USER_USER",                       "Invoke-UserCheck",                            "TA0043 - Reconnaissance",       "User - Identity",                                  "None",     "List",   "Base",         "True",       "False", "Get information about the current user (name, domain name) and its access token (SID, integrity level, authentication ID)."
"USER_GROUPS",                     "Invoke-UserGroupCheck",                       "TA0043 - Reconnaissance",       "User - Groups",                                    "None",     "Table",  "Base",         "True",       "False", "Get information about the groups the current user belongs to (name, type, SID)."
"USER_RESTRICTED_SIDS",            "Invoke-UserRestrictedSidCheck",               "TA0043 - Reconnaissance",       "User - Restricted SIDs",                           "None",     "Table",  "Extended",     "True",       "False", "Get information about potential restricted SIDs applied to the current user."
"USER_PRIVILEGES",                 "Invoke-UserPrivilegeCheck",                   "TA0004 - Privilege Escalation", "User - Privileges",                                "High",     "Table",  "Base",         "False",      "False", "Check whether the current user is granted privileges that can be leveraged for local privilege escalation."
"USER_PRIVILEGES_GPO",             "Invoke-UserPrivilegeGpoCheck",                "TA0004 - Privilege Escalation", "User - Privileges (GPO)",                          "High",     "List",   "Base",         "False",      "False", "Check whether the current user is granted privileges, through a group policy, that can be leveraged for local privilege escalation."
"USER_ENV",                        "Invoke-UserEnvironmentCheck",                 "TA0006 - Credential Access",    "User - Environment Variables",                     "None",     "Table",  "Base",         "True",       "False", "Check whether any environment variables contain sensitive information such as credentials or secrets. Note that this check follows a keyword-based approach and thus might not be completely reliable."
"SERVICE_INSTALLED",               "Invoke-InstalledServiceCheck",                "TA0004 - Privilege Escalation", "Services - Non-Default Services",                  "None",     "List",   "Base",         "True",       "False", "Get information about third-party services. It does so by parsing the target executable's metadata and checking whether the publisher is Microsoft."
"SERVICE_THIRD_PARTY",             "Invoke-ThirdPartyDriverCheck",                "TA0004 - Privilege Escalation", "Services - Non-Default Kernel Drivers",            "None",     "List",   "Extended",     "True",       "False", "Get information about third-party kernel drivers. It does so by parsing the driver's metadata and checking whether the publisher is Microsoft."
"SERVICE_VULN_DRIVER",             "Invoke-VulnerableDriverCheck",                "TA0004 - Privilege Escalation", "Services - Known Vulnerable Kernel Drivers",       "High",     "List",   "Base",         "True",       "False", "Check whether known vulnerable kernel drivers are installed. It does so by computing the file hash of each driver and comparing the value against the list provided by loldrivers.io."
"SERVICE_KERNEL_DEVICES",          "Invoke-NamedKernelDeviceCheck",               "TA0004 - Privilege Escalation", "Services - Named Kernel Device Permissions",       "None",     "List",   "Extended",     "False",      "False", "Get information about named Kernel devices for which low-privileged users are granted write access. This can be helpful as a first step to identify exploitable drivers."
"SERVICE_PERMISSIONS",             "Invoke-ServicePermissionCheck",               "TA0004 - Privilege Escalation", "Services - Permissions",                           "High",     "List",   "Base",         "False",      "False", "Check whether the current user has any write permissions on a service through the Service Control Manager (SCM)."
"SERVICE_PERMISSIONS_REGISTRY",    "Invoke-ServiceRegistryPermissionCheck",       "TA0004 - Privilege Escalation", "Services - Registry Permissions",                  "High",     "List",   "Base",         "False",      "False", "Check whether the current user has any write permissions on the configuration of a service in the registry."
"SERVICE_IMAGE_PERMISSIONS",       "Invoke-ServiceImagePermissionCheck",          "TA0004 - Privilege Escalation", "Services - Image File Permissions",                "High",     "List",   "Base",         "False",      "False", "Check whether the current user has any write permissions on a service's binary or its folder."
"SERVICE_UNQUOTED_PATH",           "Invoke-ServiceUnquotedPathCheck",             "TA0004 - Privilege Escalation", "Services - Unquoted Paths",                        "High",     "List",   "Base",         "False",      "False", "Check whether there are services configured with an exploitable unquoted path that contains spaces."
