Crate adhammer_core 

Shared domain model: SIDs, GUIDs, collected AD objects, findings, risk config. Everything above this crate (checks, graph, report) speaks in these types.

Re-exports

pub use finding::AttackResult;

pub use finding::Category;

pub use finding::Finding;

pub use finding::Mitre;

pub use finding::Severity;

pub use object::AdObject;

pub use snapshot::Snapshot;

Modules

finding

The output vocabulary: a Finding is one rule firing, tagged with a hygiene category, a severity, and one or more MITRE ATT&CK techniques.

object

A generic collected directory object: DN + multi-valued string attributes, plus the raw binary blobs we need to parse ourselves (objectSid, nTSecurityDescriptor).

sid

SID / GUID types. The parsing/formatting lives in the standalone windows_sddl crate (extracted from this repo); we re-export it here so the whole workspace shares one Sid/Guid type, and keep the AD-specific well-known RID table alongside.

snapshot

An immutable point-in-time capture of the directory. Checks and the graph builder read this; the collector produces it. Keeps a few precomputed indices.

Structs

Guid

16-byte GUID stored in the mixed-endian on-wire layout, normalized to a comparable byte array. Rendered aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee.

Sid

Windows Security Identifier. Stored canonically; Display yields S-1-5-....