PSGuerrilla
2.10.3
Minimum PowerShell version
7.0
Installation Options
Owners
Copyright
(c) 2026 Jim Tyler. All rights reserved.
Package Details
Author(s)
- Jim Tyler Microsoft MVP
Tags
GoogleWorkspace ActiveDirectory EntraID AzureAD Intune M365 Security CompromiseAssessment IncidentResponse ThreatDetection ADSecurity CloudSecurity NTLMRelay TierZero GUI WPF PSGuerrilla
Functions
Invoke-Recon Invoke-Surveillance Invoke-Watchtower Invoke-Wiretap Get-DeadDrop Send-Signal Send-SignalSendGrid Send-SignalMailgun Send-SignalTwilio Send-SignalTeams Send-SignalSlack Send-SignalWebhook Send-SignalPagerDuty Send-SignalPushover Send-SignalSyslog Send-SignalEventLog Send-SignalDigest Set-Safehouse Test-Safehouse Get-Safehouse Register-Patrol Unregister-Patrol Get-Patrol Update-ThreatIntel Invoke-ReconDemo Invoke-Fortification Invoke-Reconnaissance Invoke-Infiltration Invoke-Campaign Get-GuerrillaScore Get-QuickWins Get-ComplianceCrosswalk Export-BudgetJustification Export-ExecutiveSummary Export-TechnicalReport Export-RemediationPlaybook Export-RemediationScripts Set-RiskAcceptance Get-RiskAcceptance Get-TrendReport Export-ReportPdf Export-Dashboard Show-Guerrilla
Dependencies
This module has no dependencies.
Release Notes
v2.10.3 (patch): Fixes from the v2.10.1 attack-path validation + the v2.10.2 GUI re-check. (1) ADPATH-001 false positives eliminated — the attack-path engine was reporting default infrastructure/admin principals (Domain Controllers group, Enterprise Domain Controllers, RODCs, Enterprise Read-only DCs, Schema Admins) as Tier-0 escalation paths even though they hold replication/control rights by AD design. A centralized allowlist (Test-DefaultControlPrincipal, matched by forge-proof well-known SID/RID, not locale-dependent names) now excludes them; in the reporter's live domain this drops the headline from "32 paths, all non-privileged" to the ~7 genuine ones. (2) SourceIsPrivileged is now correct (was always false, so the highest-risk sort/count was meaningless) — true for default privileged principals incl. operator groups and Tier-0 members. (3) Azure AD Connect MSOL_* sync accounts have real DCSync rights but by design (tracked by ADTIER-001); they're now flagged Expected, kept out of the non-privileged count, and reported separately rather than as surprise escalations. (4) DCSync/ACL-delegation checks share the same allowlist — Test-SafeAdminSid (ADPRIV-028, ADACL-010/015/016) delegates to Test-DefaultControlPrincipal (a strict superset of its old list), closing the residual where Enterprise Read-only Domain Controllers (498) was reported as a non-default DCSync principal. (5) GUI-2 ComboBox selection box fixed for real — the closed box rendered with the system's light button chrome (the nested ToggleButton's TemplateBinding bound to its own unset Background, not the ComboBox's), so near-white selection text read as blank/faint; the box fill is now hardcoded dark, verified by rendering the control off-screen to a bitmap and inspecting pixels. Regression tests added (Tests/verify-adpath-fix.ps1, 19/19). v2.10.2 (patch): GUI + safehouse audit fixes from the live GUI validation. (SH-1) Set-Safehouse -ConfigFile now also persists the Google Workspace delegated-admin email (and the Pushover/Twilio providers, previously dropped) into the vault — before this, a config-file setup followed by a vault-only scan (GUI / scheduled patrol, no -ConfigFile) failed