"SERVICE_SCM_PERMISSIONS",         "Invoke-ServiceControlManagerPermissionCheck", "TA0004 - Privilege Escalation", "Services - Service Control Manager Permissions",   "High",     "List",   "Base",         "False",      "False", "Check whether the current user has any write permissions on the Service Control Manager (SCM)."
"SERVICE_HARDCODED_CREDS",         "Invoke-ServiceCredentialCheck",               "TA0006 - Credential Access",    "Services - Hardcoded Credentials",                 "Low",      "List",   "Extended",     "True",       "False", "Check whether there are services configured with hardcoded credentials, in which case the service account's password is likely to be stored in a reversible format in the registry, and can be extracted with administrator privileges."
"APP_INSTALLED",                   "Invoke-InstalledApplicationCheck",            "TA0043 - Reconnaissance",       "Applications - Microsoft",                         "None",     "Table",  "Extended",     "True",       "False", "Get information about Microsoft applications installed on the machine by searching the registry and the default install locations."
"APP_INSTALLED_THIRD_PARTY",       "Invoke-InstalledApplicationThirdPartyCheck",  "TA0043 - Reconnaissance",       "Applications - Third-Party",                       "None",     "Table",  "Extended",     "True",       "False", "Get information about third-party applications installed on the machine by searching the registry and the default install locations."
"APP_MODIFIABLE",                  "Invoke-InstalledApplicationPermissionCheck",  "TA0004 - Privilege Escalation", "Applications - File Permissions",                  "Medium",   "List",   "Extended",     "False",      "False", "Check whether the current user has any write permissions on non-default or third-party applications."
"APP_PROGRAMDATA",                 "Invoke-ProgramDataPermissionCheck",           "TA0004 - Privilege Escalation", "Applications - ProgramData Folder Permissions",    "Low",      "List",   "Experimental", "False",      "False", "Check whether the current user has any write permissions on a non-default 'ProgramData' folder. This check is purely informative and the results require manual analysis."
"APP_ROOT_FOLDER_PERMISSIONS",     "Invoke-RootFolderPermissionCheck",            "TA0004 - Privilege Escalation", "Applications - Root Folder Permissions",           "Low",      "List",   "Extended",     "False",      "False", "Check whether the current user has any modification right on or within a folder located at the root of a 'fixed' drive."
"APP_STARTUP",                     "Invoke-StartupApplicationPermissionCheck",    "TA0004 - Privilege Escalation", "Applications - Startup Application Permissions",   "Medium",   "List",   "Extended",     "False",      "False", "Check whether the current user has any write permissions on system-wide applications that are run at startup for all users."
"APP_PROCESSES",                   "Invoke-RunningProcessCheck",                  "TA0043 - Reconnaissance",       "Applications - Running Processes",                 "None",     "Table",  "Extended",     "True",       "False", "Get information about the currently running processes that are not owned by the current user. Processes such as 'svchost.exe' are filtered out."
"SCHTASKS_IMAGE_PERMISSIONS",      "Invoke-ScheduledTaskImagePermissionCheck",    "TA0004 - Privilege Escalation", "Scheduled Tasks - Image File Permissions",         "High",     "List",   "Base",         "False",      "False", "Check whether the current user has any write permissions on a scheduled task's binary or its folder. Note that low-privileged users cannot list all the scheduled tasks."
"SCHTASKS_UNQUOTED_PATH",          "Invoke-ScheduledTaskUnquotedPathCheck",       "TA0004 - Privilege Escalation", "Scheduled Tasks - Unquoted Paths",                 "Medium",   "List",   "Experimental", "False",      "False", "Check whether there are scheduled tasks configured with an exploitable unquoted path. Note that low-privileged users cannot list all the scheduled tasks."
"SCHTASKS_HARDCODED_CREDS",        "Invoke-ScheduledTaskCredentialCheck",         "TA0006 - Credential Access",    "Scheduled Tasks - Hardcoded Credentials",          "Low",      "List",   "Extended",     "True",       "False", "Check whether there are scheduled tasks configured with hardcoded credentials (logon type 'Password'), in which case the user account's password is stored in a reversible format in the registry, and can be extracted with administrator privileges."
"CREDS_SENSITIVE_HIVE_FILES",      "Invoke-HiveFilePermissionCheck",              "TA0006 - Credential Access",    "Credentials - Hive File Permissions",              "Medium",   "List",   "Base",         "False",      "False", "Check whether the current user has read permissions on the SAM/SYSTEM/SECURITY hive files, either in the system folder or in volume shadow copies (CVE-2021-36934 - HiveNightmare)."
