[martinsohn]

Query updates:

• Added queries
  • Pre-built AD site queries:
    • Map AD site topology
    • Map site controllers
    • Map site servers to computers
    • Map site-linked GPO controllers
    • Map site-linked GPOs
  • Queries from PR #56, thanks to @nickvourd:
    • All Domain Controllers
    • Non-Tier Zero Principals with Control of Disabled Objects
    • Shortest Paths from Owned Principals to Disabled Objects
  • Accounts local Administrator of Tier Zero computers
  • Accounts with possible secrets in description
  • Foreign principals in Tier Zero groups
  • Hybrid accounts Tier Zero in both Entra ID and Active Directory
  • Non-Tier Zero accounts with WriteDACL on Tier Zero group
  • Computers with passwords older than the default maximum password age - MSSQL Failover Cluster
  • GPOs with computer configuration disabled linked to computers
  • GPOs with paths outside domain SYSVOL
  • GPOs with user configuration disabled linked to users
  • Kerberos-enabled service accounts without AES encryption
• Removed queries
  • AdminSDHolder protected Accounts and Groups
    • Replaced by the existing AdminSDHolder to protected objects relationship query.
  • Large default groups with outbound control of OUs
    • Covered by the expanded Large default groups with outbound control query.
• Updated queries
  • AdminSDHolder to protected objects relationship
    • Add a description and references for protected objects.
  • Non-Tier Zero principals with control of AdminSDHolder
    • Traverse all applicable AD attack-path edges.
  • All privileged Azure Service Principals
    • Return direct and group-delegated Entra role assignments.
  • All members of Operator groups
    • Include recursive membership and limit results to 1,000.
  • All DNSAdmins
    • Include nested group membership when locating DNSAdmins.
  • Users with non-default Primary Group membership
    • Detect non-default primary groups for Guest and other users while excluding managed service accounts.
  • Computers with non-default Primary Group membership
    • Simplify primary-group checks for Domain Controllers, Read-Only Domain Controllers, and Domain Computers.
  • Computer owners who can obtain LAPS passwords
    • Update ownership and permission analysis.
  • Users which do not require password to authenticate
    • Align with the BloodHound built-in query.
  • Accounts with weak password storage encryption
    • Increase the result limit to 1,000.
  • Enrollment rights on published ESC15 certificate templates
    • Clarify that CVE-2024-49019 addresses ESC15.
  • Accounts with SID History to a non-existent domain
    • Check the SID history target account's domain SID.
  • Tier Zero accounts not members of Denied RODC Password Replication Group
    • Check membership in the Denied RODC Password Replication Group.
  • Kerberos-enabled service account member of built-in Admins groups
    • Include the built-in Administrators group.
  • Domains with functional level not the latest version
    • Include additional functional levels and add a reference.
  • Large default groups with outbound control
    • Traverse applicable attack-path edges across object types and exclude membership and special-identity paths.
  • Principals With Direct Rights Assignment
    • Use traversable attack-path edges and exclude membership paths.
  • GPOs with computer configuration disabled linked to computers and GPOs with user configuration disabled linked to users
    • Return paths to enabled descendant computers or users; document that linked scope does not establish effective policy application.
  • Kerberos-enabled service accounts without AES encryption
    • Exclude unset or empty encryption configurations and document assumptions about KDC settings and AES keys.

Security assessment mapping updates:

• Added mappings
  • MDI: Stale user and service accounts.
  • MDI: Discoverable passwords in account descriptions.
  • MDI: Hybrid accounts privileged in both Entra ID and Active Directory.
  • MDI: Membership in built-in Operator groups and service accounts in privileged groups.
  • MDI: Certificate Authority permissions (ESC7).
  • MDI: Unnecessary replication permissions on Entra Connect accounts.
  • MDI: Unsafe permissions on Entra SSO accounts.
  • MDI: Local Administrator access to identity assets.
  • MDI: Privileged external and guest accounts.
  • MDI: WriteDacl permissions on sensitive groups.
  • MDI: Privileged Entra service principals.
  • Mapping for Kerberos-enabled service accounts without AES encryption.
• Removed mappings
  • MDI: Weak cipher usage.
    • Check is removed from MDI documentation.
  • Duplicate PingCastle A-CertTempCustomSubject mapping.
• Updated mappings
  • MDI: Refresh assessment names and identifiers for Kerberos preauthentication, MachineAccountQuota, AdminSDHolder, ADCS, and LDAP signing.
  • MDI: Map the SPN assessment to All Kerberoastable users.
  • PingCastle and MDI: Revise RC4/AES coverage scopes and explanations, including the effect of CVE-2026-20833.
  • PingCastle and MDI: Expand privileged-account delegation coverage to Tier Zero.
  • MDI: Clarify the partial coverage of weak password storage encryption.
  • Nessus: Update the Kerberoasting mapping explanation.
  • MDI: Clarify how to identify non-Tier Zero accounts with DCSync privileges.
  • PurpleKnight: Associate hybrid privilege coverage with the dual Tier Zero query.
  • Nessus and MDI: Clarify combined LDAP relay assessment mapping scopes.
  • Consolidate duplicate Tier Zero ownership mappings.
  • Update the MSSQL failover cluster password-age mapping.
  • Expand the LDAP signing and channel binding mappings to reflect the query's combined coverage.
  • Clarify Windows 10 mapping limitations and expand the AES mapping scope to include computer accounts with SPNs.

Other changes:

• Publish the mapping JSON alongside the query bundle.
• Update documentation with the Security Assessments page and screenshot.
• Add a Python utility for live BloodHound validation.

Validation: all 248 syntax and schema tests pass. Live BloodHound validation was not performed.