PSGuerrilla
2.40.1
Minimum PowerShell version
7.0
Installation Options
Owners
Copyright
(c) 2026 Jim Tyler. All rights reserved.
Package Details
Author(s)
- Jim Tyler Microsoft MVP
Tags
GoogleWorkspace ActiveDirectory EntraID AzureAD Intune M365 Security CompromiseAssessment IncidentResponse ThreatDetection ADSecurity CloudSecurity NTLMRelay TierZero GUI WPF PSGuerrilla
Functions
Invoke-Recon Invoke-Surveillance Invoke-Watchtower Invoke-Wiretap Invoke-Lookout Get-DeadDrop Send-Signal Send-SignalSendGrid Send-SignalMailgun Send-SignalTwilio Send-SignalTeams Send-SignalSlack Send-SignalWebhook Send-SignalPagerDuty Send-SignalPushover Send-SignalSyslog Send-SignalEventLog Send-SignalDigest Set-Safehouse Test-Safehouse Get-Safehouse Register-Patrol Unregister-Patrol Get-Patrol Update-ThreatIntel Invoke-ReconDemo Invoke-Fortification Invoke-Reconnaissance Invoke-Infiltration Invoke-Campaign Get-GuerrillaScore Get-GuerrillaMaturity Get-QuickWins Get-ComplianceCrosswalk Test-GuerrillaConditionalAccess Export-BudgetJustification Export-ExecutiveSummary Export-TechnicalReport Export-RemediationPlaybook Export-RemediationScripts Set-RiskAcceptance Get-RiskAcceptance Get-TrendReport Export-ReportPdf Export-Dashboard Export-BloodHoundData Export-GuerrillaJUnit Get-GuerrillaCIGate Show-Guerrilla Get-ZeroTrustScore
Dependencies
This module has no dependencies.
Release Notes
v2.40.1: Fixes the Gemini audit-log derivation. Live-tenant validation showed Google names generative-AI audit settings gen_ai_* (not 'gemini'/'generative') and emits them under CHANGE_CHROME_OS_USER_SETTING, so the 2.40.0 matching found nothing and GWS-GEMINI-002/003/004/005 always SKIPped. Scoping now covers gen_ai/gemini/generative over any *_SETTING change event; a two-level match keeps it safe (no spurious verdicts from unrelated gen_ai settings). Still inference, still labeled as such; the exact Workspace-Gemini literals remain pending one live change event, so it SKIPs safely on no match. v2.40.0: Partner/GDAP delegated-access review + Gemini deep-settings coverage. Two new Entra checks model the partner attack path: EIDTNT-015 fails when a CSP/partner delegated-admin (GDAP) relationship grants a Tier-0 directory role (the Kaseya-class propagation path), EIDTNT-016 flags long-lived auto-extending grants; a failed collection is Not Assessed, never a clean pass. The four Gemini deep settings (Alpha features, conversation history, retention, sharing) are in no config API, so PSGuerrilla now infers them from Google Admin audit-log setting-change events (the source ScubaGoggles uses) and labels every such verdict as inferred with its source timestamp; absent a change event it honestly SKIPs. Also fixes DEVICE-009 false-WARN on tenants with zero Chrome OS devices (empty-array trap). Backed by 18 new golden fixtures, a GDAP collector query-contract test, and a Gemini derivation unit test. v2.39.0: Zero Trust posture is now first-class. Every check declares a CISA ZTMM pillar and a 0-3 weight in its definition, carried onto every finding, so you can filter and score by pillar straight from the pipeline. New public Get-ZeroTrustScore returns a weighted posture score per pillar (PASS/WARN/FAIL credit; Not-Assessed excluded from the denominator) plus a Coverage-Confidence marker (Solid/Moderate/Directional) so a score from a thin pillar discloses that instead of reading as authoritative; the Infiltration HTML report renders the pillar line on its cover. A schema test in CI and the release gate fails the build if any check omits its ZT stance. Description narrowed Azure to Azure identity-plane to match real coverage. v2.38.0: Reliability and correctness fixes from live-tenant validation (read-only; no check-count or public-surface change). Fixed three collector under-fetch defects that produced wrong verdicts on live tenants while passing offline fixtures: cross-tenant access (EIDTNT-005) now collects the default policy so an all-inbound and outbound B2B default is flagged instead of passing; Intune configuration profiles (INTUNE-005) now request assignment data so assigned profiles are no longer reported unassigned; PIM eligibility (EIDPIM-010) now reads eligibility schedule definitions so standing eligible assignments are detected instead of reporting PIM not configured. Fixed an empty-collection dead-branch in about ten checks (Exchange anti-spam, anti-malware, Safe Attachments, Safe Links, transport