fix(detection): suppress ESC5a false positives for CA host self-permissions - #102
Open
jakehildreth wants to merge 1 commit into
Open
fix(detection): suppress ESC5a false positives for CA host self-permissions#102jakehildreth wants to merge 1 commit into
jakehildreth wants to merge 1 commit into
Conversation
…ssions - skip ACEs in Set-DangerousEditor/Set-LowPrivilegeEditor where principal SID equals the object's own ComputerPrincipal - CA host accounts legitimately hold rights on their own CA object; flagging them was a false positive (#99) - tests: 5 new Set-Editor cases (own-CA suppressed, other principals still flagged, null ComputerPrincipal unaffected) - bump ModuleVersion to 2026.8.191430; full PS 7 suite green except 3 pre-existing dashboard header failures
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Suppresses ESC5a false positives where the flagged principal is a CA host's own computer account holding rights on its own CA object (
pKIEnrollmentService). Closes #99.Set-DangerousEditorandSet-LowPrivilegeEditor: skip ACEs whose IdentityReference SID equals the object's ownComputerPrincipal(already populated bySet-CAComputerPrincipalearlier in the pipeline viadNSHostNamelookup).ComputerPrincipal, guard is a null check.Why
A CA host legitimately needs access to its own CA object — this is normal self-management, so flagging it as a dangerous/low-privilege editor was a false positive (reported by @thedxt, #99). Distinct from #3, which covers inherited expected ACEs (Exchange, Entra Connect).
Fixing at enrichment time rather than in
Find-LS2VulnerableObjectmeans all consumers (Find functions, dashboard, risk scoring) get the suppression with one guard per shared function.Test plan
Set-Editortests — own-CA ACE suppressed in both functions, other principals on the same CA still flagged, nullComputerPrincipalunaffected.New-LS2Dashboardheader tests, verified pre-existing against the stashed baseline.