Skip to main content

Module finding

Module finding 

Source
Expand description

The output vocabulary: a Finding is one rule firing, tagged with a hygiene category, a severity, and one or more MITRE ATT&CK techniques.

Modules§

mitre
Common techniques, referenced by checks so the mapping lives in one place.

Structs§

AttackResult
Evidence
A single piece of ground-truth evidence substantiating a finding (WS-PROOF): the actual server/client artifact — an LDAP attribute value, an MS-RRP registry key, a SAMR field, a wire status code — that a reviewer can verify by hand, independent of adhammer’s verdict. This is the difference between “you have X” (our word) and “the server returned Y, which is X” (proof).
Finding
Mitre
MITRE ATT&CK technique reference, e.g. (“T1558.003”, “Kerberoasting”).

Enums§

Category
The four top-level AD hygiene categories a Finding rolls up under.
Severity