rules; mobile-device MDM; Google alert rules; AD GPO inventory): a connected tenant with zero policies now returns the correct verdict (for example zero anti-malware policies or zero alert rules now FAIL) instead of being swallowed to SKIP or WARN; Not-Assessed-on-collection-error is preserved. Gave two AD checks a reachable path: AD GPO Restricted Groups (ADGPO-017) now passes in the clean state, and AD CS ESC9 binding enforcement (ADCS-012) reports Not Assessed when the registry value was not collected instead of a permanent WARN. Hardened alerting: Send-Signal no longer crashes when piped monitor results that expose Severity rather than ThreatLevel, signal formatting no longer aborts all channels on a null timestamp, and Register-Patrol no longer reports success when task registration actually failed. Added collector query-contract tests that assert the exact Graph endpoints and parameters the collectors request, plus regression fixtures for the corrected verdicts. v2.37.0: Fixed 7 Entra PIM privileged-account checks (EIDPIM-004/005/006/007/008/009/013) that referenced an undefined variable and threw at runtime instead of returning a verdict. They now evaluate the collected privileged-user set behind a Not Assessed guard and correctly flag guest accounts in privileged roles, on-premises-synced admins, privileged users without MFA or with weak-only MFA, disabled accounts that still hold privileged roles, never-signed-in privileged accounts, and separate-admin naming. Surfaced by the detection-test suite, which now also covers all 44 EIDSCA controls and the repaired PIM checks (1,583 fixtures; test-only, no public-surface change). v2.36.0: Added a golden-fixture detection-test suite for the security checks. 468 of 580 checks (every Critical, High, and Medium control) are now validated by synthetic fixtures that feed known-good, known-bad, and uncollectable data through the real check functions and assert the resulting verdict (PASS / FAIL / WARN / Not Assessed), pinning each check's contract so a regression that silently changes a verdict fails the test run. 1,288 fixtures run under Pester in a few seconds and surfaced several latent verdict defects, which are tracked for fixing. The installable module surface and all check behavior are unchanged — the suite lives in the repository. v2.35.0: Honesty fix across all theaters — a control whose data fails to collect now reports Not Assessed instead of PASS. Previously a Graph throttle/error or an AD enumeration failure could leave a check scoring "clean" on data it never saw. Invoke-GraphApi now fails loud by default so collectors record the failure (continuous-monitoring collectors opt out), a shared Get-NotAssessedFinding guard fronts the checks, and ~285 check sites consult their collector error map before passing on empty. Read-only; no check-count or public-surface change. v2.34.0: GUI — new Signals tab in Show-Guerrilla to manage alert providers. Add / remove / test Microsoft Teams, Slack, generic Webhook, PagerDuty, Pushover, SendGrid, Mailgun, Twilio, Syslog, and Windows Event Log signals (secrets stored in the vault, consistent with the CLI Send-Signal path), set the alert threshold, toggle alerting, and configure duplicate suppression. Each provider has a Test button that sends a synthetic alert through the real send path so you can confirm it works. v2.33.0: Reports — the Professional style is now the default for all HTML reports (Campaign / Reconnaissance / Infiltration / Fortification), and findings now list their affected entities as a bulleted list instead of a comma-separated paragraph across all four theater reports. v2.32.2: Fix — the GUI single-instance guard is now advisory. If the lock is held by a stranded process (a prior launch whose window got lost behind the hidden console), you are prompted to open a new window anyway instead of being blocked outright. The window also comes to the front on launch (Activate + brief Topmost) so it cannot open hidden behind other windows. v2.32.1: Fix — the GUI single-instance guard could falsely report "PSGuerrilla is already open in another window" when a prior launch left the lock held (window closed abnormally, or a still-alive session). The lock is now self-healing: a stale handle from this session is disposed, an abandoned lock from a dead process is reclaimed, and the lock is always released on close. See CHANGELOG.md for v2.32 and earlier.