with "AdminEmail is required." (SH-2) Get-Safehouse, Set-Safehouse -Status and the GUI Safehouse tab now reconcile vault metadata with the REAL secret store (Get-SecretInfo), so present-but-unregistered secrets (admin email, Pushover, legacy keys) are no longer hidden — a "are my creds loaded?" blind spot. (SH-3) Status now plainly discloses the no-master-password unattended mode instead of just labeling it "DPAPI". (GUI-1) The Safehouse "Test All" button now runs the real Test-Safehouse connectivity engine asynchronously and shows per-check results, instead of redirecting to the terminal. (GUI-2) ComboBoxes (Report style / Profile / Min alert level) now show their selected value when collapsed — a full dark control template themes the selection box. (GUI-4) A single-instance guard stops a second GUI window from clobbering shared config/state. (GUI-5) Rotate/Remove with no row selected now prompts to pick one. Regression tests added (Tests/verify-safehouse-fixes.ps1, 10/10). v2.10.1: Attack-path analysis now also flags GROUP-NESTING pivots — ADPATH-001 reports non-default groups nested inside a Tier-0 group (Domain/Enterprise/Schema Admins, Administrators, operator groups) as escalation pivots (controlling such a group, or being added to it, confers the Tier-0 group's privileges). Uses the already-collected recursive privileged-group membership; well-known Tier-0 groups are excluded so only custom nesting is flagged. Each path now carries a PathType (Object control / Group nesting). v2.10.0: AD attack-path analysis. Invoke-Reconnaissance gains a new "AttackPath" category (check ADPATH-001) that turns the flat dangerous-ACL findings into named privilege-escalation PATHS to Tier-0, each annotated with the concrete takeover technique it enables. v1 models the highest-value edge class — non-default control (GenericAll/WriteDacl/WriteOwner/replication rights) over a Tier-0 object (the domain root, AdminSDHolder, the Domain Controllers OU, the GPO/Configuration/Schema containers), a one-hop path to Domain Admin equivalence — and surfaces paths from genuinely non-privileged principals first as the highest risk. Built on already-collected ACL + privileged-group data (no new collection); runs under -Categories All or ACLDelegation/AttackPath. AD coverage is now 204 checks across 15 categories. This is the first increment of the roadmap's graph-based attack-path gap; full domain-wide TRANSITIVE path computation (low-priv user through nested-group control to Domain Admins) needs a full-domain ACL collector and is the next step. Regression tests added. v2.9.4 (patch): Fixes from the v2.9.3 live re-validation. (MON-4, regression) Continuous monitoring broke after the first run — Invoke-Surveillance/Invoke-Wiretap succeeded once then threw "Item has already been added" on every subsequent run (silently killing Register-Patrol scheduled monitoring). The scan-history append used `@($state.scanHistory) += @{...