"CREDS_UNATTEND",                  "Invoke-UnattendFileCredentialCheck",          "TA0006 - Credential Access",    "Credentials - Unattend Files",                     "Medium",   "List",   "Base",         "True",       "False", "Check whether there are any 'unattend' files and whether they contain clear-text credentials."
"CREDS_WINLOGON",                  "Invoke-WinLogonCredentialCheck",              "TA0006 - Credential Access",    "Credentials - WinLogon",                           "Medium",   "List",   "Base",         "True",       "False", "Check whether the 'WinLogon' registry key contains clear-text credentials. Note that entries with an empty password field are filtered out."
"CREDS_CRED_MASTER_KEYS",          "Invoke-CredentialMasterKeyCheck",             "TA0006 - Credential Access",    "Credentials - DPAPI Master Keys",                  "None",     "List",   "Extended",     "True",       "False", "Get information about the current user's DPAPI master keys."
"CREDS_CRED_FILES",                "Invoke-CredentialFileCheck",                  "TA0006 - Credential Access",    "Credentials - DPAPI Credential Files",             "None",     "List",   "Extended",     "True",       "False", "Get information about the current user's DPAPI credential files."
"CREDS_VAULT_CRED",                "Invoke-CredentialCheck",                      "TA0006 - Credential Access",    "Credentials - Vault (creds)",                      "None",     "List",   "Base",         "True",       "True",  "Check whether the current user's credential vault contains any clear-text Windows passwords."
"CREDS_VAULT_LIST",                "Invoke-VaultCheck",                           "TA0006 - Credential Access",    "Credentials - Vault (list)",                       "None",     "List",   "Base",         "True",       "True",  "Check whether the current user's credential vault contains any clear-text web passwords."
"CREDS_GPP",                       "Invoke-GPPCredentialCheck",                   "TA0006 - Credential Access",    "Credentials - Group Policy Preferences (GPP)",     "Medium",   "List",   "Base",         "True",       "False", "Check whether there are cached Group Policy Preference (GPP) files that contain clear-text passwords."
"CREDS_PS_HIST",                   "Invoke-PowerShellHistoryCredentialCheck",     "TA0006 - Credential Access",    "Credentials - PowerShell History",                 "None",     "List",   "Extended",     "True",       "False", "Check whether the current user's PowerShell history contains any clear-text credentials. Note that this check follows a keyword-based approach and thus might not be completely reliable."
"CREDS_SCCM_NAA",                  "Invoke-SccmNaaCredentialCheck",               "TA0006 - Credential Access",    "Credentials - SCCM Network Access Account (NAA)",  "Medium",   "List",   "Base",         "True",       "False", "Check whether SCCM NAA credentials are stored in the WMI repository. If so, the username and password DPAPI blobs are returned, but can only be decrypted using the SYSTEM's DPAPI user key."
"CREDS_SCCM_CACHE_FOLDERS",        "Invoke-SccmCacheFolderCredentialCheck",       "TA0006 - Credential Access",    "Credentials - SCCM Cache Folder",                  "Low",      "List",   "Base",         "True",       "False", "Check whether the SCCM cache folders contain files with potentially hard coded credentials, or secrets, using basic keywords such as 'password', or 'secret'."
"CREDS_SMA_ACC",                   "Invoke-SmaAgentConnectivityCredentialCheck",  "TA0006 - Credential Access",    "Credentials - Symantec Account Connectivity ",     "Medium",   "List",   "Base",         "True",       "False", "Check whether a Symantec Management Agent (SMA) is installed and whether Account Connectivity Credentials (ACCs) are stored locally."
"CREDS_SCOM_RUN_AS",               "Invoke-ScomRunAsAccountCredentialCheck",      "TA0006 - Credential Access",    "Credentials - SCOM Run As Account",                "Medium",   "List",   "Base",         "True",       "False", "Check whether the event logs contain traces of SCOM Run As accounts being used locally. If so, the clear-text credentials of those accounts can be extracted from the registry with administrator privileges."
"CREDS_VNC",                       "Invoke-VncCredentialCheck",                   "TA0006 - Credential Access",    "Credentials - VNC Server Password",                "Medium",   "List",   "Extended",     "True",       "False", "Check whether a well-known VNC server (RealVNC, TigerVNC, TightVNC, UltraVNC) is installed. If so, it attempts to read and decrypt the encrypted password. Note that this might require administrator privileges."