FileList
- PSGuerrilla.nuspec
- Private\AD\Checks\Invoke-ADLoggingChecks.ps1
- Private\EntraMonitor\Detections\Test-EntraRiskySignIn.ps1
- Private\Entra\Core\Get-EntraAuthMethodsData.ps1
- Private\ADMonitor\Core\Get-ADMonitorThreatScore.ps1
- LICENSE
- Public\Set-RiskAcceptance.ps1
- Public\Invoke-Lookout.ps1
- Data\SuspiciousCountries.json
- Private\Core\Save-TheaterState.ps1
- Private\Google\Invoke-GoogleAdminApi.ps1
- Private\Gui\Invoke-GuerrillaGuiAsync.ps1
- Private\Export\Export-ReconnaissanceReportCsv.ps1
- Private\Console\Get-FortificationScoreLabel.ps1
- Data\AuditChecks\OAuthSecurityChecks.json
- Data\AuditChecks\ADCertificateServicesChecks.json
- Private\AD\Core\New-LdapConnection.ps1
- Private\AD\Checks\Invoke-ADPrivilegedAccountChecks.ps1
- Private\EntraMonitor\Detections\Test-EntraUnfamiliarSignIn.ps1
- Private\Entra\Core\Get-EntraPIMData.ps1
- Private\ADMonitor\Core\Get-ADMonitorData.ps1
- CHANGELOG.md
- Public\Get-QuickWins.ps1
- Public\Update-ThreatIntel.ps1
- Data\VpnTorProxies.json
- Private\Core\Find-ThreatActorProfile.ps1
- Private\Graph\Invoke-GraphApi.ps1
- Private\Gui\Show-AddCredentialDialog.ps1
- Private\Export\Get-GuerrillaReportSectionHtml.ps1
- Private\Console\Write-SpectreProgress.ps1
- Data\AuditChecks\CollaborationChecks.json
- Data\AuditChecks\DriveSecurityChecks.json
- Private\AD\Core\Get-ADReplicationHealth.ps1
- Private\AD\Checks\Invoke-ADKerberosChecks.ps1
- Private\EntraMonitor\Detections\Test-EntraAppPermissionGrant.ps1
- Private\Entra\Core\Get-M365ServiceData.ps1
- Private\ADMonitor\Core\Compare-ADBaseline.ps1
- PSGuerrilla.format.ps1xml
- Public\Send-SignalPagerDuty.ps1
- Public\Get-DeadDrop.ps1
- Data\ComplianceCrosswalk.json
- Private\Core\Invoke-AlertEscalation.ps1
- Private\Graph\Get-GraphAccessToken.ps1
- Private\Gui\Get-GuerrillaGuiTheme.ps1
- Private\Export\Export-FortificationReportHtml.ps1
- Private\Console\Write-InterceptAlert.ps1
- Data\AuditChecks\ADStaleObjectChecks.json
- Data\AuditChecks\ADNetworkChecks.json
- Private\AD\Core\Get-ADAttackPath.ps1
- Private\AD\Checks\Invoke-ADStaleObjectChecks.ps1
- Private\EntraMonitor\Detections\Test-EntraGlobalAdminAssignment.ps1
- Private\Entra\Core\Get-IntuneData.ps1
- Private\ADMonitor\Core\Get-ADBaseline.ps1
- AI-USAGE.md
- Public\Send-SignalSyslog.ps1
- Public\Get-ComplianceCrosswalk.ps1
- Data\ThreatActorProfiles.json
- Private\Core\Test-ConcurrentSessions.ps1
- Private\Graph\Test-GraphModuleAvailability.ps1
- Private\Gui\Show-AddSignalDialog.ps1
- Private\Export\Export-TrendReportHtml.ps1
- Private\Console\Write-SpectrePanel.ps1
- Data\AuditChecks\M365TeamsChecks.json
- Data\AuditChecks\EntraTenantChecks.json
- Private\AD\Core\Get-ADTransitiveAttackPath.ps1
- Private\AD\Checks\Invoke-ADTradecraftChecks.ps1
- Private\EntraMonitor\Detections\Test-EntraPrivilegedRoleChange.ps1
- Private\Entra\Core\Get-EntraApplicationData.ps1
- Private\ADMonitor\Detections\Test-ADServiceAccountCreation.ps1
- README.md
- Public\Invoke-Wiretap.ps1
- Public\Export-RemediationPlaybook.ps1
- Data\RemediationCosts.json
- Private\Core\Test-AfterHoursLogin.ps1
- Private\Graph\Invoke-AzureRMApi.ps1
- Private\Gui\Show-GuerrillaWindow.ps1
- Private\Export\Export-CampaignReportJson.ps1