}`, which merged hashtable keys once a prior single-entry history reloaded from JSON. Both now build history via a new List-based Add-ScanHistoryEntry helper that always returns a clean array; two-run regression test added. (AD-1b) ADPRIV-028 (DCSync rights) reported instead of always SKIPping: with AD-1 collecting the domain-root DACL, the collector now derives DCSyncAccounts from the dangerous-ACE set (replication GUIDs 1131f6aa/1131f6ad/89e95b76, dropping default Tier-0 principals), completing the DCSync attack-path coverage. (GWS-3, partial) New Invoke-Fortification -Quick skips the slow per-user Gmail crawl (~1.4s/user; ~11min for 500 users) — directory/DNS/OAuth still run, Gmail-dependent EMAIL checks SKIP. Full parallelization deferred (needs live-tenant validation of runspace/token handling). v2.9.3 (patch): More live-validation backlog fixes. (REP-2) Get-ComplianceCrosswalk now exposes the technical frameworks already carried on every check — added NIST-800-53, MITRE-ATTACK and CIS to -Framework, built directly from each finding's compliance map (previously only the education frameworks FERPA/COPPA/CIPA/NIST-171/STATE-EDTECH were surfaced). (GWS-2) Sampled Google Workspace Gmail checks (EMAIL-009/010/011/022) now append a "SAMPLED N of M active mailboxes" qualifier to a clean PASS so a partial scan can't read as full coverage. (ENT-3) Invoke-GraphApi treats license-gated 400s (AadPremiumLicenseRequired, e.g. PIM schedule endpoints) as a quiet verbose note instead of an alarming warning on tenants without Entra ID P2. (ADTRADE-002) DCShadow indicator softened Critical->High — an unmatched server object under CN=Sites,CN=Configuration is usually lingering DC metadata, not an attack; the finding now says so and points at whenCreated. Remaining backlog tracked: GWS-1 (Cloud Identity Policy API — blocked until the SA gets the cloud-identity.policies.readonly DWD scope; adding it before delegation would break all Google auth), ENT-4/ENT-5, GWS-3, ADDOM-007. v2.9.2 (patch): Part-2 live-validation fixes (Google Workspace, monitoring, reporting). (1) Continuous monitoring couldn't use the safehouse vault — Invoke-Surveillance/Invoke-Wiretap never read it, so a vault-only setup failed with "TenantId is required" (and broke Register-Patrol for vault installs). Both now have -VaultName and resolve TenantId/ClientId/ClientSecret from GUERRILLA_GRAPH_* as the last resort, like the audit cmdlets since v2.5.0. (2) Invoke-Surveillance aborted the whole run on the first Graph 403; each collector is now wrapped in try/catch and the risk-detection 403/AadPremiumLicenseRequired case degrades to a clear "requires IdentityRiskEvent.Read.All + IdentityRiskyUser.Read.All + Entra ID P2" skip while sign-in/audit signals still run. (3) Google Workspace Gmail sampling was non-random (Select-Object -First always inspected the same directory-order prefix, so a compromised mailbox later in the list was never seen) — now a random sample. (4) Export-RemediationScripts gained an -OutputPath alias (was the only Export-* using -OutputDirectory). (5) Invoke-Watchtower gained comment-based help. v2.9.1 (patch): Fixes from a live-environment validation pass (production AD domain + Entra tenant). (1) AD ACL/DCSync/GPO-delegation checks were silently dead: Resolve-ADSid referenced three module-scope caches ($script:SidCache/WellKnownSids/WellKnownRids) the .psm1 never initialized, so every ACL read threw and Get-ADObjectACLs swallowed it — turning ADACL-012/014, ADGPO-007/009 and the DCSync check ADPRIV-028 into false SKIPs. Caches now initialized at load (with well-known SID/RID tables) + a guard in Resolve-ADSid; domain-RID lookup gated on S-1-5-21-* SIDs. (2) Tier-0 tier-bleed checks ADTIER-002/003/004/005 ERRORed on CLEAN environments because New-TierBleedFinding's [Parameter(Mandatory)][array]$Hits rejected an empty collection — the