PSGuerrilla
2.10.0
Minimum PowerShell version
7.0
Installation Options
Owners
Copyright
(c) 2026 Jim Tyler. All rights reserved.
Package Details
Author(s)
- Jim Tyler Microsoft MVP
Tags
GoogleWorkspace ActiveDirectory EntraID AzureAD Intune M365 Security CompromiseAssessment IncidentResponse ThreatDetection ADSecurity CloudSecurity NTLMRelay TierZero GUI WPF PSGuerrilla
Functions
Invoke-Recon Invoke-Surveillance Invoke-Watchtower Invoke-Wiretap Get-DeadDrop Send-Signal Send-SignalSendGrid Send-SignalMailgun Send-SignalTwilio Send-SignalTeams Send-SignalSlack Send-SignalWebhook Send-SignalPagerDuty Send-SignalPushover Send-SignalSyslog Send-SignalEventLog Send-SignalDigest Set-Safehouse Test-Safehouse Get-Safehouse Register-Patrol Unregister-Patrol Get-Patrol Update-ThreatIntel Invoke-ReconDemo Invoke-Fortification Invoke-Reconnaissance Invoke-Infiltration Invoke-Campaign Get-GuerrillaScore Get-QuickWins Get-ComplianceCrosswalk Export-BudgetJustification Export-ExecutiveSummary Export-TechnicalReport Export-RemediationPlaybook Export-RemediationScripts Set-RiskAcceptance Get-RiskAcceptance Get-TrendReport Export-ReportPdf Export-Dashboard Show-Guerrilla
Dependencies
This module has no dependencies.
Release Notes
v2.10.0: AD attack-path analysis. Invoke-Reconnaissance gains a new "AttackPath" category (check ADPATH-001) that turns the flat dangerous-ACL findings into named privilege-escalation PATHS to Tier-0, each annotated with the concrete takeover technique it enables. v1 models the highest-value edge class — non-default control (GenericAll/WriteDacl/WriteOwner/replication rights) over a Tier-0 object (the domain root, AdminSDHolder, the Domain Controllers OU, the GPO/Configuration/Schema containers), a one-hop path to Domain Admin equivalence — and surfaces paths from genuinely non-privileged principals first as the highest risk. Built on already-collected ACL + privileged-group data (no new collection); runs under -Categories All or ACLDelegation/AttackPath. AD coverage is now 204 checks across 15 categories. This is the first increment of the roadmap's graph-based attack-path gap; full domain-wide TRANSITIVE path computation (low-priv user through nested-group control to Domain Admins) needs a full-domain ACL collector and is the next step. Regression tests added. v2.9.4 (patch): Fixes from the v2.9.3 live re-validation. (MON-4, regression) Continuous monitoring broke after the first run — Invoke-Surveillance/Invoke-Wiretap succeeded once then threw "Item has already been added" on every subsequent run (silently killing Register-Patrol scheduled monitoring). The scan-history append used `@($state.scanHistory) += @{...}`, which merged hashtable keys once a prior single-entry history reloaded from JSON. Both now build history via a new List-based Add-ScanHistoryEntry helper that always returns a clean array; two-run regression test added. (AD-1b) ADPRIV-028 (DCSync rights) reported instead of always SKIPping: with AD-1 collecting the domain-root DACL, the collector now derives DCSyncAccounts from the dangerous-ACE set (replication GUIDs 1131f6aa/1131f6ad/89e95b76, dropping default Tier-0 principals), completing the DCSync attack-path coverage. (GWS-3, partial) New Invoke-Fortification -Quick skips the slow per-user Gmail crawl (~1.4s/user; ~11min for 500 users) — directory/DNS/OAuth still run, Gmail-dependent