"CREDS_CERTIFICATES",              "Invoke-PersonalCertificateCheck",             "TA0006 - Credential Access",    "Credentials - Personal Certificates",              "None",     "List",   "Extended",     "True",       "False", "Get information about machine and user personal certificates. Those certificates can be found in the registry and on the filesystem in each user's home folder."
"HARDEN_UAC",                      "Invoke-UserAccountControlCheck",              "TA0008 - Lateral Movement",     "Hardening - User Account Control (UAC)",           "Low",      "List",   "Audit",        "True",       "False", "Check whether User Access Control (UAC) is enabled and whether it filters the access token of local administrator accounts when they authenticate remotely."
"HARDEN_NAME_RESOLUTION",          "Invoke-NameResolutionProtocolCheck",          "TA0006 - Credential Access",    "Hardening - Name Resolution Protocols",            "Low",      "List",   "Audit",        "True",       "False", "Check whether broadcast and multicast name resolution protocols are disabled."
"HARDEN_IPV6",                     "Invoke-Ipv6ConfigurationCheck",               "TA0006 - Credential Access",    "Hardening - IPv6 Configuration",                   "Low",      "List",   "Audit",        "True",       "False", "Check whether IPv6 is disabled globally. Disabling IPv6 aims at limiting the risk of credential stealing by preventing DHCPv6 poisoning attacks."
"HARDEN_LSA_PROTECTION",           "Invoke-LsaProtectionCheck",                   "TA0006 - Credential Access",    "Hardening - LSA Protection",                       "Low",      "List",   "Base",         "True",       "False", "Check whether LSA protection is enabled. Note that when LSA protection is enabled, 'lsass.exe' runs as a Protected Process Light (PPL) and thus can only be accessed by other protected processes with an equivalent or higher protection level."
"HARDEN_CREDENTIAL_GUARD",         "Invoke-CredentialGuardCheck",                 "TA0006 - Credential Access",    "Hardening - Credential Guard",                     "Low",      "List",   "Base",         "True",       "False", "Check whether Credential Guard is supported and enabled. Note that when Credential Guard is enabled, credentials are stored in an isolated process ('LsaIso.exe') that cannot be accessed, even if the kernel is compromised."
"HARDEN_ASR_RULES",                "Invoke-AttackSurfaceReductionRuleCheck",      "TA0005 - Defense Evasion",      "Hardening - Attack Surface Reduction (ASR)",       "None",     "List",   "Extended",     "True",       "False", "Get information about configured Windows Defender Exploit Guard Attack Surface Reduction (ASR) rules."
"HARDEN_BIOS_MODE",                "Invoke-BiosModeCheck",                        "TA0003 - Persistence",          "Hardening - UEFI & Secure Boot",                   "Low",      "Table",  "Extended",     "True",       "False", "Check whether UEFI and Secure Boot are supported and enabled. Note that Secure Boot requires UEFI."
"HARDEN_LAPS",                     "Invoke-LapsCheck",                            "TA0008 - Lateral Movement",     "Hardening - LAPS",                                 "Medium",   "List",   "Base",         "True",       "False", "Check whether LAPS is configured and enabled. Note that this applies to domain-joined machines only."
"HARDEN_PS_SECURITY_FEATURES",     "Invoke-PowerShellSecurityFeatureCheck",       "TA0002 - Execution",            "Hardening - PowerShell Security Features",         "Low",      "List",   "Audit",        "True",       "False", "Check whether PowerShell security features are configured and enabled."
"MISC_TPM_DEVICE_INFO",            "Invoke-TpmDeviceInformationCheck",            "TA0043 - Reconnaissance",       "Misc - TPM Device Information",                    "None",     "List",   "Extended",     "True",       "False", "Get information about the machine's Trusted Platform Module (TPM), if present."
"HARDEN_BITLOCKER",                "Invoke-BitLockerCheck",                       "TA0001 - Initial Access",       "Hardening - BitLocker",                            "Medium",   "List",   "Base",         "True",       "False", "Check whether BitLocker is enabled on the system drive and requires a second factor of authentication (PIN or startup key). Note that this check might yield a false positive if a third-party drive encryption software is installed."