secure (zero-hit) state threw instead of PASS. Added [AllowEmptyCollection()]. (3) Entra password-protection checks EIDAUTH-013/014 falsely reported "settings not found": Get-EntraAuthMethodsData queried /settings (beta-only, 400s on v1.0); now uses v1.0 /groupSettings. (4) Removed a redundant always-400 Graph call (authenticationMethodConfigurations sourced from the parent policy object). (5) Invoke-LdapQuery now treats "no such object" (no AD CS / empty DNS partition) as verbose + empty instead of an alarming warning. Added Tests/verify-core-fixes.ps1. See CHANGELOG.md for v2.9.0 and earlier.
FileList
- PSGuerrilla.nuspec
- AI-USAGE.md
- Config\guerrilla-defaults.json
- Public\Export-ExecutiveSummary.ps1
- Public\Get-Safehouse.ps1
- Public\Register-Patrol.ps1
- Public\Send-SignalTwilio.ps1
- Samples\Infiltration-AllFail-Professional.html
- Data\AuditChecks\ADLogonScriptChecks.json
- Data\AuditChecks\DeviceManagementChecks.json
- Data\AuditChecks\M365AuditChecks.json
- Private\Audit\Compare-FortificationState.ps1
- Private\Audit\Invoke-LoggingAlertingChecks.ps1
- Private\Console\Write-GuerrillaText.ps1
- Private\Console\Write-SurveillanceReport.ps1
- Private\Core\Get-ResourceConstrainedFixes.ps1
- Private\Core\Test-AdminAction.ps1
- Private\Core\Test-UserAgentAnomaly.ps1
- Private\Export\Export-FortificationReportCsv.ps1
- Private\Export\Export-SurveillanceReportJson.ps1
- Private\Google\Invoke-GoogleAdminApi.ps1
- Private\Vault\Get-SafehouseCredentialView.ps1
- Private\AD\Checks\Invoke-ADCertificateServicesChecks.ps1
- Private\AD\Checks\Invoke-ADTrustChecks.ps1
- Private\AD\Core\Get-ADPasswordPolicies.ps1
- Private\ADMonitor\Core\Compare-ADBaseline.ps1
- Private\ADMonitor\Detections\Test-ADDnsRecordChange.ps1
- Private\ADMonitor\Detections\Test-ADSensitivePasswordChange.ps1
- Private\Entra\Checks\Invoke-M365AuditChecks.ps1
- Private\Entra\Core\Get-EntraPIMData.ps1
- Private\EntraMonitor\Detections\Test-EntraAnomalousToken.ps1
- Private\EntraMonitor\Detections\Test-EntraMalwareIp.ps1
- Private\M365Monitor\Detections\Test-M365AuditLogDisablement.ps1
- CHANGELOG.md
- Data\CloudIpRanges.json
- Public\Export-RemediationPlaybook.ps1
- Public\Get-TrendReport.ps1
- Public\Send-Signal.ps1
- Public\Send-SignalWebhook.ps1
- Samples\Infiltration-AllFail.html
- Data\AuditChecks\AdminManagementChecks.json
- Data\AuditChecks\DriveSecurityChecks.json
- Data\AuditChecks\M365DefenderChecks.json
- Private\Audit\Get-AuditCategoryDefinitions.ps1
- Private\Audit\Invoke-OAuthSecurityChecks.ps1
- Private\Console\Write-InfiltrationReport.ps1
- Private\Console\Write-WatchtowerReport.ps1
- Private\Core\Get-TheaterState.ps1
- Private\Core\Test-AfterHoursLogin.ps1
- Private\Core\Test-UserSuspension.ps1
- Private\Export\Export-FortificationReportHtml.ps1
- Private\Export\Export-TrendReportHtml.ps1
- Private\Google\Invoke-GoogleReportsApi.ps1
- Private\Vault\Get-SafehouseSecret.ps1
- Private\AD\Checks\Invoke-ADDomainForestChecks.ps1
- Private\AD\Checks\Invoke-TierZeroChecks.ps1
- Private\AD\Core\Get-ADPrivilegedMembers.ps1
- Private\ADMonitor\Core\Get-ADBaseline.ps1
- Private\ADMonitor\Detections\Test-ADDomainAdminChange.ps1
- Private\ADMonitor\Detections\Test-ADServiceAccountCreation.ps1
- Private\Entra\Checks\Invoke-M365DefenderChecks.ps1
- Private\Entra\Core\Get-EntraTenantData.ps1
- Private\EntraMonitor\Detections\Test-EntraAnonymousIp.ps1
- Private\EntraMonitor\Detections\Test-EntraPasswordSpray.ps1