EMAIL checks SKIP. Full parallelization deferred (needs live-tenant validation of runspace/token handling). v2.9.3 (patch): More live-validation backlog fixes. (REP-2) Get-ComplianceCrosswalk now exposes the technical frameworks already carried on every check — added NIST-800-53, MITRE-ATTACK and CIS to -Framework, built directly from each finding's compliance map (previously only the education frameworks FERPA/COPPA/CIPA/NIST-171/STATE-EDTECH were surfaced). (GWS-2) Sampled Google Workspace Gmail checks (EMAIL-009/010/011/022) now append a "SAMPLED N of M active mailboxes" qualifier to a clean PASS so a partial scan can't read as full coverage. (ENT-3) Invoke-GraphApi treats license-gated 400s (AadPremiumLicenseRequired, e.g. PIM schedule endpoints) as a quiet verbose note instead of an alarming warning on tenants without Entra ID P2. (ADTRADE-002) DCShadow indicator softened Critical->High — an unmatched server object under CN=Sites,CN=Configuration is usually lingering DC metadata, not an attack; the finding now says so and points at whenCreated. Remaining backlog tracked: GWS-1 (Cloud Identity Policy API — blocked until the SA gets the cloud-identity.policies.readonly DWD scope; adding it before delegation would break all Google auth), ENT-4/ENT-5, GWS-3, ADDOM-007. v2.9.2 (patch): Part-2 live-validation fixes (Google Workspace, monitoring, reporting). (1) Continuous monitoring couldn't use the safehouse vault — Invoke-Surveillance/Invoke-Wiretap never read it, so a vault-only setup failed with "TenantId is required" (and broke Register-Patrol for vault installs). Both now have -VaultName and resolve TenantId/ClientId/ClientSecret from GUERRILLA_GRAPH_* as the last resort, like the audit cmdlets since v2.5.0. (2) Invoke-Surveillance aborted the whole run on the first Graph 403; each collector is now wrapped in try/catch and the risk-detection 403/AadPremiumLicenseRequired case degrades to a clear "requires IdentityRiskEvent.Read.All + IdentityRiskyUser.Read.All + Entra ID P2" skip while sign-in/audit signals still run. (3) Google Workspace Gmail sampling was non-random (Select-Object -First always inspected the same directory-order prefix, so a compromised mailbox later in the list was never seen) — now a random sample. (4) Export-RemediationScripts gained an -OutputPath alias (was the only Export-* using -OutputDirectory). (5) Invoke-Watchtower gained comment-based help. v2.9.1 (patch): Fixes from a live-environment validation pass (production AD domain + Entra tenant). (1) AD ACL/DCSync/GPO-delegation checks were silently dead: Resolve-ADSid referenced three module-scope caches ($script:SidCache/WellKnownSids/WellKnownRids) the .psm1 never initialized, so every ACL read threw and Get-ADObjectACLs swallowed it — turning ADACL-012/014, ADGPO-007/009 and the DCSync check ADPRIV-028 into false SKIPs. Caches now initialized at load (with well-known SID/RID tables) + a guard in Resolve-ADSid; domain-RID lookup gated on S-1-5-21-* SIDs. (2) Tier-0 tier-bleed checks ADTIER-002/003/004/005 ERRORed on CLEAN environments because New-TierBleedFinding's [Parameter(Mandatory)][array]$Hits rejected an empty collection — the secure (zero-hit) state threw instead of PASS. Added [AllowEmptyCollection()]. (3) Entra password-protection checks EIDAUTH-013/014 falsely reported "settings not found": Get-EntraAuthMethodsData queried /settings (beta-only, 400s on v1.0); now uses v1.0 /groupSettings. (4) Removed a redundant always-400 Graph call (authenticationMethodConfigurations sourced from the parent policy object). (5) Invoke-LdapQuery now treats "no such object" (no AD CS / empty DNS partition) as verbose + empty instead of an alarming warning. Added Tests/verify-core-fixes.ps1. v2.9.0: Test mode. A new -TestMode switch on Invoke-Reconnaissance / Invoke-Fortification / Invoke-Infiltration / Invoke-Campaign, and a "Test mode" checkbox in the Show-Guerrilla Operations tab. When enabled the scan makes NO live connection and synthesizes a complete all-FAIL report straight from the shipped check definitions — every downstream feature works exactly like a real scan: report styles/themes, white-label branding, affected-account lists, scoring, and CSV/JSON output. Lets a consultant preview a fully-populated report and dial in branding/theme without a tenant or domain. Works for all three theaters and the big Campaign report (which simulates all 459 checks across AD + Google Workspace + Entra/M365). Test mode ignores the category selection — it always simulates the full theater check set. Also: the Campaign (big report) now honours report themes + white-label branding too — Invoke-Campaign gains -ReportStyle, reads branding from config, and Export-CampaignReportHtml moved onto the shared theming engine (Guerrilla/Professional/Slate) with plain risk-based per-theater labels in the plain themes (previously only the three single-theater reports were themed). Backward compatible: default Guerrilla output unchanged. v2.8.1 (patch): Fix Show-Guerrilla GUI Entra/Azure/M365 (Infiltration) scans appearing to HANG — the scan completed but the OnComplete callback called the module-private Get-PSGuerrillaDataRoot, which is not resolvable inside a GetNewClosure() closure, so the callback threw before resetting the UI and the progress bar kept spinning. (AD/Workspace were unaffected because their results carry HtmlReportPath and skipped that branch.) The callback now uses the captured $session.ReportsDir, and Invoke-Infiltration now returns HtmlReportPath like the other theaters so the GUI opens the exact report. Also fixed poor GUI contrast: the Report style / Settings dropdown popups used WPF's default light theme, making the near-white item text invisible — ComboBoxItem now has an explicit dark template (light text, amber highlight with dark text) — and the left-nav buttons were brightened for legibility. v2.8.0: Report themes + white-label branding. (1) Reports can now be generated in three visual STYLES, picked per scan from the Operations tab's new "Report style" dropdown (or a new -ReportStyle parameter on Invoke-Reconnaissance / Invoke-Fortification / Invoke-Infiltration): Guerrilla (default, unchanged dark tactical theme with FORTRESS/EXPOSED FLANK/OVERRUN labels), Professional (light white corporate theme, sans-serif, plain risk-based labels Secure/Hardened/Moderate Risk/Elevated Risk/High Risk/Critical Risk), and Slate (modern dark dashboard, plain labels). A shared theming engine drives a common palette of CSS variables so all three audit reports look consistent per style. (2) A new "Branding" tab in Show-Guerrilla white-labels reports with firm name, logo, consultant name/email, client name, and a confidentiality banner (rendered in the report header). Branding is saved to config and applied on every subsequent scan. The "Generated with PSGuerrilla by Jim Tyler, Microsoft MVP" footer attribution is ALWAYS preserved regardless of theme or branding. Default look is unchanged (existing scans render identically as Guerrilla); themes/branding currently cover the three audit reports, with the Campaign roll-up and monitoring reports to follow. See CHANGELOG.md for v2.7.0 and earlier.
