diego - Active Directory security diagnostics for defender

项目说明

diego

Read-only Acti diagnostics for authorised defenders and assessors.
diego runs from a standard domain-user context and produces JSON, Markdown, or
self-contained HTML reports. It does not modify the directory, execute OS
commands, crack hashes, exploit hosts, or mo.

Current release

v0.23.0 adds credential-free, read-only posture diagnostics for email
authentication, explicitly named TLS endpoints, and operator-named local paths.
These surfaces run without a Domain Controller and do not execute commands,
read file contents, scan ports, or attempt authentication.

Capabilities

LDAP: delegation, RBCD, pri groups, SPNs, stale service passwords,

description leaks, password policy, and related read-only findings.

Kerberos: AS-REP and TGS requests with audit-safe e handling.

Passi: LLMNR/NBT-NS and cleartext-protocol indicators on a

selected local interface.

Email & domain authentication hygiene (Surface A): SPF, DMARC, DKIM (common

selectors), MTA-STS, TLS-RPT, CAA, and a bounded DNSSEC check — o
DNS only, needing no credentials and no Domain Controller.

TLS transport hygiene (Surface B): for explicitly named endpoints, which of

TLS 1.0/1.1/1.2/1.3 are accepted, the negotiated cipher, and certificate
(expired/expiring/self-signed). Read-only, no port scanning, no
exploit probes, no credentials.

Local file-permission posture (Surface C): for paths you name, o

private keys and credential files, world-writable files/directories, and loose
.ssh/.gnupg permissions — inspecting permission bits only (never file
contents), ne symlinks, unpri and read-only (Unix).

Reports and integrations: JSON, Markdown, HTML, baseline diff, explanations,

bounded exposure graph, remediation simulation, go, SARIF, webhook,
MCP stdio, and multi-domain plans.

Optional Claude analysis and chat, requiring ANTHROPIC_API_KEY.

Quick start

Supply a password with --password or DIEGO_PASSWORD; otherwise diego prompts
for one. Keytab and Kerberos-cache authentication are not supported yet. The
default audit mode remo hash material from reports. Only an
authorised assessment that needs that material should use both --mode full
and --export-hashes.

The email module is read-only and needs neither credentials nor a Domain
Controller — only a domain and a resolver:

The TLS module is read-only and probes only the endpoints you name (no port
scanning); it needs no credentials and no Domain Controller:

The file-permission module scans only the paths you name, reads permission
bits (not contents), and needs no credentials:

Common options

| Option | Purpose |
|---|---|
| --modules <LIST> | Run kerberos, ldap, passive, email, tls, fs, or all |
| --dns-resolver <ADDR> | Resolver for email checks (ip or ip:port; default: system) |
| --dkim-selectors <LIST> | Comma-separated DKIM selectors for email (default: common set) |
| --tls-target <LIST> | Comma-separated host[:port] endpoints for the tls module |
| --fs-path <LIST> | Comma-separated files/dirs for the fs permission-posture module |
| --format <FORMAT> | Write json, markdown, or html |
| --output <PATH> | Write the primary report to a file |
| --baseline <PATH> | Compare the current report with a prior report |
| --explain <ID> | Explain a finding and its pro |
| --exposure-graph | Emit a bounded exposure graph |
| --simulate-remediation <IDS> | Simulate removing findings locally |
| --sarif-output <PATH> | Write a SARIF 2.1.0 sidecar |
| --webhook-output <PATH> | Write an e webhook sidecar |
| --attack-path / --attack-path-output <PATH> | Emit a bounded defensive path summary |
| --plan <PATH> | Execute a multi-domain plan whose target metadata has no credentials |
| --plan- | a plan without credentials or network access |
| --plan-state <PATH> | Save and resume an integrity-protected local checkpoint |
| --mcp / --mcp-init | Run MCP stdio mode or print its client configuration |

Multi-domain plans

A plan contains target metadata only. Executing it still requires --username
and either --password or DIEGO_PASSWORD. Targets execute in bounded batches
controlled by max_parallel; FleetReport retains each target's status, report,
bounded attackPath, and aggregate se counts.

a plan before supplying credentials:

For a resumable run, write a local checkpoint after each batch:

Re-running the same command skips completed targets and retries failed or
unfinished targets. The checkpoint is rejected when its SHA-256 checksum or
plan fingerprint is invalid, or when the plan's scope, target ID, domain, or DC
metadata has changed.

Output safety and detection

Audit output is the default. Raw hash material is an explicit full-mode opt-in,
and sidecars are designed to contain summaries rather than raw e.
diego is read-only and does not claim to be in: LDAP enumeration,
AS-REP roasting, and especially RC4 Kerberoasting remain observable to
directory-side monitoring. Jitter may smooth request timing, but it does not
remove the beha signature of a request.

De

The project forbids std::process::Command in src/. Offline commands work
only when their dependencies are already cached. See
CONTRIBUTING.md and docs/TESTING.md.

Documentation

Threat model — goals, non-goals, detection, and limits

Roadmap — current status and next gates

Security policy — private reporting

Testing — test layers and co boundaries

Benchmarks — reproducible lab methodology

Report schema — JSON contract

Changelog

Sample report and sample JSON

License

MIT License. Copyright (c) 2026 kent-tokyo. You may use, modify, and
redistribute diego under the terms in LICENSE; copies and substantial
portions must retain this copyright and permission notice.

项目信息

开发语言：Rust

Star 数：4

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Active Directory security diagnostics for defenders — non-privileged, read-only, Pure Rust. AS-REP/Kerberoast/LDAP/delegation findings with HTML reports, AI analysis, and MCP. For authorised assessment.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。