- Private\M365Monitor\Detections\Test-M365BulkFileExfiltration.ps1
- CONTRIBUTING.md
- Data\ComplianceCrosswalk.json
- Public\Export-RemediationScripts.ps1
- Public\Invoke-Campaign.ps1
- Public\Send-SignalDigest.ps1
- Public\Set-RiskAcceptance.ps1
- Samples\Reconnaissance-AllFail-Professional.html
- Data\AuditChecks\ADNetworkChecks.json
- Data\AuditChecks\EmailSecurityChecks.json
- Data\AuditChecks\M365ExchangeChecks.json
- Private\Audit\Get-AuditPostureScore.ps1
- Private\Audit\New-AuditFinding.ps1
- Private\Console\Write-InterceptAlert.ps1
- Private\Console\Write-WiretapReport.ps1
- Private\Core\Get-ThreatScore.ps1
- Private\Core\Test-BruteForce.ps1
- Private\Core\Test-WorkspaceSettingChange.ps1
- Private\Export\Export-FortificationReportJson.ps1
- Private\Export\Export-WatchtowerReportCsv.ps1
- Private\Google\New-GoogleJwt.ps1
- Private\Vault\Get-VaultMetadata.ps1
- Private\AD\Checks\Invoke-ADGroupPolicyChecks.ps1
- Private\AD\Core\Get-ADAttackPath.ps1
- Private\AD\Core\Get-ADStaleObjects.ps1
- Private\ADMonitor\Core\Get-ADMonitorData.ps1
- Private\ADMonitor\Detections\Test-ADEnterpriseAdminChange.ps1
- Private\ADMonitor\Detections\Test-ADTrustChange.ps1
- Private\Entra\Checks\Invoke-M365ExchangeChecks.ps1
- Private\Entra\Core\Get-InfiltrationData.ps1
- Private\EntraMonitor\Detections\Test-EntraAppPermissionGrant.ps1
- Private\EntraMonitor\Detections\Test-EntraPrivilegedRoleChange.ps1
- Private\M365Monitor\Detections\Test-M365DefenderAlertChange.ps1
- LICENSE
- Data\HighRiskOAuthApps.json
- Public\Export-ReportPdf.ps1
- Public\Invoke-Fortification.ps1
- Public\Send-SignalEventLog.ps1
- Public\Set-Safehouse.ps1
- Samples\Reconnaissance-AllFail.html
- Data\AuditChecks\ADPasswordPolicyChecks.json
- Data\AuditChecks\EntraAppChecks.json
- Data\AuditChecks\M365PowerPlatformChecks.json
- Private\Audit\Get-FortificationData.ps1
- Private\Audit\Resolve-DomainMailSecurity.ps1
- Private\Console\Write-OperationHeader.ps1
- Private\Core\Add-ScanHistoryEntry.ps1
- Private\Core\Hide-ConfigSecret.ps1
- Private\Core\Test-BulkFileDownload.ps1
- Private\Core\Update-ThreatIntelData.ps1
- Private\Export\Export-InfiltrationReportCsv.ps1
- Private\Export\Export-WatchtowerReportHtml.ps1
- Private\Graph\Get-GraphAccessToken.ps1
- Private\Vault\Initialize-GuerrillaVault.ps1
- Private\AD\Checks\Invoke-ADKerberosChecks.ps1
- Private\AD\Core\Get-ADCertificateServices.ps1
- Private\AD\Core\Get-ADTierZeroSignals.ps1
- Private\ADMonitor\Core\Get-ADMonitorThreatScore.ps1
- Private\ADMonitor\Detections\Test-ADGPOChange.ps1
- Private\Entra\Checks\Invoke-AzureIAMChecks.ps1
- Private\Entra\Checks\Invoke-M365PowerPlatformChecks.ps1
- Private\Entra\Core\Get-IntuneData.ps1
- Private\EntraMonitor\Detections\Test-EntraAuditLogGap.ps1
- Private\EntraMonitor\Detections\Test-EntraRiskySignIn.ps1
- Private\M365Monitor\Detections\Test-M365DLPPolicyChange.ps1
- PSGuerrilla-Sample-Report.html
- Data\KnownAttackerIps.json
- Public\Export-TechnicalReport.ps1
- Public\Invoke-Infiltration.ps1
- Public\Send-SignalMailgun.ps1
- Public\Show-Guerrilla.ps1
- Data\AuditChecks\ADAclDelegationChecks.json
- Data\AuditChecks\ADPrivilegedAccountChecks.json
- Data\AuditChecks\EntraAuthChecks.json
- Data\AuditChecks\M365SharePointChecks.json
- Private\Audit\Get-GuerrillaSimulatedFindings.ps1
- Private\Console\Get-FortificationScoreLabel.ps1
- Private\Console\Write-ProgressLine.ps1