FileList
- PSGuerrilla.nuspec
- AI-USAGE.md
- Config\guerrilla-defaults.json
- Public\Export-ExecutiveSummary.ps1
- Public\Get-Safehouse.ps1
- Public\Register-Patrol.ps1
- Public\Send-SignalTwilio.ps1
- Samples\Infiltration-AllFail-Professional.html
- Data\AuditChecks\ADLogonScriptChecks.json
- Data\AuditChecks\DeviceManagementChecks.json
- Data\AuditChecks\M365AuditChecks.json
- Private\Audit\Compare-FortificationState.ps1
- Private\Audit\Invoke-LoggingAlertingChecks.ps1
- Private\Console\Write-GuerrillaText.ps1
- Private\Console\Write-SurveillanceReport.ps1
- Private\Core\Get-ResourceConstrainedFixes.ps1
- Private\Core\Test-AdminAction.ps1
- Private\Core\Test-UserAgentAnomaly.ps1
- Private\Export\Export-FortificationReportCsv.ps1
- Private\Export\Export-SurveillanceReportJson.ps1
- Private\Google\Invoke-GoogleAdminApi.ps1
- Private\Vault\Get-SafehouseSecret.ps1
- Private\AD\Checks\Invoke-ADDomainForestChecks.ps1
- Private\AD\Checks\Invoke-TierZeroChecks.ps1
- Private\AD\Core\Get-ADPrivilegedMembers.ps1
- Private\ADMonitor\Core\Get-ADBaseline.ps1
- Private\ADMonitor\Detections\Test-ADDomainAdminChange.ps1
- Private\ADMonitor\Detections\Test-ADServiceAccountCreation.ps1
- Private\Entra\Checks\Invoke-M365DefenderChecks.ps1
- Private\Entra\Core\Get-EntraTenantData.ps1
- Private\EntraMonitor\Detections\Test-EntraAnonymousIp.ps1
- Private\EntraMonitor\Detections\Test-EntraPasswordSpray.ps1
- Private\M365Monitor\Detections\Test-M365AuditLogDisablement.ps1
- CHANGELOG.md
- Data\CloudIpRanges.json
- Public\Export-RemediationPlaybook.ps1
- Public\Get-TrendReport.ps1
- Public\Send-Signal.ps1
- Public\Send-SignalWebhook.ps1
- Samples\Infiltration-AllFail.html
- Data\AuditChecks\AdminManagementChecks.json
- Data\AuditChecks\DriveSecurityChecks.json
- Data\AuditChecks\M365DefenderChecks.json
- Private\Audit\Get-AuditCategoryDefinitions.ps1
- Private\Audit\Invoke-OAuthSecurityChecks.ps1
- Private\Console\Write-InfiltrationReport.ps1
- Private\Console\Write-WatchtowerReport.ps1
- Private\Core\Get-TheaterState.ps1
- Private\Core\Test-AfterHoursLogin.ps1
- Private\Core\Test-UserSuspension.ps1
- Private\Export\Export-FortificationReportHtml.ps1
- Private\Export\Export-TrendReportHtml.ps1
- Private\Google\Invoke-GoogleReportsApi.ps1
- Private\Vault\Get-VaultMetadata.ps1
- Private\AD\Checks\Invoke-ADGroupPolicyChecks.ps1
- Private\AD\Core\Get-ADAttackPath.ps1
- Private\AD\Core\Get-ADStaleObjects.ps1
- Private\ADMonitor\Core\Get-ADMonitorData.ps1
- Private\ADMonitor\Detections\Test-ADEnterpriseAdminChange.ps1
- Private\ADMonitor\Detections\Test-ADTrustChange.ps1
- Private\Entra\Checks\Invoke-M365ExchangeChecks.ps1
- Private\Entra\Core\Get-InfiltrationData.ps1
- Private\EntraMonitor\Detections\Test-EntraAppPermissionGrant.ps1
- Private\EntraMonitor\Detections\Test-EntraPrivilegedRoleChange.ps1
- Private\M365Monitor\Detections\Test-M365BulkFileExfiltration.ps1
- CONTRIBUTING.md
- Data\ComplianceCrosswalk.json