"HARDEN_APPLOCKER",                "Invoke-AppLockerCheck",                       "TA0005 - Defense Evasion",      "Hardening - AppLocker",                            "Low",      "List",   "Audit",        "True",       "False", "Check whether an AppLocker policy is enforced."
"HARDEN_APPLOCKER_POLICY",         "Invoke-AppLockerPolicyCheck",                 "TA0005 - Defense Evasion",      "Hardening - AppLocker Policy",                     "Low",      "List",   "Extended",     "False",      "False", "Check whether AppLocker rules can be exploited, in the context of the current user, to execute arbitrary code."
"HARDEN_FILE_EXTENSION_ASSOC",     "Invoke-FileExtensionAssociationCheck",        "TA0001 - Initial Access",       "Hardening - File Extension Associations",          "Low",      "Table",  "Audit",        "True",       "False", "Check whether file extensions such as '.bat' or '.wsh' are associated to a text editor. Note that only basic text editors such as 'Notepad' are detected. If a rich text editor is set instead, this check could yield false positives."
"HARDEN_HIDDEN_FILE_EXTENSIONS",   "Invoke-HiddenFilenameExtensionCheck",         "TA0001 - Initial Access",       "Hardening - Hidden File Name Extensions",          "Low",      "List",   "Audit",        "True",       "False", "Check whether extensions of known file types are shown or hidden in the Explorer."
"HARDEN_DEFAULT_LOCAL_ADMIN",      "Invoke-DefaultLocalAdministratorAccountCheck","TA0008 - Lateral Movement",     "Hardening - Default Local Administrator Account",  "Low",      "List",   "Audit",        "True",       "False", "Check whether the default local administrator account is disabled."
"HARDEN_CLICKONCE_PROMPT",         "Invoke-ClickOnceTrustPromptBehaviorCheck",    "TA0001 - Initial Access",       "Hardening - ClickOnce Trust Prompt Behavior",      "Low",      "List",   "Audit",        "True",       "False", "Check whether users are allowed to execute ClickOnce applications from the 'Internet' zone."
"HARDEN_OFFICE_MACROS",            "Invoke-OfficeMacroConfigurationCheck",        "TA0001 - Initial Access",       "Hardening - MS Office Macro Settings",             "Low",      "List",   "Audit",        "True",       "False", "Check whether Office macros are enabled or disabled with a notification."
"HARDEN_OFFICE_PROTECTED_VIEW",    "Invoke-OfficeProtectedViewConfigurationCheck","TA0001 - Initial Access",       "Hardening - MS Office Protected View Settings",    "Low",      "List",   "Audit",        "True",       "False", "Check whether Office Protected View is enabled on all supported applications."
"HARDEN_OFFICE_TRUSTED_LOCATIONS", "Invoke-OfficeTrustedLocationsCheck",          "TA0001 - Initial Access",       "Hardening - MS Office Trusted Locations",          "Low",      "List",   "Audit",        "True",       "False", "Check whether Office Trusted Locations are enabled and whether they contain any directory modifiable as the current user."
"CONFIG_PATH_FOLDERS",             "Invoke-DllHijackingCheck",                    "TA0004 - Privilege Escalation", "Configuration - PATH Folder Permissions",          "High",     "List",   "Base",         "False",      "False", "Check whether the current user has any write permissions on the system-wide PATH folders. If so, the system could be vulnerable to privilege escalation through ghost DLL hijacking."
"MISC_HIJACKABLE_DLL",             "Invoke-HijackableDllCheck",                   "TA0004 - Privilege Escalation", "Misc - Known Ghost DLLs",                          "None",     "List",   "Base",         "False",      "False", "Get information about services that are known to be prone to ghost DLL hijacking. Note that their exploitation requires the current user to have write permissions on at least one system-wide PATH folder."
"CONFIG_CREDENTIAL_DELEGATION",    "Invoke-CredentialDelegationCheck",            "TA0006 - Credential Access",    "Configuration - Credential Delegation",            "Medium",   "List",   "Extended",     "True",       "False", "Check whether Credential Delegation is enabled. If so, passwords are very likely to be stored in clear-text in memory, unless another setting prevents that. Note that LSA Protection is not sufficient to protect credentials in this case."
"CONFIG_NTLM_DOWNGRADE",           "Invoke-NtlmDowngradeAttackCheck",             "TA0004 - Privilege Escalation", "Configuration - NTLM Downgrade (NTLMv1)",          "High",     "List",   "Base",         "True",       "False", "Check whether the machine is vulnerable to NTLM downgrade attacks. If so, a local or remote attacker could capture the NTLMv1 authentication of the computer account (or another authenticated user), and recover its NT hash offline."