- Private\Console\Write-SurveillanceReport.ps1
- Data\AuditChecks\ADLoggingChecks.json
- Data\AuditChecks\LoggingAlertingChecks.json
- Private\AD\Core\Get-ADStaleObjects.ps1
- Private\M365Monitor\Core\Get-M365MonitorThreatScore.ps1
- Private\EntraMonitor\Detections\Test-EntraSubscriptionPermChange.ps1
- Private\Entra\Core\Get-EntraConditionalAccessData.ps1
- Private\ADMonitor\Detections\Test-ADSensitivePasswordChange.ps1
- PSGuerrilla-Sample-Report.html
- Public\Invoke-Recon.ps1
- Public\Invoke-Reconnaissance.ps1
- Data\CloudIpRanges.json
- Private\Core\Get-IpGeoData.ps1
- Private\Audit\Invoke-DriveSecurityChecks.ps1
- Private\Export\Export-InfiltrationReportJson.ps1
- Private\Export\Export-DashboardHtml.ps1
- Private\Console\Write-GuerrillaBanner.ps1
- Data\AuditChecks\ADLogonScriptChecks.json
- Data\AuditChecks\DeviceManagementChecks.json
- Private\AD\Core\Get-ADKerberosConfig.ps1
- Private\M365Monitor\Core\Get-M365AuditEvents.ps1
- Private\EntraMonitor\Detections\Test-EntraCAPolicyChange.ps1
- Private\Entra\Core\Get-EntraFederationData.ps1
- Private\ADMonitor\Detections\Test-ADAdminSDHolderChange.ps1
- CONTRIBUTING.md
- Public\Send-SignalWebhook.ps1
- Public\Unregister-Patrol.ps1
- Data\HighRiskOAuthApps.json
- Private\Core\Get-ResourceConstrainedFixes.ps1
- Private\Audit\Invoke-EmailSecurityChecks.ps1
- Private\Export\Export-WiretapReportCsv.ps1
- Private\Export\Export-FieldReportJson.ps1
- Private\Console\Initialize-SpectreCapability.ps1
- Data\AuditChecks\EntraFedChecks.json
- Data\AuditChecks\ADDomainForestChecks.json
- Private\AD\Core\Get-ADGroupPolicyObjects.ps1
- Private\M365Monitor\Core\New-M365ChangeProfile.ps1
- Private\EntraMonitor\Detections\Test-EntraAuthMethodChange.ps1
- Private\Entra\Core\Resolve-CAWhatIf.ps1
- Private\ADMonitor\Detections\Test-ADPrivilegedGroupChange.ps1
- PSGuerrilla.psd1
- Public\Get-RiskAcceptance.ps1
- Public\Get-ZeroTrustScore.ps1
- Data\KnownAttackerIps.json
- Private\Core\Initialize-ConfigMigration.ps1
- Private\Audit\Resolve-GooglePolicyValue.ps1
- Private\Export\Export-WatchtowerReportJson.ps1
- Private\Export\Format-SignalContent.ps1
- Private\Console\Write-SpectreBarChart.ps1
- Data\AuditChecks\EntraAppChecks.json
- Data\AuditChecks\GoogleTradecraftChecks.json
- Private\AD\Core\Get-ADCertificateServices.ps1
- Private\M365Monitor\Detections\Test-M365PowerAutomateFlow.ps1
- Private\EntraMonitor\Detections\Test-EntraPasswordSpray.ps1
- Private\Entra\Checks\Invoke-EntraAppChecks.ps1
- Private\ADMonitor\Detections\Test-ADCertTemplateChange.ps1
- PSGuerrilla.psm1
- Public\Test-Safehouse.ps1
- Public\Send-SignalSlack.ps1
- Private\Core\Get-AlertDeduplication.ps1
- Private\Core\Test-BruteForce.ps1
- Private\Audit\Compare-FortificationState.ps1
- Private\Export\Get-GuerrillaReportTheme.ps1
- Private\Export\Export-SurveillanceReportJson.ps1
- Private\Console\Write-SpectreTree.ps1
- Data\AuditChecks\EntraPIMChecks.json
- Data\AuditChecks\ADPrivilegedAccountChecks.json
- Private\AD\Core\Get-ADUserRightsAssignment.ps1
- Private\M365Monitor\Detections\Test-M365DLPPolicyChange.ps1
- Private\EntraMonitor\Detections\Test-EntraAdminUnitChange.ps1
- Private\Entra\Checks\Invoke-M365PowerPlatformChecks.ps1