- Public\Export-RemediationScripts.ps1
- Public\Invoke-Campaign.ps1
- Public\Send-SignalDigest.ps1
- Public\Set-RiskAcceptance.ps1
- Samples\Reconnaissance-AllFail-Professional.html
- Data\AuditChecks\ADNetworkChecks.json
- Data\AuditChecks\EmailSecurityChecks.json
- Data\AuditChecks\M365ExchangeChecks.json
- Private\Audit\Get-AuditPostureScore.ps1
- Private\Audit\New-AuditFinding.ps1
- Private\Console\Write-InterceptAlert.ps1
- Private\Console\Write-WiretapReport.ps1
- Private\Core\Get-ThreatScore.ps1
- Private\Core\Test-BruteForce.ps1
- Private\Core\Test-WorkspaceSettingChange.ps1
- Private\Export\Export-FortificationReportJson.ps1
- Private\Export\Export-WatchtowerReportCsv.ps1
- Private\Google\New-GoogleJwt.ps1
- Private\Vault\Initialize-GuerrillaVault.ps1
- Private\AD\Checks\Invoke-ADKerberosChecks.ps1
- Private\AD\Core\Get-ADCertificateServices.ps1
- Private\AD\Core\Get-ADTierZeroSignals.ps1
- Private\ADMonitor\Core\Get-ADMonitorThreatScore.ps1
- Private\ADMonitor\Detections\Test-ADGPOChange.ps1
- Private\Entra\Checks\Invoke-AzureIAMChecks.ps1
- Private\Entra\Checks\Invoke-M365PowerPlatformChecks.ps1
- Private\Entra\Core\Get-IntuneData.ps1
- Private\EntraMonitor\Detections\Test-EntraAuditLogGap.ps1
- Private\EntraMonitor\Detections\Test-EntraRiskySignIn.ps1
- Private\M365Monitor\Detections\Test-M365DefenderAlertChange.ps1
- LICENSE
- Data\HighRiskOAuthApps.json
- Public\Export-ReportPdf.ps1
- Public\Invoke-Fortification.ps1
- Public\Send-SignalEventLog.ps1
- Public\Set-Safehouse.ps1
- Samples\Reconnaissance-AllFail.html
- Data\AuditChecks\ADPasswordPolicyChecks.json
- Data\AuditChecks\EntraAppChecks.json
- Data\AuditChecks\M365PowerPlatformChecks.json
- Private\Audit\Get-FortificationData.ps1
- Private\Audit\Resolve-DomainMailSecurity.ps1
- Private\Console\Write-OperationHeader.ps1
- Private\Core\Add-ScanHistoryEntry.ps1
- Private\Core\Hide-ConfigSecret.ps1
- Private\Core\Test-BulkFileDownload.ps1
- Private\Core\Update-ThreatIntelData.ps1
- Private\Export\Export-InfiltrationReportCsv.ps1
- Private\Export\Export-WatchtowerReportHtml.ps1
- Private\Graph\Get-GraphAccessToken.ps1
- Private\Vault\Read-MissionConfig.ps1
- Private\AD\Checks\Invoke-ADLoggingChecks.ps1
- Private\AD\Core\Get-ADDomainControllers.ps1
- Private\AD\Core\Get-ADTradecraftSignals.ps1
- Private\ADMonitor\Core\New-ADChangeProfile.ps1
- Private\ADMonitor\Detections\Test-ADGPOLinkChange.ps1
- Private\Entra\Checks\Invoke-EntraAppChecks.ps1
- Private\Entra\Checks\Invoke-M365SharePointChecks.ps1
- Private\Entra\Core\Get-M365ServiceData.ps1
- Private\EntraMonitor\Detections\Test-EntraAuthMethodChange.ps1
- Private\EntraMonitor\Detections\Test-EntraServicePrincipalCred.ps1
- Private\M365Monitor\Detections\Test-M365DLPPolicyChange.ps1
- PSGuerrilla-Sample-Report.html
- Data\KnownAttackerIps.json
- Public\Export-TechnicalReport.ps1
- Public\Invoke-Infiltration.ps1
- Public\Send-SignalMailgun.ps1
- Public\Show-Guerrilla.ps1
- Data\AuditChecks\ADAclDelegationChecks.json
- Data\AuditChecks\ADPrivilegedAccountChecks.json
- Data\AuditChecks\EntraAuthChecks.json
- Data\AuditChecks\M365SharePointChecks.json
- Private\Audit\Get-GuerrillaSimulatedFindings.ps1
- Private\Console\Get-FortificationScoreLabel.ps1
- Private\Console\Write-ProgressLine.ps1
- Private\Core\Find-ThreatActorProfile.ps1
- Private\Core\Initialize-ConfigMigration.ps1
