ADShield

ADShield is a comprehensive Active Directory security analysis and threat assessment platform. It is designed to identify misconfigurations, security baseline deviations, stale objects, and potential attack paths within an Active Directory environment. By correlating vulnerability data, ADShield generates interactive visual dashboards and structured reports to assist administrators and security professionals in prioritizing and tracking remediations.

---

Architecture Overview

ADShield consists of three main components:

1. Collection (adshield_collector.ps1): A PowerShell script executed on a domain-joined machine to extract necessary Active Directory configuration data in a standardized JSON format.
2. Analysis Core (core/): Modular Python analyzers that process the collected data to audit password policies, kerberoasting exposure, privileged accounts, stale objects, service account hygiene, and Group Policy Objects (GPOs). A central correlation engine links these risk indicators to map potential multi-stage attack paths.
3. Visualization & Triage (gui/): A PyQt5-based graphical user interface (GUI) displaying high-level threat metrics, detailed object explorers, remediation status trackers backed by SQLite, and hierarchical attack graphs.

---

Key Features

• Automated Active Directory Collection: Minimally invasive PowerShell collector gathers user, computer, group, GPO, and policy configurations without requiring administrative rights for most operations.
• Security Baseline Audits:
  • Password Policy Analyzer: Evaluates complexity, age, and lockout settings against industry standards.
  • SPN & Kerberoast Analyzer: Flags service accounts vulnerable to Kerberoasting attacks.
  • Privileged Accounts Analyzer: Identifies highly privileged accounts and highlights delegation risks.
  • Stale Objects Analyzer: Detects inactive user and computer accounts that may serve as entry points.
  • Service Account Hygiene Analyzer: Audits service account configurations and privilege levels.
  • GPO Baseline Analyzer: Assesses security baselines within GPOs for potential gaps.
• Cross-Risk Correlation: Evaluates how combined minor risks escalate to high-impact attack paths.
• Interactive Triage Center: Database-backed dashboard to track remediation tasks from "Unresolved" to "In Progress" or "Resolved".
• Visual Attack Paths: Hierarchical, left-to-right graphs showing progression pathways of potential lateral movement or privilege escalation.

---

Getting Started

Prerequisites

• Operating System: Windows (required for PowerShell collector execution, optional but recommended for Python analysis).
• Python: version 3.8 or higher.
• Domain Access: A domain-joined machine to execute the collector script.

Installation

1. Clone the repository:

   git clone https://github.com/bhaskarbhar/ADShield.git
   cd ADShield

2. Install the required Python dependencies:

   pip install -r requirements.txt

---

Usage Workflow

1. Data Collection

Run the PowerShell collector on a domain-joined machine to harvest the environment details:

.\adshield_collector.ps1

By default, the script outputs the gathered information to a timestamped folder containing several JSON files:

• password_policy.json
• spn_accounts.json
• privileged_accounts.json
• users_activity.json
• computers_activity.json
• service_accounts.json
• gpo_baseline.json
• Metadata and inventory files (e.g., domain_info.json, domain_controllers.json)

2. Command Line Analysis

To run a specific analysis module via the CLI:

python run_analysis.py --analyzer core.password_policy_analyzer --input path/to/password_policy.json --output reports/password_report.json

3. Graphical Interface

To launch the ADShield interactive dashboard:

python gui/main.py

From the landing page, select the output folder containing the collected JSON files to run the full pipeline, generate the final reports, and populate the dashboard.

---

Repository Structure

ADShield/
├── core/                       # Core analysis and pipeline logic
│   ├── correlation_engine.py   # Correlates findings to identify attack paths
│   ├── pipeline.py             # Orchestrates full data ingestion and analysis
│   ├── triage_db.py            # SQLite state management for remediations
│   └── *_analyzer.py           # Individual target security analyzers
├── gui/                        # PyQt5 GUI application files
│   ├── main.py                 # Application entry point
│   ├── dashboard.py            # Main metrics and triage dashboard
│   └── assets/                 # Stylesheets and JavaScript assets for visualization
├── reports/                    # Generated output HTML/JSON reports (git-ignored)
├── adshield_collector.ps1      # Active Directory collector script
├── requirements.txt            # Python dependencies list
└── run_analysis.py             # CLI runner script