- Private\ADMonitor\Detections\Test-ADDelegationChange.ps1
- Public\Send-SignalPushover.ps1
- Public\Invoke-Infiltration.ps1
- Private\Core\Test-UserSuspension.ps1
- Private\Core\Test-WorkspaceSettingChange.ps1
- Private\Audit\Get-FortificationData.ps1
- Private\Export\Export-WiretapReportHtml.ps1
- Private\Export\Export-ReconnaissanceReportHtml.ps1
- Private\Console\Write-WiretapReport.ps1
- Data\AuditChecks\ADAttackPathChecks.json
- Data\AuditChecks\EntraAuthChecks.json
- Private\AD\Core\Get-ADTradecraftSignals.ps1
- Private\M365Monitor\Detections\Test-M365EDiscoverySearch.ps1
- Private\EntraMonitor\Detections\Test-EntraLeakedCredential.ps1
- Private\Entra\Checks\Invoke-EntraPIMChecks.ps1
- Private\ADMonitor\Detections\Test-ADKrbtgtChange.ps1
- action.yml
- Public\Get-TrendReport.ps1
- Public\Get-Patrol.ps1
- Private\Core\Update-ThreatIntelData.ps1
- Private\Core\Get-LocalizedString.ps1
- Private\Audit\Invoke-LoggingAlertingChecks.ps1
- Private\Export\Export-FieldReportCsv.ps1
- Private\Vault\Test-CredentialConnectivity.ps1
- Private\Console\Write-FieldReport.ps1
- Data\AuditChecks\GwsServiceChecks.json
- Data\AuditChecks\M365SharePointChecks.json
- Private\AD\Core\Get-ADFullDomainAcl.ps1
- Private\M365Monitor\Detections\Test-M365ForwardingRule.ps1
- Private\EntraMonitor\Detections\Test-EntraImpossibleTravel.ps1
- Private\Entra\Checks\Invoke-EntraFedChecks.ps1
- Private\ADMonitor\Detections\Test-ADReplicationAnomaly.ps1
- Config\guerrilla-config-schema.json
- Public\Export-BloodHoundData.ps1
- Public\Export-Dashboard.ps1
- Private\Core\Test-EmailForwarding.ps1
- Private\Core\Test-UserAgentAnomaly.ps1
- Private\Audit\Invoke-OAuthSecurityChecks.ps1
- Private\Export\Export-WatchtowerReportCsv.ps1
- Private\Vault\Get-SafehouseSecret.ps1
- Private\Console\Write-FortificationReport.ps1
- Data\AuditChecks\TierZeroChecks.json
- Data\AuditChecks\M365DefenderChecks.json
- Private\AD\Core\Get-ADPasswordHashQuality.ps1
- Private\M365Monitor\Detections\Test-M365DefenderAlertChange.ps1
- Private\EntraMonitor\Detections\Test-EntraGuestInvitation.ps1
- Private\Entra\Checks\Invoke-EntraAuthChecks.ps1
- Private\ADMonitor\Detections\Test-ADDCSyncPermission.ps1
- Config\guerrilla-defaults.json
- Public\Send-SignalDigest.ps1
- Public\Send-Signal.ps1
- Private\Core\Test-NewDevice.ps1
- Private\Core\Invoke-PendingKeyFileCleanup.ps1
- Private\Audit\Get-GuerrillaSimulatedFindings.ps1
- Private\Export\Export-CampaignReportCsv.ps1
- Private\Vault\Save-SafehouseCredentialSet.ps1
- Private\Console\Write-InfiltrationReport.ps1
- Data\AuditChecks\M365AuditChecks.json
- Data\AuditChecks\IntuneChecks.json
- Private\AD\Core\Get-ADObjectACLs.ps1
- Private\M365Monitor\Detections\Test-M365TeamsExternalAccess.ps1
- Private\EntraMonitor\Detections\Test-EntraAnomalousToken.ps1
- Private\Entra\Checks\Invoke-EntraTenantChecks.ps1
- Private\ADMonitor\Detections\Test-ADGPOLinkChange.ps1
- Samples\Campaign-AllFail.html
- Public\Get-GuerrillaCIGate.ps1
- Public\Export-BudgetJustification.ps1
- Private\Core\New-UserCompromiseProfile.ps1
- Private\Core\Get-CloudIpClassification.ps1
- Private\Audit\Get-AuditCategoryDefinitions.ps1
- Private\Export\Export-SurveillanceReportCsv.ps1