- Private\Core\Test-ConcurrentSessions.ps1
- Private\Export\Export-CampaignReportCsv.ps1
- Private\Export\Export-InfiltrationReportHtml.ps1
- Private\Export\Export-WatchtowerReportJson.ps1
- Private\Graph\Invoke-AzureRMApi.ps1
- Private\Vault\Set-GuerrillaCredential.ps1
- Private\AD\Checks\Invoke-ADLogonScriptChecks.ps1
- Private\AD\Core\Get-ADDomainInfo.ps1
- Private\AD\Core\Get-ADTrustRelationships.ps1
- Private\ADMonitor\Detections\Test-ADAdminSDHolderChange.ps1
- Private\ADMonitor\Detections\Test-ADKrbtgtChange.ps1
- Private\Entra\Checks\Invoke-EntraAuthChecks.ps1
- Private\Entra\Checks\Invoke-M365TeamsChecks.ps1
- Private\EntraMonitor\Core\Get-EntraDirectoryAudits.ps1
- Private\EntraMonitor\Detections\Test-EntraCAPolicyChange.ps1
- Private\EntraMonitor\Detections\Test-EntraSubscriptionPermChange.ps1
- Private\M365Monitor\Detections\Test-M365EDiscoverySearch.ps1
- PSGuerrilla.format.ps1xml
- Data\RemediationCosts.json
- Public\Get-ComplianceCrosswalk.ps1
- Public\Invoke-Recon.ps1
- Public\Send-SignalPagerDuty.ps1
- Public\Test-Safehouse.ps1
- Data\AuditChecks\ADAttackPathChecks.json
- Data\AuditChecks\ADStaleObjectChecks.json
- Data\AuditChecks\EntraCAChecks.json
- Data\AuditChecks\M365TeamsChecks.json
- Private\Audit\Invoke-AdminManagementChecks.ps1
- Private\Console\Get-GuerrillaScoreLabel.ps1
- Private\Console\Write-ReconnaissanceReport.ps1
- Private\Core\Get-AlertDeduplication.ps1
- Private\Core\Invoke-AlertEscalation.ps1
- Private\Core\Test-DomainWideDelegation.ps1
- Private\Export\Export-CampaignReportHtml.ps1
- Private\Export\Export-InfiltrationReportJson.ps1
- Private\Export\Export-WiretapReportCsv.ps1
- Private\Graph\Invoke-GraphApi.ps1
- Private\Vault\Set-VaultMetadata.ps1
- Private\AD\Checks\Invoke-ADNetworkChecks.ps1
- Private\AD\Core\Get-ADGroupPolicyObjects.ps1
- Private\AD\Core\Get-ReconnaissanceData.ps1
- Private\ADMonitor\Detections\Test-ADCertEnrollmentAnomaly.ps1
- Private\ADMonitor\Detections\Test-ADLdapQueryAnomaly.ps1
- Private\Entra\Checks\Invoke-EntraCAChecks.ps1
- Private\Entra\Core\Get-AzureIAMData.ps1
- Private\EntraMonitor\Core\Get-EntraMonitorThreatScore.ps1
- Private\EntraMonitor\Detections\Test-EntraFederationChange.ps1
- Private\EntraMonitor\Detections\Test-EntraTenantSettingChange.ps1
- Private\M365Monitor\Detections\Test-M365ExternalSharingChange.ps1
- Data\SuspiciousCountries.json
- Public\Get-DeadDrop.ps1
- Public\Invoke-ReconDemo.ps1
- Public\Send-SignalPushover.ps1
- Public\Unregister-Patrol.ps1
- Data\AuditChecks\ADCertificateServicesChecks.json
- Data\AuditChecks\ADTradecraftChecks.json
- Data\AuditChecks\EntraFedChecks.json
- Data\AuditChecks\OAuthSecurityChecks.json
- Private\Audit\Invoke-AuthenticationChecks.ps1
- Private\Console\Initialize-SpectreCapability.ps1
- Private\Console\Write-SpectreBarChart.ps1
- Private\Core\Get-CloudIpClassification.ps1
- Private\Core\Invoke-PendingKeyFileCleanup.ps1
- Private\Core\Test-DriveExternalSharing.ps1
- Private\Export\Export-CampaignReportJson.ps1
- Private\Export\Export-ReconnaissanceReportCsv.ps1
- Private\Export\Export-WiretapReportHtml.ps1
- Private\Graph\Test-GraphModuleAvailability.ps1
- Private\Vault\Show-SafehouseStatus.ps1
- Private\AD\Checks\Invoke-ADPasswordPolicyChecks.ps1
- Private\AD\Core\Get-ADKerberosConfig.ps1
- Private\AD\Core\Invoke-LdapQuery.ps1
- Private\ADMonitor\Detections\Test-ADCertTemplateChange.ps1