- Private\Core\Find-ThreatActorProfile.ps1
- Private\Core\Initialize-ConfigMigration.ps1
- Private\Core\Test-ConcurrentSessions.ps1
- Private\Export\Export-CampaignReportCsv.ps1
- Private\Export\Export-InfiltrationReportHtml.ps1
- Private\Export\Export-WatchtowerReportJson.ps1
- Private\Graph\Invoke-AzureRMApi.ps1
- Private\Vault\Read-MissionConfig.ps1
- Private\AD\Checks\Invoke-ADLoggingChecks.ps1
- Private\AD\Core\Get-ADDomainControllers.ps1
- Private\AD\Core\Get-ADTradecraftSignals.ps1
- Private\ADMonitor\Core\New-ADChangeProfile.ps1
- Private\ADMonitor\Detections\Test-ADGPOLinkChange.ps1
- Private\Entra\Checks\Invoke-EntraAppChecks.ps1
- Private\Entra\Checks\Invoke-M365SharePointChecks.ps1
- Private\Entra\Core\Get-M365ServiceData.ps1
- Private\EntraMonitor\Detections\Test-EntraAuthMethodChange.ps1
- Private\EntraMonitor\Detections\Test-EntraServicePrincipalCred.ps1
- Private\M365Monitor\Detections\Test-M365EDiscoverySearch.ps1
- PSGuerrilla.format.ps1xml
- Data\RemediationCosts.json
- Public\Get-ComplianceCrosswalk.ps1
- Public\Invoke-Recon.ps1
- Public\Send-SignalPagerDuty.ps1
- Public\Test-Safehouse.ps1
- Data\AuditChecks\ADAttackPathChecks.json
- Data\AuditChecks\ADStaleObjectChecks.json
- Data\AuditChecks\EntraCAChecks.json
- Data\AuditChecks\M365TeamsChecks.json
- Private\Audit\Invoke-AdminManagementChecks.ps1
- Private\Console\Get-GuerrillaScoreLabel.ps1
- Private\Console\Write-ReconnaissanceReport.ps1
- Private\Core\Get-AlertDeduplication.ps1
- Private\Core\Invoke-AlertEscalation.ps1
- Private\Core\Test-DomainWideDelegation.ps1
- Private\Export\Export-CampaignReportHtml.ps1
- Private\Export\Export-InfiltrationReportJson.ps1
- Private\Export\Export-WiretapReportCsv.ps1
- Private\Graph\Invoke-GraphApi.ps1
- Private\Vault\Set-GuerrillaCredential.ps1
- Private\AD\Checks\Invoke-ADLogonScriptChecks.ps1
- Private\AD\Core\Get-ADDomainInfo.ps1
- Private\AD\Core\Get-ADTrustRelationships.ps1
- Private\ADMonitor\Detections\Test-ADAdminSDHolderChange.ps1
- Private\ADMonitor\Detections\Test-ADKrbtgtChange.ps1
- Private\Entra\Checks\Invoke-EntraAuthChecks.ps1
- Private\Entra\Checks\Invoke-M365TeamsChecks.ps1
- Private\EntraMonitor\Core\Get-EntraDirectoryAudits.ps1
- Private\EntraMonitor\Detections\Test-EntraCAPolicyChange.ps1
- Private\EntraMonitor\Detections\Test-EntraSubscriptionPermChange.ps1
- Private\M365Monitor\Detections\Test-M365ExternalSharingChange.ps1
- Data\SuspiciousCountries.json
- Public\Get-DeadDrop.ps1
- Public\Invoke-ReconDemo.ps1
- Public\Send-SignalPushover.ps1
- Public\Unregister-Patrol.ps1
- Data\AuditChecks\ADCertificateServicesChecks.json
- Data\AuditChecks\ADTradecraftChecks.json
- Data\AuditChecks\EntraFedChecks.json
- Data\AuditChecks\OAuthSecurityChecks.json
- Private\Audit\Invoke-AuthenticationChecks.ps1
- Private\Console\Initialize-SpectreCapability.ps1
- Private\Console\Write-SpectreBarChart.ps1
- Private\Core\Get-CloudIpClassification.ps1
- Private\Core\Invoke-PendingKeyFileCleanup.ps1
- Private\Core\Test-DriveExternalSharing.ps1
- Private\Export\Export-CampaignReportJson.ps1
- Private\Export\Export-ReconnaissanceReportCsv.ps1
- Private\Export\Export-WiretapReportHtml.ps1
- Private\Graph\Test-GraphModuleAvailability.ps1
- Private\Vault\Set-VaultMetadata.ps1
- Private\AD\Checks\Invoke-ADNetworkChecks.ps1
- Private\AD\Core\Get-ADGroupPolicyObjects.ps1
- Private\AD\Core\Get-ReconnaissanceData.ps1
- Private\ADMonitor\Detections\Test-ADCertEnrollmentAnomaly.ps1
