This repository has been archived by the owner on Sep 2, 2022. It is now read-only.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Added the raw value for the UAC flag in the user's object for extensibility (The field is called "uac" and value si the integer value to keep it more compact in the final JSON dataset).
This has a few benefits:
Allows blue team to identify potentially problematic accounts using the Bloodhound datasets by running queries like:
match (u) where apoc.bitwise.op(u.uac, "&", 2097152) = 1 return u.name
matches all accounts with DES enabledmatch (u) where apoc.bitwise.op(u.uac, "&", 128) = 1 return u.name
matches all account with passwords stored using reversible encryptionIndividual properties could be added for those elements (just like the "Enabled" property that is derived from this flag), but this approach allows for future elements of the UAC flag to be taken into consideration without having to make changes to Sharphound.
It also allows red team to identify accounts using DES (with the query listed above) to avoid potential downgrade detection usecases.