- Private\Vault\Get-SafehouseCredentialView.ps1
- Private\Console\Write-ProgressLine.ps1
- Data\AuditChecks\M365ExchangeChecks.json
- Private\AD\Core\Invoke-LdapQuery.ps1
- Private\AD\Core\Get-ADTierZeroSignals.ps1
- Private\M365Monitor\Detections\Test-M365ExternalSharingChange.ps1
- Private\EntraMonitor\Detections\Test-EntraAnonymousIp.ps1
- Private\Entra\Checks\Invoke-EntraCAChecks.ps1
- Private\ADMonitor\Detections\Test-ADTrustChange.ps1
- Samples\Reconnaissance-AllFail.html
- Public\Invoke-ReconDemo.ps1
- Public\Test-GuerrillaConditionalAccess.ps1
- Private\Core\Save-OperationState.ps1
- Private\Core\Get-OperationState.ps1
- Private\Audit\Invoke-CollaborationChecks.ps1
- Private\Export\Export-FortificationReportJson.ps1
- Private\Vault\Show-SafehouseStatus.ps1
- Private\Console\Get-GuerrillaScoreLabel.ps1
- Data\AuditChecks\ADKerberosChecks.json
- Private\AD\Core\Get-ADDomainInfo.ps1
- Private\AD\Checks\Invoke-ADNetworkChecks.ps1
- Private\M365Monitor\Detections\Test-M365AuditLogDisablement.ps1
- Private\EntraMonitor\Detections\Test-EntraServicePrincipalCred.ps1
- Private\Entra\Checks\Invoke-AzureIAMChecks.ps1
- Private\ADMonitor\Detections\Test-ADLdapQueryAnomaly.ps1
- Samples\Fortification-AllFail-Professional.html
- Public\Get-GuerrillaScore.ps1
- Public\Send-SignalEventLog.ps1
- Private\Core\Test-DriveExternalSharing.ps1
- Private\Core\Test-DomainWideDelegation.ps1
- Private\Audit\Invoke-GoogleTradecraftChecks.ps1
- Private\Export\Export-CampaignReportHtml.ps1
- Private\Vault\Initialize-GuerrillaVault.ps1
- Private\Console\Write-WatchtowerReport.ps1
- Data\AuditChecks\ADAclDelegationChecks.json
- Private\AD\Core\Resolve-ADSid.ps1
- Private\AD\Checks\Invoke-ADPasswordPolicyChecks.ps1
- Private\M365Monitor\Detections\Test-M365BulkFileExfiltration.ps1
- Private\EntraMonitor\Detections\Test-EntraAuditLogGap.ps1
- Private\Entra\Checks\Invoke-M365AuditChecks.ps1
- Private\ADMonitor\Detections\Test-ADOUPermissionChange.ps1
- Samples\Reconnaissance-AllFail-Professional.html
- Public\Invoke-Watchtower.ps1
- Public\Show-Guerrilla.ps1
- Private\Core\Add-ScanHistoryEntry.ps1
- Private\Core\Get-ThreatScore.ps1
- Private\Audit\Get-NotAssessedFinding.ps1
- Private\Export\Export-ReconnaissanceReportJson.ps1
- Private\Vault\Set-GuerrillaCredential.ps1
- Private\Console\Write-CampaignReport.ps1
- Data\AuditChecks\ADPasswordPolicyChecks.json
- Private\AD\Core\Get-ADPrivilegedMembers.ps1
- Private\AD\Checks\Invoke-ADDomainForestChecks.ps1
- Private\M365Monitor\Detections\Test-M365TransportRuleChange.ps1
- Private\EntraMonitor\Detections\Test-EntraTenantSettingChange.ps1
- Private\Entra\Checks\Invoke-EntraEidscaChecks.ps1
- Private\ADMonitor\Detections\Test-ADEnterpriseAdminChange.ps1
- Samples\Infiltration-AllFail.html
- Public\Send-SignalTwilio.ps1
- Public\Get-GuerrillaMaturity.ps1
- Private\Core\Test-HighRiskOAuthApp.ps1
- Private\Core\Test-AdminAction.ps1
- Private\Audit\New-AuditFinding.ps1
- Private\Export\Export-SurveillanceReportHtml.ps1
- Private\Vault\Get-VaultMetadata.ps1
- Private\Console\Write-OperationHeader.ps1
- Data\AuditChecks\EidscaChecks.json
- Private\AD\Core\Test-ADModuleAvailability.ps1
- Private\AD\Checks\Invoke-ADTrustChecks.ps1