"CONFIG_MSI",                      "Invoke-RegistryAlwaysInstallElevatedCheck",   "TA0004 - Privilege Escalation", "Configuration - MSI AlwaysInstallElevated",        "High",     "List",   "Base",         "False",      "False", "Check whether the 'AlwaysInstallElevated' policy is enabled system-wide and for the current user. If so, the current user may install a Windows Installer package with elevated (SYSTEM) privileges."
"CONFIG_WSUS",                     "Invoke-WsusConfigurationCheck",               "TA0008 - Lateral Movement",     "Configuration - WSUS",                             "High",     "List",   "Base",         "True",       "False", "Check whether WSUS uses the HTTPS protocol to retrieve updates from the on-premise update server. If WSUS uses the clear-text HTTP protocol, it is vulnerable to MitM attacks that may result in remote code execution as SYSTEM."
"CONFIG_HARDENED_UNC_PATHS",       "Invoke-HardenedUNCPathCheck",                 "TA0008 - Lateral Movement",     "Configuration - Hardened UNC Paths",               "Medium",   "List",   "Base",         "True",       "False", "Check whether sensitive UNC paths are properly hardened. Note that non-hardened UNC paths used for retrieving group policies can be hijacked through an MitM attack to obtain remote code execution as SYSTEM."
"CONFIG_SMB",                      "Invoke-SmbConfigurationCheck",                "TA0008 - Lateral Movement",     "Configuration - SMB",                              "Low",      "List",   "Audit",        "True",       "False", "Check whether SMBv1 is enabled (server), and whether signing is required (server and client)."
"CONFIG_PRINTNIGHTMARE",           "Invoke-PointAndPrintConfigurationCheck",      "TA0004 - Privilege Escalation", "Configuration - Point and Print",                  "High",     "List",   "Base",         "True",       "False", "Check whether the Print Spooler service is enabled and if the Point and Print configuration allows non-administrator users to install printer drivers."
"CONFIG_MSI_REPAIR_UAC_PROMPT",    "Invoke-MsiAutomaticRepairUacPromptCheck",     "TA0004 - Privilege Escalation", "Configuration - Application Repair UAC Prompt",    "Medium",   "List",   "Extended",     "True",       "False", "Check whether the UAC prompt displayed when attempting an application repair through the Windows Installer was disabled."
"CONFIG_MSI_REPAIR_WHITELIST",     "Invoke-MsiAutomaticRepairWhitelistCheck",     "TA0004 - Privilege Escalation", "Configuration - Application Repair Whitelist",     "Low",      "List",   "Base",         "True",       "False", "Check whether a whitelist of MSI packages is set in the registry to disable UAC prompts, and whether they have custom actions that may be leveraged for local privilege escalation."
"CONFIG_COINSTALLERS",             "Invoke-DriverCoInstallerCheck",               "TA0004 - Privilege Escalation", "Configuration - Driver Co-Installers",             "Low",      "List",   "Audit",        "True",       "False", "Check whether Driver Co-installers are disabled. A local user might be able to gain SYSTEM privileges by plugging in a device such as a mouse or keyboard with a vulnerable Driver Co-installer."
"CONFIG_SCCM_CACHE_FOLDERS",       "Invoke-SccmCacheFolderCheck",                 "TA0043 - Reconnaissance",       "Configuration - SCCM Cache Folders",               "None",     "List",   "Extended",     "True",       "False", "Get information about SCCM cache folders (incl. number and list of binary, script, and text files)."
"CONFIG_COM_REGISTRY_PERMISSIONS", "Invoke-ComServerRegistryPermissionCheck",     "TA0004 - Privilege Escalation", "Configuration - COM registry permissions",         "Medium",   "List",   "Extended",     "False",      "False", "Check whether the current user has any modification rights on a COM server in the registry. This may not necessarily result in a privilege escalation. Further analysis is required."
"CONFIG_COM_IMAGE_PERMISSIONS",    "Invoke-ComServerImagePermissionCheck",        "TA0004 - Privilege Escalation", "Configuration - COM Image File Permissions",       "Medium",   "List",   "Extended",     "False",      "False", "Check whether the current user has any modification rights on a COM server module file. This may not necessarily result in a privilege escalation. Further analysis is required."
