Skip to main content

ACLGuard v2.0

Advanced Active Directory ACL Monitoring & Privilege Escalation Detection

🔐

ACLGuard v2.0

Advanced Active Directory ACL Analysis Tool

Active Development
24
🍴8
C
MIT License

Overview

ACLGuard v2.0 is a next-generation Active Directory security tool designed to detect and prevent privilege escalation attacks through comprehensive ACL analysis. Built for red team operators and security professionals, it provides real-time monitoring of critical AD objects and identifies potential attack paths.

The Problem

Active Directory ACLs are often misconfigured, creating hidden privilege escalation paths that attackers can exploit. Traditional security tools miss these subtle configurations that can lead to domain compromise.

The Solution

ACLGuard continuously monitors AD ACLs, applies advanced analysis algorithms, and provides actionable insights to prevent privilege escalation attacks before they can be exploited.

Key Features

🔍

Real-time ACL Monitoring

Continuously monitors Active Directory ACLs for suspicious changes and privilege escalations.

Privilege Escalation Detection

Advanced algorithms to detect potential privilege escalation paths through ACL analysis.

🛡️

Custom Rule Engine

Flexible rule-based system for custom security policies and compliance requirements.

📊

Detailed Reporting

Comprehensive reports with visualizations and actionable security recommendations.

Architecture

🔍

ACL Parser

Extracts and parses Active Directory ACLs from domain controllers

🧠

Analysis Engine

Applies security rules and ML algorithms to detect threats

📊

Reporting

Generates detailed reports and security recommendations

System Requirements

  • • Windows 10/11 or Windows Server 2016+
  • • Domain admin privileges for full functionality
  • • Minimum 4GB RAM, 1GB disk space
  • • Network access to domain controllers

Code Examples

Basic Usage

Basic ACLGuard Initialization

c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
#include <stdio.h>
#include <windows.h>
#include "aclguard.h"
 
int main() {
ACLGuardConfig config = {
.domain = "corp.local",
.monitor_interval = 30,
.log_level = LOG_INFO
};
ACLGuard* guard = aclguard_init(&config);
if (!guard) {
fprintf(stderr, "Failed to initialize ACLGuard\n");
return 1;
}
// Start monitoring
if (aclguard_start_monitoring(guard) != 0) {
fprintf(stderr, "Failed to start monitoring\n");
aclguard_cleanup(guard);
return 1;
}
printf("ACLGuard monitoring started successfully\n");
// Keep running
getchar();
aclguard_cleanup(guard);
return 0;
}

Advanced Configuration

Custom Rules and ML Detection

c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
// Advanced configuration example
ACLGuardConfig config = {
.domain = "corp.local",
.monitor_interval = 15,
.log_level = LOG_DEBUG,
.custom_rules = {
.count = 3,
.rules = {
{
.name = "Sensitive Group Changes",
.pattern = "CN=Domain Admins,CN=Users",
.action = ALERT_IMMEDIATE
},
{
.name = "Service Account ACLs",
.pattern = "CN=Service Accounts",
.action = ALERT_DAILY
},
{
.name = "Guest Account Access",
.pattern = "CN=Guest,CN=Users",
.action = ALERT_WEEKLY
}
}
},
.output_format = OUTPUT_JSON,
.enable_ml_detection = true
};

Installation Guide

Prerequisites

  • • Visual Studio 2022 or GCC 9.0+
  • • Windows SDK 10.0.19041.0 or later
  • • Domain admin privileges
  • • Network connectivity to domain controllers

Build from Source

Build Commands

bash
git clone https://github.com/ForeverLX/ACLGuard-Active-Directory-Permission-Auditor.git
cd ACLGuard
mkdir build && cd build
cmake ..
make -j4
sudo make install

Configuration

Create a configuration file to customize ACLGuard behavior:

Configuration File

ini
# aclguard.conf
domain = "corp.local"
monitor_interval = 30
log_level = "INFO"
output_format = "JSON"
enable_ml_detection = true
 
[custom_rules]
rule1 = "CN=Domain Admins,CN=Users:ALERT_IMMEDIATE"
rule2 = "CN=Service Accounts:ALERT_DAILY"

Development Journey

Q4 2024

Initial Development

Core ACL parsing and analysis engine

Q1 2025

Real-time Monitoring

Added live monitoring capabilities

Q2 2025

Rule Engine

Custom rule system implementation

Q3 2025

Advanced Analytics

Machine learning-based threat detection

Technical Details

Tech Stack

CWindows APILDAPJSONSQLiteOpenSSL

Performance

Memory Usage:~50MB
CPU Usage:~2%
Scan Speed:1000+ objects/sec

Contributing

We welcome contributions! Please read our contributing guidelines and submit pull requests for any improvements or bug fixes.
Press ESC to return home