PSGuerrilla

2.20.0

Security assessment, threat detection, and continuous monitoring module for Google Workspace, Active Directory, and Microsoft cloud environments. Includes Google Workspace compromise assessment with 23 detection signals, Active Directory reconnaissance (205 security checks across 15 categories including transitive Tier-0 attack-path analysis, NTLM-relay preconditions,
Security assessment, threat detection, and continuous monitoring module for Google Workspace, Active Directory, and Microsoft cloud environments. Includes Google Workspace compromise assessment with 23 detection signals, Active Directory reconnaissance (205 security checks across 15 categories including transitive Tier-0 attack-path analysis, NTLM-relay preconditions, Tier-0 hygiene, telemetry posture, and adversary tradecraft indicators), Entra ID / Azure / Intune / M365 infiltration audit (158 checks), and continuous monitoring across all four theaters (Entra ID sign-in risk, AD baseline monitoring, M365 audit log monitoring). Supports alerting via SendGrid, Mailgun, Twilio SMS, Teams, Slack, generic webhooks, PagerDuty, Pushover, Syslog (CEF/LEEF), and Windows Event Log.
Show more

Minimum PowerShell version

7.0

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Module -Name PSGuerrilla -RequiredVersion 2.20.0

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

Install-PSResource -Name PSGuerrilla -Version 2.20.0

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More

Owners

Copyright

(c) 2026 Jim Tyler. All rights reserved.

Package Details

Author(s)

  • Jim Tyler Microsoft MVP

Tags

GoogleWorkspace ActiveDirectory EntraID AzureAD Intune M365 Security CompromiseAssessment IncidentResponse ThreatDetection ADSecurity CloudSecurity NTLMRelay TierZero GUI WPF PSGuerrilla

Functions

Invoke-Recon Invoke-Surveillance Invoke-Watchtower Invoke-Wiretap Invoke-Lookout Get-DeadDrop Send-Signal Send-SignalSendGrid Send-SignalMailgun Send-SignalTwilio Send-SignalTeams Send-SignalSlack Send-SignalWebhook Send-SignalPagerDuty Send-SignalPushover Send-SignalSyslog Send-SignalEventLog Send-SignalDigest Set-Safehouse Test-Safehouse Get-Safehouse Register-Patrol Unregister-Patrol Get-Patrol Update-ThreatIntel Invoke-ReconDemo Invoke-Fortification Invoke-Reconnaissance Invoke-Infiltration Invoke-Campaign Get-GuerrillaScore Get-GuerrillaMaturity Get-QuickWins Get-ComplianceCrosswalk Export-BudgetJustification Export-ExecutiveSummary Export-TechnicalReport Export-RemediationPlaybook Export-RemediationScripts Set-RiskAcceptance Get-RiskAcceptance Get-TrendReport Export-ReportPdf Export-Dashboard Export-BloodHoundData Show-Guerrilla

Dependencies

This module has no dependencies.

