SpecterOps / SpecterOps/SharpHound
IsAdmin from group policy preferences does not account for Item Level Targeting
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 1.3k
- Forks
- 266
- Avg merge
- 2d 7h
- Merged PRs (30d)
- 3
Description
SharpHound does not account for Item Level Targetting when collecting local group membership collection from GPOs linked to OUs,
Group Policy Preference in a GPO can add groups or users into local administrators group only if the host has a matching NETBIOS name or member of an AD group.
I know it will be impossible for SharpHound to account for some item level targeting options such as WMI, but I believe ones that are likely used for managing local groups can, such as hostname, OU and security group membership.
Item level targeting details:
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn789189(v=ws.11)
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the linked Item Level Targeting documentation and the current SharpHound collection of local group membership from GPOs linked to OUs. Done means hostname, OU, and security-group targeting are accounted for when determining local administrators membership; WMI targeting is explicitly out of scope in the issue.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100