- Private\ADMonitor\Detections\Test-ADLdapQueryAnomaly.ps1
- Private\Entra\Checks\Invoke-EntraCAChecks.ps1
- Private\Entra\Core\Get-AzureIAMData.ps1
- Private\EntraMonitor\Core\Get-EntraMonitorThreatScore.ps1
- Private\EntraMonitor\Detections\Test-EntraFederationChange.ps1
- Private\EntraMonitor\Detections\Test-EntraTenantSettingChange.ps1
- Private\M365Monitor\Detections\Test-M365ForwardingRule.ps1
- PSGuerrilla.psd1
- Data\ThreatActorProfiles.json
- Public\Get-GuerrillaScore.ps1
- Public\Invoke-Reconnaissance.ps1
- Public\Send-SignalSendGrid.ps1
- Public\Update-ThreatIntel.ps1
- Data\AuditChecks\ADDomainForestChecks.json
- Data\AuditChecks\ADTrustChecks.json
- Data\AuditChecks\EntraPIMChecks.json
- Data\AuditChecks\TierZeroChecks.json
- Private\Audit\Invoke-CollaborationChecks.ps1
- Private\Console\Write-CampaignReport.ps1
- Private\Console\Write-SpectrePanel.ps1
- Private\Core\Get-GuerrillaScoreCalculation.ps1
- Private\Core\New-UserCompromiseProfile.ps1
- Private\Core\Test-EmailForwarding.ps1
- Private\Export\Export-DashboardHtml.ps1
- Private\Export\Export-ReconnaissanceReportHtml.ps1
- Private\Export\Export-WiretapReportJson.ps1
- Private\Gui\Get-GuerrillaGuiTheme.ps1
- Private\Vault\Show-SafehouseStatus.ps1
- Private\AD\Checks\Invoke-ADPasswordPolicyChecks.ps1
- Private\AD\Core\Get-ADKerberosConfig.ps1
- Private\AD\Core\Invoke-LdapQuery.ps1
- Private\ADMonitor\Detections\Test-ADCertTemplateChange.ps1
- Private\ADMonitor\Detections\Test-ADOUPermissionChange.ps1
- Private\Entra\Checks\Invoke-EntraFedChecks.ps1
- Private\Entra\Core\Get-EntraApplicationData.ps1
- Private\EntraMonitor\Core\Get-EntraRiskDetections.ps1
- Private\EntraMonitor\Detections\Test-EntraGlobalAdminAssignment.ps1
- Private\EntraMonitor\Detections\Test-EntraUnfamiliarSignIn.ps1
- Private\M365Monitor\Detections\Test-M365PowerAutomateFlow.ps1
- PSGuerrilla.psm1
- Data\VpnTorProxies.json
- Public\Get-Patrol.ps1
- Public\Invoke-Surveillance.ps1
- Public\Send-SignalSlack.ps1
- Samples\Fortification-AllFail-Professional.html
- Data\AuditChecks\ADGroupPolicyChecks.json
- Data\AuditChecks\AuthenticationChecks.json
- Data\AuditChecks\EntraTenantChecks.json
- Data\Localization\en-US.json
- Private\Audit\Invoke-DeviceManagementChecks.ps1
- Private\Console\Write-FieldReport.ps1
- Private\Console\Write-SpectreProgress.ps1
- Private\Core\Get-IpGeoData.ps1
- Private\Core\Save-OperationState.ps1
- Private\Core\Test-HighRiskOAuthApp.ps1
- Private\Export\Export-FieldReportCsv.ps1
- Private\Export\Export-ReconnaissanceReportJson.ps1
- Private\Export\Format-SignalContent.ps1
- Private\Gui\Invoke-GuerrillaGuiAsync.ps1
- Private\Vault\Test-CredentialConnectivity.ps1
- Private\AD\Checks\Invoke-ADPrivilegedAccountChecks.ps1
- Private\AD\Core\Get-ADLogonScripts.ps1
- Private\AD\Core\New-LdapConnection.ps1
- Private\ADMonitor\Detections\Test-ADComputerAccountCreation.ps1
- Private\ADMonitor\Detections\Test-ADPrivilegedGroupChange.ps1
- Private\Entra\Checks\Invoke-EntraPIMChecks.ps1
- Private\Entra\Core\Get-EntraAuthMethodsData.ps1
- Private\EntraMonitor\Core\Get-EntraSignInEvents.ps1
- Private\EntraMonitor\Detections\Test-EntraGuestInvitation.ps1
- Private\M365Monitor\Core\Get-M365AuditEvents.ps1
- Private\M365Monitor\Detections\Test-M365TeamsExternalAccess.ps1
- README.md
- Public\Export-BudgetJustification.ps1
- Public\Get-QuickWins.ps1
- Public\Invoke-Watchtower.ps1
- Public\Send-SignalSyslog.ps1