- Private\ADMonitor\Detections\Test-ADOUPermissionChange.ps1
- Private\Entra\Checks\Invoke-EntraFedChecks.ps1
- Private\Entra\Core\Get-EntraApplicationData.ps1
- Private\EntraMonitor\Core\Get-EntraRiskDetections.ps1
- Private\EntraMonitor\Detections\Test-EntraGlobalAdminAssignment.ps1
- Private\EntraMonitor\Detections\Test-EntraUnfamiliarSignIn.ps1
- Private\M365Monitor\Detections\Test-M365ForwardingRule.ps1
- PSGuerrilla.psd1
- Data\ThreatActorProfiles.json
- Public\Get-GuerrillaScore.ps1
- Public\Invoke-Reconnaissance.ps1
- Public\Send-SignalSendGrid.ps1
- Public\Update-ThreatIntel.ps1
- Data\AuditChecks\ADDomainForestChecks.json
- Data\AuditChecks\ADTrustChecks.json
- Data\AuditChecks\EntraPIMChecks.json
- Data\AuditChecks\TierZeroChecks.json
- Private\Audit\Invoke-CollaborationChecks.ps1
- Private\Console\Write-CampaignReport.ps1
- Private\Console\Write-SpectrePanel.ps1
- Private\Core\Get-GuerrillaScoreCalculation.ps1
- Private\Core\New-UserCompromiseProfile.ps1
- Private\Core\Test-EmailForwarding.ps1
- Private\Export\Export-DashboardHtml.ps1
- Private\Export\Export-ReconnaissanceReportHtml.ps1
- Private\Export\Export-WiretapReportJson.ps1
- Private\Gui\Get-GuerrillaGuiTheme.ps1
- Private\Vault\Test-CredentialConnectivity.ps1
- Private\AD\Checks\Invoke-ADPrivilegedAccountChecks.ps1
- Private\AD\Core\Get-ADLogonScripts.ps1
- Private\AD\Core\New-LdapConnection.ps1
- Private\ADMonitor\Detections\Test-ADComputerAccountCreation.ps1
- Private\ADMonitor\Detections\Test-ADPrivilegedGroupChange.ps1
- Private\Entra\Checks\Invoke-EntraPIMChecks.ps1
- Private\Entra\Core\Get-EntraAuthMethodsData.ps1
- Private\EntraMonitor\Core\Get-EntraSignInEvents.ps1
- Private\EntraMonitor\Detections\Test-EntraGuestInvitation.ps1
- Private\M365Monitor\Core\Get-M365AuditEvents.ps1
- Private\M365Monitor\Detections\Test-M365PowerAutomateFlow.ps1
- PSGuerrilla.psm1
- Data\VpnTorProxies.json
- Public\Get-Patrol.ps1
- Public\Invoke-Surveillance.ps1
- Public\Send-SignalSlack.ps1
- Samples\Fortification-AllFail-Professional.html
- Data\AuditChecks\ADGroupPolicyChecks.json
- Data\AuditChecks\AuthenticationChecks.json
- Data\AuditChecks\EntraTenantChecks.json
- Data\Localization\en-US.json
- Private\Audit\Invoke-DeviceManagementChecks.ps1
- Private\Console\Write-FieldReport.ps1
- Private\Console\Write-SpectreProgress.ps1
- Private\Core\Get-IpGeoData.ps1
- Private\Core\Save-OperationState.ps1
- Private\Core\Test-HighRiskOAuthApp.ps1
- Private\Export\Export-FieldReportCsv.ps1
- Private\Export\Export-ReconnaissanceReportJson.ps1
- Private\Export\Format-SignalContent.ps1
- Private\Gui\Invoke-GuerrillaGuiAsync.ps1
- Private\AD\Checks\Invoke-ADAclDelegationChecks.ps1
- Private\AD\Checks\Invoke-ADStaleObjectChecks.ps1
- Private\AD\Core\Get-ADNetworkConfig.ps1
- Private\AD\Core\Resolve-ADSid.ps1
- Private\ADMonitor\Detections\Test-ADDCSyncPermission.ps1
- Private\ADMonitor\Detections\Test-ADReplicationAnomaly.ps1
- Private\Entra\Checks\Invoke-EntraTenantChecks.ps1
- Private\Entra\Core\Get-EntraConditionalAccessData.ps1
- Private\EntraMonitor\Core\New-EntraRiskProfile.ps1
- Private\EntraMonitor\Detections\Test-EntraImpossibleTravel.ps1
- Private\M365Monitor\Core\Get-M365MonitorThreatScore.ps1
- Private\M365Monitor\Detections\Test-M365TeamsExternalAccess.ps1
- README.md
- Public\Export-BudgetJustification.ps1
- Public\Get-QuickWins.ps1
- Public\Invoke-Watchtower.ps1