- Private\EntraMonitor\Core\Get-EntraDirectoryAudits.ps1
- Private\EntraMonitor\Detections\Test-EntraFederationChange.ps1
- Private\Entra\Checks\Invoke-M365DefenderChecks.ps1
- Private\ADMonitor\Detections\Test-ADSchemaChange.ps1
- Samples\Fortification-AllFail.html
- Public\Send-SignalSendGrid.ps1
- Public\Register-Patrol.ps1
- Private\Core\Test-BulkFileDownload.ps1
- Private\Google\Get-GoogleCloudIdentityPolicies.ps1
- Private\Audit\Resolve-DomainMailSecurity.ps1
- Private\Export\Export-FieldReportHtml.ps1
- Private\Vault\Set-VaultMetadata.ps1
- Data\Profiles\K12-Baseline.json
- Data\AuditChecks\M365PowerPlatformChecks.json
- Private\AD\Core\Get-ReconnaissanceData.ps1
- Private\AD\Checks\Invoke-ADGroupPolicyChecks.ps1
- Private\EntraMonitor\Core\Get-EntraSignInEvents.ps1
- Private\Entra\Core\Get-InfiltrationData.ps1
- Private\Entra\Checks\Invoke-M365SharePointChecks.ps1
- Private\ADMonitor\Detections\Test-ADDomainAdminChange.ps1
- Samples\Infiltration-AllFail-Professional.html
- Public\Export-GuerrillaJUnit.ps1
- Public\Get-Safehouse.ps1
- Private\Core\Get-TheaterState.ps1
- Private\Google\ConvertTo-GeminiDerivedSettings.ps1
- Private\Audit\Get-AuditPostureScore.ps1
- Private\Export\Export-WatchtowerReportHtml.ps1
- Private\Vault\Get-GuerrillaCredential.ps1
- Data\Profiles\Default-Baseline.json
- Data\AuditChecks\AuthenticationChecks.json
- Private\AD\Core\Get-ADTrustRelationships.ps1
- Private\AD\Checks\Invoke-ADAclDelegationChecks.ps1
- Private\EntraMonitor\Core\Get-EntraMonitorThreatScore.ps1
- Private\Entra\Core\Get-EntraTenantData.ps1
- Private\Entra\Checks\Invoke-M365ExchangeChecks.ps1
- Private\ADMonitor\Detections\Test-ADDnsRecordChange.ps1
- Samples\Campaign-AllFail-Professional.html
- Public\Send-SignalMailgun.ps1
- Public\Export-ExecutiveSummary.ps1
- Private\Core\Hide-ConfigSecret.ps1
- Private\Google\Get-GoogleAccessToken.ps1
- Private\Audit\Invoke-AdminManagementChecks.ps1
- Private\Export\Export-WiretapReportJson.ps1
- Private\Vault\Read-MissionConfig.ps1
- Data\Localization\en-US.json
- Data\AuditChecks\ADTradecraftChecks.json
- Private\AD\Core\Get-ADNetworkConfig.ps1
- Private\AD\Checks\Invoke-ADLogonScriptChecks.ps1
- Private\EntraMonitor\Core\New-EntraRiskProfile.ps1
- Private\Entra\Core\Test-EntraConnectVersionCurrent.ps1
- Private\Entra\Checks\Invoke-IntuneChecks.ps1
- Private\ADMonitor\Detections\Test-ADGPOChange.ps1
- Samples\Generate-SampleReports.ps1
- Public\Export-TechnicalReport.ps1
- Public\Invoke-Fortification.ps1
- Private\Core\Get-GuerrillaScoreCalculation.ps1
- Private\Google\Invoke-GoogleReportsApi.ps1
- Private\Audit\Invoke-DeviceManagementChecks.ps1
- Private\Export\Export-InfiltrationReportHtml.ps1
- Private\Console\Write-GuerrillaText.ps1
- Data\AuditChecks\ADGroupPolicyChecks.json
- Data\AuditChecks\AdminManagementChecks.json
- Private\AD\Core\Get-ADDomainControllers.ps1
- Private\AD\Checks\Invoke-ADCertificateServicesChecks.ps1
- Private\EntraMonitor\Core\Get-EntraRiskDetections.ps1
- Private\Entra\Core\Get-AzureIAMData.ps1
- Private\Entra\Checks\Invoke-M365TeamsChecks.ps1
- Private\ADMonitor\Detections\Test-ADCertEnrollmentAnomaly.ps1
- Samples\Reconnaissance-BloodHound.json
- Public\Set-Safehouse.ps1