- Samples\Fortification-AllFail.html
- Data\AuditChecks\ADKerberosChecks.json
- Data\AuditChecks\AzureIAMChecks.json
- Data\AuditChecks\IntuneChecks.json
- Data\Profiles\Default-Baseline.json
- Private\Audit\Invoke-DriveSecurityChecks.ps1
- Private\Console\Write-FortificationReport.ps1
- Private\Console\Write-SpectreTable.ps1
- Private\Core\Get-LocalizedString.ps1
- Private\Core\Save-TheaterState.ps1
- Private\Core\Test-ImpossibleTravel.ps1
- Private\Export\Export-FieldReportHtml.ps1
- Private\Export\Export-SurveillanceReportCsv.ps1
- Private\Export\Get-GuerrillaReportTheme.ps1
- Private\Gui\Show-GuerrillaWindow.ps1
- Private\AD\Checks\Invoke-ADAclDelegationChecks.ps1
- Private\AD\Checks\Invoke-ADStaleObjectChecks.ps1
- Private\AD\Core\Get-ADNetworkConfig.ps1
- Private\AD\Core\Resolve-ADSid.ps1
- Private\ADMonitor\Detections\Test-ADDCSyncPermission.ps1
- Private\ADMonitor\Detections\Test-ADReplicationAnomaly.ps1
- Private\Entra\Checks\Invoke-EntraTenantChecks.ps1
- Private\Entra\Core\Get-EntraConditionalAccessData.ps1
- Private\EntraMonitor\Core\New-EntraRiskProfile.ps1
- Private\EntraMonitor\Detections\Test-EntraImpossibleTravel.ps1
- Private\M365Monitor\Core\Get-M365MonitorThreatScore.ps1
- Private\M365Monitor\Detections\Test-M365TransportRuleChange.ps1
- Config\guerrilla-config-schema.json
- Public\Export-Dashboard.ps1
- Public\Get-RiskAcceptance.ps1
- Public\Invoke-Wiretap.ps1
- Public\Send-SignalTeams.ps1
- Samples\Generate-SampleReports.ps1
- Data\AuditChecks\ADLoggingChecks.json
- Data\AuditChecks\CollaborationChecks.json
- Data\AuditChecks\LoggingAlertingChecks.json
- Data\Profiles\K12-Baseline.json
- Private\Audit\Invoke-EmailSecurityChecks.ps1
- Private\Console\Write-GuerrillaBanner.ps1
- Private\Console\Write-SpectreTree.ps1
- Private\Core\Get-OperationState.ps1
- Private\Core\Test-2svDisablement.ps1
- Private\Core\Test-NewDevice.ps1
- Private\Export\Export-FieldReportJson.ps1
- Private\Export\Export-SurveillanceReportHtml.ps1
- Private\Google\Get-GoogleAccessToken.ps1
- Private\Vault\Get-GuerrillaCredential.ps1
- Private\AD\Checks\Invoke-ADAttackPathChecks.ps1
- Private\AD\Checks\Invoke-ADTradecraftChecks.ps1
- Private\AD\Core\Get-ADObjectACLs.ps1
- Private\AD\Core\Test-ADModuleAvailability.ps1
- Private\ADMonitor\Detections\Test-ADDelegationChange.ps1
- Private\ADMonitor\Detections\Test-ADSchemaChange.ps1
- Private\Entra\Checks\Invoke-IntuneChecks.ps1
- Private\Entra\Core\Get-EntraFederationData.ps1
- Private\EntraMonitor\Detections\Test-EntraAdminUnitChange.ps1
- Private\EntraMonitor\Detections\Test-EntraLeakedCredential.ps1
- Private\M365Monitor\Core\New-M365ChangeProfile.ps1
Version History
| Version | Downloads | Last updated |
|---|---|---|
| 2.10.4 | 11 | 6/18/2026 |
| 2.10.3 (current version) | 5 | 6/18/2026 |
| 2.10.2 | 5 | 6/18/2026 |
| 2.10.1 | 5 | 6/18/2026 |
| 2.10.0 | 3 | 6/18/2026 |
| 2.9.4 | 4 | 6/18/2026 |
| 2.9.3 | 4 | 6/18/2026 |
| 2.9.2 | 3 | 6/18/2026 |
| 2.9.1 | 3 | 6/18/2026 |
| 2.9.0 | 7 | 6/17/2026 |
| 2.8.1 | 4 | 6/17/2026 |
| 2.8.0 | 5 | 6/17/2026 |
| 2.7.0 | 8 | 6/17/2026 |
| 2.6.0 | 4 | 6/16/2026 |
| 2.5.2 | 5 | 6/16/2026 |
| 2.5.1 | 3 | 6/16/2026 |
| 2.5.0 | 4 | 6/16/2026 |
| 2.4.4 | 4 | 6/16/2026 |
| 2.4.3 | 4 | 6/16/2026 |
| 2.4.2 | 5 | 6/16/2026 |
| 2.4.1 | 6 | 6/15/2026 |
| 2.4.0 | 7 | 6/11/2026 |
| 2.3.1 | 9 | 5/28/2026 |
| 2.3.0 | 3 | 5/28/2026 |
| 2.2.1 | 11 | 5/15/2026 |
| 2.2.0 | 3 | 5/15/2026 |