Release Notes

v2.20.0: HTML reports now showcase the marquee capabilities instead of burying them. The AD reconnaissance report (Export-ReconnaissanceReportHtml) gains a Security Maturity (CMMI 1-5) section, an Attack Paths to Tier-0 section that renders the FULL transitive chains (HelpDesk -GenericAll-> CORP-Helpdesk-Admins -MemberOf-> Domain Admins, non-privileged sources first) instead of a buried finding-row preview, and a BloodHound export callout when -BloodHoundPath was used. The GWS report (Export-FortificationReportHtml) gains the Security Maturity section. The unified Campaign report (the one big report) gains Security Maturity + Attack Paths across all theaters. Invoke-Reconnaissance now runs the BloodHound export before report generation so the callout references an existing file. Shared helpers (Get-GuerrillaMaturitySectionHtml/Get-GuerrillaAttackPathSectionHtml) keep all three reports consistent. Report-only: no engine/check/scoring changes. 46 public functions, check counts unchanged. Test verify-report-sections.ps1 (15/15). PingCastle plan remaining: cartography (visual map). v2.19.0: New full-domain ACL collector (Get-ADFullDomainAcl, via Invoke-Reconnaissance -FullDomainAcl). Sweeps every group/user/computer/gMSA in the domain, parsing each DACL from binary nTSecurityDescriptor in one paged LDAP query (no per-object bind), and merges domain-wide dangerous control ACEs into ACLs.DangerousACEs - consumed unchanged by the transitive engine and the BloodHound export. FIX: ACE records now carry ObjectClass + ObjectSID + ObjectName so the engine classifies group targets (grp:) and chains actually form (e.g. HelpDesk -GenericAll-> CORP-Helpdesk-Admins -MemberOf-> Domain Admins); previously missing, so chains dead-ended regardless of coverage. Opt-in (off by default; heaviest read PSGuerrilla performs), MaxObjects cap 50000 with explicit truncation reporting (no silent caps), SID-resolution cache. Read-only. 46 public functions. Test verify-fulldomain-acl.ps1 (18/18). Check counts unchanged. PingCastle plan remaining: cartography (visual map). See CHANGELOG.md for v2.19.0 and earlier.

FileList

Version History

Version Downloads Last updated
2.37.0 5 6/27/2026
2.36.0 5 6/27/2026
2.35.0 6 6/26/2026
2.34.0 4 6/25/2026
2.33.0 3 6/25/2026
2.32.2 4 6/25/2026
2.32.1 4 6/25/2026
2.32.0 6 6/25/2026
2.31.0 7 6/24/2026
2.30.3 5 6/24/2026
2.30.2 5 6/24/2026
2.30.1 6 6/24/2026
2.30.0 6 6/24/2026
2.29.1 7 6/22/2026
2.29.0 4 6/22/2026
2.28.1 4 6/22/2026
2.28.0 4 6/22/2026
2.27.0 5 6/22/2026
2.26.0 7 6/22/2026
2.25.0 4 6/22/2026
2.24.0 8 6/22/2026
2.23.0 6 6/21/2026
2.22.0 8 6/21/2026
2.21.0 7 6/21/2026
2.20.1 5 6/21/2026
2.20.0 (current version) 4 6/21/2026
2.19.0 6 6/21/2026
2.18.0 7 6/21/2026
2.17.0 5 6/21/2026
2.16.0 5 6/21/2026
2.15.0 9 6/21/2026
2.14.1 8 6/20/2026
2.14.0 8 6/20/2026
2.13.0 7 6/20/2026
2.12.1 6 6/20/2026
2.12.0 9 6/20/2026
2.11.1 6 6/20/2026
2.11.0 5 6/19/2026
2.10.8 11 6/19/2026
2.10.7 16 6/19/2026
2.10.6 5 6/19/2026
2.10.5 6 6/19/2026
2.10.4 14 6/18/2026
2.10.3 9 6/18/2026
2.10.2 8 6/18/2026
2.10.1 7 6/18/2026
2.10.0 6 6/18/2026
2.9.4 7 6/18/2026
2.9.3 7 6/18/2026
2.9.2 5 6/18/2026
2.9.1 5 6/18/2026
2.9.0 9 6/17/2026
2.8.1 7 6/17/2026
2.8.0 7 6/17/2026
2.7.0 11 6/17/2026
2.6.0 6 6/16/2026
2.5.2 7 6/16/2026
2.5.1 6 6/16/2026
2.5.0 6 6/16/2026
2.4.4 6 6/16/2026
2.4.3 6 6/16/2026
2.4.2 7 6/16/2026
2.4.1 8 6/15/2026
2.4.0 9 6/11/2026
2.3.1 12 5/28/2026
2.3.0 5 5/28/2026
2.2.1 12 5/15/2026
2.2.0 4 5/15/2026
Show less