- Public\Send-SignalSyslog.ps1
- Samples\Fortification-AllFail.html
- Data\AuditChecks\ADKerberosChecks.json
- Data\AuditChecks\AzureIAMChecks.json
- Data\AuditChecks\IntuneChecks.json
- Data\Profiles\Default-Baseline.json
- Private\Audit\Invoke-DriveSecurityChecks.ps1
- Private\Console\Write-FortificationReport.ps1
- Private\Console\Write-SpectreTable.ps1
- Private\Core\Get-LocalizedString.ps1
- Private\Core\Save-TheaterState.ps1
- Private\Core\Test-ImpossibleTravel.ps1
- Private\Export\Export-FieldReportHtml.ps1
- Private\Export\Export-SurveillanceReportCsv.ps1
- Private\Export\Get-GuerrillaReportTheme.ps1
- Private\Gui\Show-GuerrillaWindow.ps1
- Private\AD\Checks\Invoke-ADAttackPathChecks.ps1
- Private\AD\Checks\Invoke-ADTradecraftChecks.ps1
- Private\AD\Core\Get-ADObjectACLs.ps1
- Private\AD\Core\Test-ADModuleAvailability.ps1
- Private\ADMonitor\Detections\Test-ADDelegationChange.ps1
- Private\ADMonitor\Detections\Test-ADSchemaChange.ps1
- Private\Entra\Checks\Invoke-IntuneChecks.ps1
- Private\Entra\Core\Get-EntraFederationData.ps1
- Private\EntraMonitor\Detections\Test-EntraAdminUnitChange.ps1
- Private\EntraMonitor\Detections\Test-EntraLeakedCredential.ps1
- Private\M365Monitor\Core\New-M365ChangeProfile.ps1
- Private\M365Monitor\Detections\Test-M365TransportRuleChange.ps1
- Config\guerrilla-config-schema.json
- Public\Export-Dashboard.ps1
- Public\Get-RiskAcceptance.ps1
- Public\Invoke-Wiretap.ps1
- Public\Send-SignalTeams.ps1
- Samples\Generate-SampleReports.ps1
- Data\AuditChecks\ADLoggingChecks.json
- Data\AuditChecks\CollaborationChecks.json
- Data\AuditChecks\LoggingAlertingChecks.json
- Data\Profiles\K12-Baseline.json
- Private\Audit\Invoke-EmailSecurityChecks.ps1
- Private\Console\Write-GuerrillaBanner.ps1
- Private\Console\Write-SpectreTree.ps1
- Private\Core\Get-OperationState.ps1
- Private\Core\Test-2svDisablement.ps1
- Private\Core\Test-NewDevice.ps1
- Private\Export\Export-FieldReportJson.ps1
- Private\Export\Export-SurveillanceReportHtml.ps1
- Private\Google\Get-GoogleAccessToken.ps1
- Private\Vault\Get-GuerrillaCredential.ps1
- Private\AD\Checks\Invoke-ADCertificateServicesChecks.ps1
- Private\AD\Checks\Invoke-ADTrustChecks.ps1
- Private\AD\Core\Get-ADPasswordPolicies.ps1
- Private\ADMonitor\Core\Compare-ADBaseline.ps1
- Private\ADMonitor\Detections\Test-ADDnsRecordChange.ps1
- Private\ADMonitor\Detections\Test-ADSensitivePasswordChange.ps1
- Private\Entra\Checks\Invoke-M365AuditChecks.ps1
- Private\Entra\Core\Get-EntraPIMData.ps1
- Private\EntraMonitor\Detections\Test-EntraAnomalousToken.ps1
- Private\EntraMonitor\Detections\Test-EntraMalwareIp.ps1
Version History
| Version | Downloads | Last updated |
|---|---|---|
| 2.10.4 | 11 | 6/18/2026 |
| 2.10.3 | 5 | 6/18/2026 |
| 2.10.2 | 5 | 6/18/2026 |
| 2.10.1 | 5 | 6/18/2026 |
| 2.10.0 (current version) | 3 | 6/18/2026 |
| 2.9.4 | 4 | 6/18/2026 |
| 2.9.3 | 4 | 6/18/2026 |
| 2.9.2 | 3 | 6/18/2026 |
| 2.9.1 | 3 | 6/18/2026 |
| 2.9.0 | 7 | 6/17/2026 |
| 2.8.1 | 4 | 6/17/2026 |
| 2.8.0 | 5 | 6/17/2026 |
| 2.7.0 | 8 | 6/17/2026 |
| 2.6.0 | 4 | 6/16/2026 |
| 2.5.2 | 5 | 6/16/2026 |
| 2.5.1 | 3 | 6/16/2026 |
| 2.5.0 | 4 | 6/16/2026 |
| 2.4.4 | 4 | 6/16/2026 |
| 2.4.3 | 4 | 6/16/2026 |
| 2.4.2 | 5 | 6/16/2026 |
| 2.4.1 | 6 | 6/15/2026 |
| 2.4.0 | 7 | 6/11/2026 |
| 2.3.1 | 9 | 5/28/2026 |
| 2.3.0 | 3 | 5/28/2026 |
| 2.2.1 | 11 | 5/15/2026 |
| 2.2.0 | 3 | 5/15/2026 |