ACLGuard v2.0
Advanced Active Directory ACL Monitoring & Privilege Escalation Detection
ACLGuard v2.0
Advanced Active Directory ACL Analysis Tool
Overview
ACLGuard v2.0 is a next-generation Active Directory security tool designed to detect and prevent privilege escalation attacks through comprehensive ACL analysis. Built for red team operators and security professionals, it provides real-time monitoring of critical AD objects and identifies potential attack paths.
The Problem
Active Directory ACLs are often misconfigured, creating hidden privilege escalation paths that attackers can exploit. Traditional security tools miss these subtle configurations that can lead to domain compromise.
The Solution
ACLGuard continuously monitors AD ACLs, applies advanced analysis algorithms, and provides actionable insights to prevent privilege escalation attacks before they can be exploited.
Key Features
Real-time ACL Monitoring
Continuously monitors Active Directory ACLs for suspicious changes and privilege escalations.
Privilege Escalation Detection
Advanced algorithms to detect potential privilege escalation paths through ACL analysis.
Custom Rule Engine
Flexible rule-based system for custom security policies and compliance requirements.
Detailed Reporting
Comprehensive reports with visualizations and actionable security recommendations.
Architecture
ACL Parser
Extracts and parses Active Directory ACLs from domain controllers
Analysis Engine
Applies security rules and ML algorithms to detect threats
Reporting
Generates detailed reports and security recommendations
System Requirements
- • Windows 10/11 or Windows Server 2016+
- • Domain admin privileges for full functionality
- • Minimum 4GB RAM, 1GB disk space
- • Network access to domain controllers
Code Examples
Basic Usage
Basic ACLGuard Initialization
1 2 3 4 5 6 7 8 91011121314151617181920212223242526272829303132#include <stdio.h>#include <windows.h>#include "aclguard.h" int main() { ACLGuardConfig config = { .domain = "corp.local", .monitor_interval = 30, .log_level = LOG_INFO }; ACLGuard* guard = aclguard_init(&config); if (!guard) { fprintf(stderr, "Failed to initialize ACLGuard\n"); return 1; } // Start monitoring if (aclguard_start_monitoring(guard) != 0) { fprintf(stderr, "Failed to start monitoring\n"); aclguard_cleanup(guard); return 1; } printf("ACLGuard monitoring started successfully\n"); // Keep running getchar(); aclguard_cleanup(guard); return 0;}Advanced Configuration
Custom Rules and ML Detection
1 2 3 4 5 6 7 8 910111213141516171819202122232425262728// Advanced configuration exampleACLGuardConfig config = { .domain = "corp.local", .monitor_interval = 15, .log_level = LOG_DEBUG, .custom_rules = { .count = 3, .rules = { { .name = "Sensitive Group Changes", .pattern = "CN=Domain Admins,CN=Users", .action = ALERT_IMMEDIATE }, { .name = "Service Account ACLs", .pattern = "CN=Service Accounts", .action = ALERT_DAILY }, { .name = "Guest Account Access", .pattern = "CN=Guest,CN=Users", .action = ALERT_WEEKLY } } }, .output_format = OUTPUT_JSON, .enable_ml_detection = true};Installation Guide
Prerequisites
- • Visual Studio 2022 or GCC 9.0+
- • Windows SDK 10.0.19041.0 or later
- • Domain admin privileges
- • Network connectivity to domain controllers
Build from Source
Build Commands
git clone https://github.com/ForeverLX/ACLGuard-Active-Directory-Permission-Auditor.gitcd ACLGuardmkdir build && cd buildcmake ..make -j4sudo make installConfiguration
Create a configuration file to customize ACLGuard behavior:
Configuration File
# aclguard.confdomain = "corp.local"monitor_interval = 30log_level = "INFO"output_format = "JSON"enable_ml_detection = true [custom_rules]rule1 = "CN=Domain Admins,CN=Users:ALERT_IMMEDIATE"rule2 = "CN=Service Accounts:ALERT_DAILY"Development Journey
Initial Development
Core ACL parsing and analysis engine
Real-time Monitoring
Added live monitoring capabilities
Rule Engine
Custom rule system implementation
Advanced Analytics
Machine learning-based threat detection