- Public\Invoke-Surveillance.ps1
- Private\Core\Test-2svDisablement.ps1
- Private\Google\New-GoogleJwt.ps1
- Private\Audit\Invoke-AuthenticationChecks.ps1
- Private\Export\Export-FortificationReportCsv.ps1
- Private\Console\Write-ReconnaissanceReport.ps1
- Data\AuditChecks\ADTrustChecks.json
- Data\AuditChecks\AzureIAMChecks.json
- Private\AD\Core\Get-ADPasswordPolicies.ps1
- Private\AD\Checks\Invoke-ADAttackPathChecks.ps1
- Private\EntraMonitor\Detections\Test-EntraMalwareIp.ps1
- Private\Entra\Core\Resolve-EidscaControl.ps1
- Private\ADMonitor\Core\New-ADChangeProfile.ps1
- Private\ADMonitor\Detections\Test-ADComputerAccountCreation.ps1
- Public\Invoke-Campaign.ps1
- Public\Export-ReportPdf.ps1
- Public\Send-SignalTeams.ps1
- Private\Core\Test-ImpossibleTravel.ps1
- Private\Google\Get-GoogleGroupSettings.ps1
- Private\Audit\Invoke-GwsServiceChecks.ps1
- Private\Export\Export-InfiltrationReportCsv.ps1
- Private\Console\Write-SpectreTable.ps1
- Data\AuditChecks\EntraCAChecks.json
- Data\AuditChecks\EmailSecurityChecks.json
- Private\AD\Core\Get-ADLogonScripts.ps1
- Private\AD\Checks\Invoke-TierZeroChecks.ps1
- Public\Export-RemediationScripts.ps1
Version History
| Version | Downloads | Last updated |
|---|---|---|
| 2.46.3 | 4 | 7/8/2026 |
| 2.40.1 (current version) | 6 | 7/7/2026 |
| 2.40.0 | 6 | 7/7/2026 |
| 2.39.0 | 8 | 7/7/2026 |
| 2.38.0 | 13 | 6/28/2026 |
| 2.37.0 | 7 | 6/27/2026 |
| 2.36.0 | 8 | 6/27/2026 |
| 2.35.0 | 7 | 6/26/2026 |
| 2.34.0 | 6 | 6/25/2026 |
| 2.33.0 | 4 | 6/25/2026 |
| 2.32.2 | 6 | 6/25/2026 |
| 2.32.1 | 6 | 6/25/2026 |
| 2.32.0 | 7 | 6/25/2026 |
| 2.31.0 | 9 | 6/24/2026 |
| 2.30.3 | 6 | 6/24/2026 |
| 2.30.2 | 6 | 6/24/2026 |
| 2.30.1 | 7 | 6/24/2026 |
| 2.30.0 | 7 | 6/24/2026 |
| 2.29.1 | 8 | 6/22/2026 |
| 2.29.0 | 5 | 6/22/2026 |
| 2.28.1 | 5 | 6/22/2026 |
| 2.28.0 | 5 | 6/22/2026 |
| 2.27.0 | 6 | 6/22/2026 |
| 2.26.0 | 8 | 6/22/2026 |
| 2.25.0 | 6 | 6/22/2026 |
| 2.24.0 | 9 | 6/22/2026 |
| 2.23.0 | 7 | 6/21/2026 |
| 2.22.0 | 10 | 6/21/2026 |
| 2.21.0 | 8 | 6/21/2026 |
| 2.20.1 | 6 | 6/21/2026 |
| 2.20.0 | 5 | 6/21/2026 |
| 2.19.0 | 7 | 6/21/2026 |
| 2.18.0 | 8 | 6/21/2026 |
| 2.17.0 | 6 | 6/21/2026 |
| 2.16.0 | 6 | 6/21/2026 |
| 2.15.0 | 10 | 6/21/2026 |
| 2.14.1 | 9 | 6/20/2026 |
| 2.14.0 | 9 | 6/20/2026 |
| 2.13.0 | 8 | 6/20/2026 |
| 2.12.1 | 7 | 6/20/2026 |
| 2.12.0 | 10 | 6/20/2026 |
| 2.11.1 | 7 | 6/20/2026 |
| 2.11.0 | 6 | 6/19/2026 |
| 2.10.8 | 12 | 6/19/2026 |
| 2.10.7 | 17 | 6/19/2026 |
| 2.10.6 | 6 | 6/19/2026 |
| 2.10.5 | 7 | 6/19/2026 |
| 2.10.4 | 14 | 6/18/2026 |
| 2.10.3 | 9 | 6/18/2026 |
| 2.10.2 | 8 | 6/18/2026 |
| 2.10.1 | 7 | 6/18/2026 |
| 2.10.0 | 6 | 6/18/2026 |
| 2.9.4 | 7 | 6/18/2026 |
| 2.9.3 | 7 | 6/18/2026 |
| 2.9.2 | 5 | 6/18/2026 |
| 2.9.1 | 5 | 6/18/2026 |
| 2.9.0 | 15 | 6/17/2026 |
| 2.8.1 | 13 | 6/17/2026 |
| 2.8.0 | 13 | 6/17/2026 |
| 2.7.0 | 17 | 6/17/2026 |
| 2.6.0 | 6 | 6/16/2026 |
| 2.5.2 | 7 | 6/16/2026 |
| 2.5.1 | 6 | 6/16/2026 |
| 2.5.0 | 6 | 6/16/2026 |
| 2.4.4 | 6 | 6/16/2026 |
| 2.4.3 | 6 | 6/16/2026 |
| 2.4.2 | 7 | 6/16/2026 |
| 2.4.1 | 8 | 6/15/2026 |
| 2.4.0 | 9 | 6/11/2026 |
| 2.3.1 | 15 | 5/28/2026 |
| 2.3.0 | 8 | 5/28/2026 |
| 2.2.1 | 13 | 5/15/2026 |
| 2.2.0 | 5 | 5/15/2026 |