Skip to content

features

Directory actions

More options

Directory actions

More options

Latest commit

 

History

History

features

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
README.md
README.md
 
 
active-directory.md
active-directory.md
 
 
azure-entra-id.md
azure-entra-id.md
 
 

README.md

Features

ETC Collector audits two major identity platforms and produces structured, machine-readable results in seconds.

Platforms Supported

Platform Protocol Community Pro Categories
Active Directory LDAP / LDAPS / SMB 261 277 14
Azure Entra ID Microsoft Graph API 148 158 9
Total 409 435 23

What Gets Analyzed

Active Directory

ETC connects to your domain controllers over LDAP/LDAPS and SYSVOL (SMB), collecting:

  • User accounts (all attributes, UAC flags, password policy, delegation, SID history)
  • Groups (membership, nesting, privileged groups, ownership)
  • Computers (OS version, delegation, LAPS, BitLocker, location in OU)
  • GPOs (security settings, permissions, links, registry policies)
  • Domain/forest trusts (direction, transitivity, SID filtering)
  • ACLs (object-level permissions — GenericAll, WriteDACL, DCSync rights, etc.)
  • AD CS (certificate templates, CA configuration)
  • Kerberos policy (ticket lifetimes, encryption types, pre-auth settings)

Azure Entra ID

ETC calls Microsoft Graph API with an app registration, collecting:

  • Users (MFA status, password age, risk level, auth methods)
  • Groups (dynamic rules, owners, privileged memberships)
  • Applications & Service Principals (permissions, credentials, multi-tenant)
  • Conditional Access Policies (MFA, device compliance, legacy auth blocking)
  • PIM roles (permanent vs eligible assignments, approval policies)
  • Audit/sign-in logs
  • Risk detections (compromised credentials, anomalous sign-ins)

Community vs Pro

Community (Apache 2.0) Pro (ETC Collector License)
AD — 12 core categories (261 detections) ✅ ✅
Azure — 8 core categories (148 detections) ✅ ✅
ADCS — ESC1–ESC11 (+11 detections) ❌ ✅
Attack Paths — privilege graph (+3 detections) ❌ ✅
Azure Risk Protection (+10 detections) ❌ ✅
REST API & embedded GUI ✅ ✅
JSON export ✅ ✅
Compliance (CIS, NIST, ANSSI, DISA STIG) ✅ ✅
Total detections 409 435
Source code GitHub (public) Closed-source binary
Access Direct download Email / SaaS subscription

Risk Scoring

Every audit produces a risk score (0–100, where 100 = no risk) and a rating (A–F):

Rating Score Meaning
A 80–100 Excellent — minimal risk
B 60–79 Good — minor improvements needed
C 40–59 Moderate — significant issues
D 20–39 Poor — serious exposure
F 0–19 Critical — likely compromised

The score is weighted by severity and entity type (privileged accounts carry more weight):

Severity Weight
Critical 10
High 3
Medium 1
Low 0.2
Info 0

Optional: Network Probes

Activate with --enable-network-probes to add:

  • ADCS ESC8 — HTTP endpoint exposure of the CA enrollment service (Pro)
  • DNS zone transfer (AXFR) — tests if DNS allows unauthorized zone dumps
  • LDAP signing — verifies domain controller LDAP signing requirements
  • SMB signing — verifies domain controller SMB signing requirements

Network probes add ~1–2 seconds and require additional network access from the collector host.

Output Format

All results are returned as structured JSON, consumable by:

  • SIEM platforms (Splunk, Elastic, Sentinel)
  • Vulnerability management tools
  • Custom dashboards
  • The embedded web GUI

Each finding includes:

{
  "type": "ASREP_ROASTING_RISK",
  "severity": "critical",
  "category": "kerberos",
  "title": "AS-REP Roasting Risk",
  "description": "User accounts without Kerberos pre-authentication...",
  "count": 25,
  "affectedEntities": [
    { "name": "svc-backup", "type": "user", "details": { ... } }
  ]
}

See Also