cyb3rint3l-labs/serversecurityauditPowerShell-based Windows Server Security Audit Engine by Cyb3rint3l Labs. Measures alignment with the NIS2 directive and maps findings to MITRE ATT&CK tactics & CIS Controls v8 practices. Generates interactive HTML dashboards & structured JSON datasets.
A modular PowerShell-based engine designed to perform deep security hygiene audits on Windows Server systems. It delivers actionable risk scoring mapped to NIS2 Directive (Article 21), MITRE ATT&CK, and CIS Controls v8, generating forensic-ready HTML and JSON outputs.
The engine executes 30+ weighted checks across 6 Strategic Domains covering 12 critical security disciplines to ensure a holistic defense-in-depth posture.
It runs entirely offline, has no external dependencies or call home capabilities.
While designed to be non-intrusive, this script performs extensive WMI, Registry, and File System queries. These operations may cause temporary CPU/Disk spikes or trigger EDR/Monitoring alerts.
🚨 High-Impact Checks (Weight: 20 pts)
Failure in these areas represents an immediate compromise risk (e.g., Ransomware, Data Breach, Man-in-the-Middle).
📖 Full Documentation: For a complete list of all 30+ checks, weights, and technical details, please consult the Detailed Checks & Scoring Documentation.
Current Version (1.0.1) Hash (SHA-256):
6BCD6B9B821DC997A19F78D7B545EFFCCEACBEA9F66883BE4F47C716EDB3559D
Verify via PowerShell:
(Get-FileHash .\ServerSecurityAudit.ps1 -Algorithm SHA256).Hash -eq "6BCD6B9B821DC997A19F78D7B545EFFCCEACBEA9F66883BE4F47C716EDB3559D"
Author: Konstantinos Xanthopoulos, Founder & Principal Consultant @ Cyb3rint3l Labs
| # | Check Name | Security Impact / Rationale | Compliance Mapping |
|---|
| 01 | OS Patching & Update Source | Continuous Vulnerability Management | CIS Control 7 (IG1) |
| 02 | RDP & NLA Status | Ransomware Entry Vector | MITRE T1133 |
| 03 | Credential Guard & LSA | OS Credential Dumping Protection | MITRE T1003 |
| 04 | Saved UNC Paths & Vault | Lateral Movement Risk | MITRE T1552 |
| 05 | Auth & Kerberos Hardening | NTLM Relay / Kerberoasting Prevention | MITRE T1557/T1558 |
| 06 | Firewall State & Logging | Secure Network Configuration | CIS Control 4 (IG1) |
| 07 | SMB Protocol Security | Exploitation of Remote Services | MITRE T1210 |
| 08 | LLMNR & mDNS Status | Man-in-the-Middle / Responder | MITRE T1557 |
| 09 | WPAD Status | Traffic Interception Prevention | MITRE T1557 |
| 10 | Endpoint Protection | Malware Defenses (AV/EDR) | CIS Control 10 (IG1) |
| 11 | Print Spooler Service | Privilege Escalation (PrintNightmare) | MITRE T1068 |
| 12 | Plaintext Password Files | Unsecured Credentials Discovery | MITRE T1552 |
| 13 | Drive Encryption (BitLocker) | Data Protection at Rest | CIS Control 3 (IG1) |
| 14 | Local Admin Group | Least Privilege Enforcement | CIS Control 5 (IG1) |
| 15 | Forensic Audit & Logging | Defense Evasion Detection | MITRE T1562 |
| 16 | VSS Writers Status | Data Recovery & Ransomware Resilience | CIS Control 11 (IG1) |