"CONFIG_COM_GHOST_DLL",            "Invoke-ComServerGhostDllHijackingCheck",      "TA0004 - Privilege Escalation", "Configuration - COM Server Ghost DLLs",            "Medium",   "List",   "Extended",     "True",       "False", "Check whether there are COM servers registered with a non-existent module using a relative path. This may not necessarily result in a privilege escalation. You would also need to have rights to create files in a PATH folder. Further analysis is required."
"CONFIG_COM_MISSING_MODULE",       "Invoke-ComServerMissingModuleFileCheck",      "TA0003 - Persistence",          "Configuration - COM Missing Image Files",          "Low",      "List",   "Extended",     "True",       "False", "Check whether there are leftover COM servers registered with non-existent modules. Such issues could be leveraged for lateral movement or persistence."
"CONFIG_PROXY_AUTO_CONFIG",        "Invoke-ProxyAutoConfigurationCheck",          "TA0001 - Initial Access",       "Configuration - Proxy Auto-Configuration (PAC)",   "Low",      "List",   "Audit",        "True",       "False", "Check whether Web Proxy Auto-Discovery (WPAD) is enabled, and whether a Proxy Auto-Configuration (PAC) file is distributed over HTTPS."
"CONFIG_DEFENDER_EXCLUSIONS",      "Invoke-DefenderExclusionCheck",               "TA0005 - Defense Evasion",      "Configuration - Windows Defender Exclusions",      "None",     "Table",  "Extended",     "True",       "False", "Get information about the exclusions configured in Microsoft Defender."
"CONFIG_MDE_SETTINGS",             "Invoke-DefenderForEndpointConfigurationCheck","TA0005 - Defense Evasion",      "Configuration - MDE State and Settings",           "None",     "List",   "Extended",     "True",       "False", "Get information about Microsoft Defender for Endpoint state and configuration."
"NET_FIREWALL_PROFILES",           "Invoke-NetworkFirewallProfileCheck",          "TA0008 - Lateral Movement",     "Network - Windows Firewall Profiles",              "Low",      "List",   "Audit",        "True",       "False", "Check whether the Windows firewall is enabled on each network profile (domain, private, public)."
"NET_ADAPTERS",                    "Invoke-NetworkAdapterCheck",                  "TA0043 - Reconnaissance",       "Network - Interfaces",                             "None",     "List",   "Extended",     "True",       "False", "Get information about all active Ethernet adapters."
"NET_TCP_ENDPOINTS",               "Invoke-TcpEndpointCheck",                     "TA0004 - Privilege Escalation", "Network - TCP Endpoints",                          "None",     "Table",  "Extended",     "False",      "False", "Get information about all the TCP ports that are in a LISTEN state. Note that the associated process is also listed."
"NET_UDP_ENDPOINTS",               "Invoke-UdpEndpointCheck",                     "TA0004 - Privilege Escalation", "Network - UDP Endpoints",                          "None",     "Table",  "Extended",     "True",       "False", "Get information about all the UDP ports that are in a LISTEN state. Note that the associated process is also listed. DNS is filtered out to minimize the output."
"NET_WLAN",                        "Invoke-WlanProfileCheck",                     "TA0001 - Initial Access",       "Network - Wi-Fi Profiles",                         "Low",      "List",   "Extended",     "True",       "False", "Get information about saved Wi-Fi profiles. Clear-text pre-shared keys (PSK) are displayed when possible, and potentially vulnerable 802.1x profiles are listed."
"NET_AIRSTRIKE",                   "Invoke-AirstrikeAttackCheck",                 "TA0001 - Initial Access",       "Network - Network Selection From Lock Screen",     "Low",      "List",   "Extended",     "True",       "False", "Check whether the 'Do not display network selection UI' policy is enabled on workstations (CVE-2021-28316 - Airstrike attack)."
"UPDATE_HISTORY",                  "Invoke-WindowsUpdateCheck",                   "TA0004 - Privilege Escalation", "Updates - Last Windows Update Date",               "None",     "Table",  "Extended",     "True",       "False", "Get information about the latest Windows update. Note that this check might be unreliable."
"UPDATE_HOTFIX",                   "Invoke-HotFixCheck",                          "TA0004 - Privilege Escalation", "Updates - Update History",                         "Medium",   "Table",  "Base",         "True",       "False", "Check whether a Windows security update was installed within the last 31 days."
"UPDATE_BIOS_RELEASE_DATE",        "Invoke-BiosUpdateCheck",                      "TA0001 - Initial Access",       "Updates - BIOS Release Date",                      "Low",      "List",   "Audit",        "True",       "False", "Check whether the BIOS was installed or updated in the last 180 days."
"MISC_LEAKED_HANDLES",             "Invoke-ExploitableLeakedHandleCheck",         "TA0004 - Privilege Escalation", "Misc - Exploitable Leaked Handles",                "Medium",   "List",   "Extended",     "False",      "False", "Check whether the current user has access to a process that contains a leaked handle to a privileged process, thread, or file object."
"MISC_PROC_THREAD_PERMISSIONS",    "Invoke-ProcessAndThreadPermissionCheck",      "TA0004 - Privilege Escalation", "Misc - Process and Thread Permissions",            "High",     "List",   "Base",         "False",      "False", "Check whether the current user has any privileged access right on a Process or Thread they do not own."
"MISC_MSI_CUSTOM_ACTIONS",         "Invoke-MsiCustomActionCheck",                 "TA0004 - Privilege Escalation", "Misc - MSI Unsafe Custom Actions",                 "None",     "List",   "Experimental", "True",       "False", "Get information about cached MSI files that execute potentially unsafe Custom Actions. Note that a manual analysis is required to determine if the returned MSI files are actually vulnerable."
"MISC_AVEDR",                      "Invoke-EndpointProtectionCheck",              "TA0005 - Defense Evasion",      "Misc - Endpoint Protection Software",              "None",     "Table",  "Extended",     "True",       "False", "Get information about the installed security products (AV, EDR). Note that this check follows a keyword-based approach and thus might not be completely reliable."
"MISC_AMSI_PROVIDERS",             "Invoke-AmsiProviderCheck",                    "TA0005 - Defense Evasion",      "Misc - AMSI Providers",                            "None",     "List",   "Extended",     "True",       "False", "Get information about AMSI providers registered by antimalware software."
"MISC_SYSINFO",                    "Invoke-SystemInformationCheck",               "TA0043 - Reconnaissance",       "Misc - System Information",                        "None",     "List",   "Extended",     "True",       "False", "Get information about the Windows version. Note that this information might be useful if the update history cannot be obtained."
"MISC_ADMINS",                     "Invoke-LocalAdminGroupCheck",                 "TA0043 - Reconnaissance",       "Misc - Local Administrators Group",                "None",     "Table",  "Extended",     "True",       "False", "Get information about the users and groups in the local 'Administrators' group."
"MISC_USER_SESSION_LIST",          "Invoke-UserSessionCheck",                     "TA0004 - Privilege Escalation", "Misc - User Sessions",                             "None",     "Table",  "Base",         "True",       "False", "Get information about the currently logged-on users. Note that it might be possible to capture or relay the NTLM/Kerberos authentication of these users (RemotePotato0, KrbRelay)."
"MISC_HOMES",                      "Invoke-UserHomeFolderCheck",                  "TA0043 - Reconnaissance",       "Misc - User Home Folders",                         "None",     "Table",  "Extended",     "False",      "False", "Get information about the local home folders and check whether the current user has read or write permissions."
"MISC_MACHINE_ROLE",               "Invoke-MachineRoleCheck",                     "TA0043 - Reconnaissance",       "Misc - Machine Role",                              "None",     "Table",  "Extended",     "True",       "False", "Get information about the machine's role. Is it a Workstation, a Server, or a Domain Controller."
"MISC_STARTUP_EVENTS",             "Invoke-SystemStartupHistoryCheck",            "TA0004 - Privilege Escalation", "Misc - System Startup History",                    "None",     "Table",  "Extended",     "True",       "False", "Get information about the startup history. Note that this information might be useful if the exploitation of a service requires a reboot but the current user does not have the privileges to shut down the system."
"MISC_DRIVES",                     "Invoke-SystemDriveCheck",                     "TA0043 - Reconnaissance",       "Misc - Filesystem Drives",                         "None",     "Table",  "Extended",     "True",       "False", "Get information about the partitions, removable storages, and mapped network shares."
"MISC_NAMED_PIPES",                "Invoke-NamedPipePermissionCheck",             "TA0004 - Privilege Escalation", "Misc - Named Pipe Permissions",                    "None",     "List",   "Extended",     "False",      "False", "Get information about named pipes with a DACL that grants write access to the current user."