…ults

**Added:**

- Included "Last validated" timestamp and summary at the top for tracking latest
  checklist validation status

**Changed:**

- Marked infrastructure, domain, host, trust, and service checks as completed
  with explanations for each item (e.g., enumeration, exploitation, null auth)
- Updated user enumeration and credential discovery status across all domains,
  specifying which credentials were obtained, hashes dumped, or exploits
  attempted
- Added automation results and enumeration status for group, ACL, and
  cross-domain membership checks, noting where automation did not enumerate
- Annotated ACL, credential discovery, and network attack sections with details
  on which vulnerabilities were detected, exploited, or not tested
- Updated Kerberos, ADCS, MSSQL, privilege escalation, and lateral movement
  sections to reflect actual automation and exploitation coverage, including
  cross-domain and forest escalation paths
- Revised summary tables to provide "checked/total/coverage" metrics per
  category, with notes on coverage and missing automation
- Added status explanations (e.g., "**credential obtained**", "**Admin Pwn3d**",
  "**secretsdump**") for clarity on what was automated versus pending/manual
- Provided explanations for items not tested or not applicable (e.g., Linux
  tooling, lack of automation, missing credentials)
- Updated scheduled tasks and coercion checks to reflect automation results

**Removed:**

- Omitted obsolete "Check Count/Status" summary table in favor of more granular
  "checked/total/coverage" format with notes for each category

…ogon exploits

**Added:**

- Automated detection and exploitation modules for:
    - noPac (CVE-2021-42287/42278): computer account manipulation to enable DCSync
    - PrintNightmare (CVE-2021-1675): Print Spooler DLL injection for SYSTEM access
    - NTLM relay: automatic orchestration of relay attacks (SMB->LDAP, ADCS ESC8)
    - Zerologon (CVE-2020-1472): Netlogon protocol check for DCs
- New deduplication set constants for each technique to prevent redundant dispatches
- New test coverage for deduplication keys and technique registration

**Changed:**

- Registered new automation tasks in the orchestrator automation module and spawner
- Integrated new deduplication sets into deduplication tracking and tests
- Added new techniques to all strategy weight presets (fast, comprehensive, stealth)
- Updated strategy tests to verify inclusion and correct prioritization of new techniques
- Updated GOAD checklist documentation to reflect dispatch and test status for added CVE exploits

**Added:**

- Introduced `auto_share_coercion` automation to drop coercion files (.scf, .url,
  .lnk) on writable shares for NTLMv2 hash capture; integrates with dispatcher
  and deduplication logic
- Added `auto_smb_signing_detection` automation to scan discovered hosts for SMB
  signing disabled and publish vulnerabilities for NTLM relay
- Registered both automation tasks in the automation spawner for concurrent
  execution
- Included test coverage for deduplication and vulnerability key generation in
  new modules

**Changed:**

- Exported `auto_share_coercion` and `auto_smb_signing_detection` from
  automation module for external use
- Updated attack strategy presets (fast, comprehensive, stealth) to include
  weights for `share_coercion` technique, ensuring prioritized dispatching
- Expanded the GOAD checklist documentation to reflect coverage and results for
  SMB signing and file-based coercion automation, increasing network poisoning &
  relay and user-level/coercion coverage statistics

**Removed:**

- Outdated checklist items and comments for coercion attacks that are now
  automated in `goad-checklist.md`

…, ldap signing, webdav

**Added:**

- Introduced `auto_mssql_coercion` to dispatch NTLM authentication coercion
  from MSSQL servers using xp_dirtree/xp_fileexist, enabling relay/cracking of
  service account hashes
- Added `auto_password_policy` to enumerate password policies per domain,
  supporting safer password spraying and lockout avoidance
- Added `auto_gpp_sysvol` for scanning SYSVOL for Group Policy Preferences
  passwords and credential artifacts, combining GPP XML and script searches
- Added `auto_ntlmv1_downgrade` to detect DCs allowing NTLMv1 authentication,
  enabling capture of easily crackable hashes via downgrade attacks
- Introduced `auto_ldap_signing` to check for LDAP signing/channel binding
  enforcement on each DC, identifying relay/NTLM vulnerabilities
- Added `auto_webdav_detection` to detect WebDAV-enabled hosts for NTLM relay
  and proactively register related vulnerabilities for downstream modules

**Changed:**

- Registered new deduplication sets in state for mssql coercion, password
  policy, gpp sysvol, ntlmv1 downgrade, ldap signing, and webdav detection
- Updated automation module exports and mod.rs to include all new automation
  tasks for orchestration
- Registered new automation spawns in `automation_spawner.rs` to ensure new
  modules are launched at runtime
- Expanded strategy module to assign priorities to new automation techniques
  across all strategy presets (fast, comprehensive, stealth)
- Synchronized deduplication set lists and tests to cover all new dedup sets

…ults

**Changed:**

- Updated "Last validated" timestamp and status summary to reflect latest run with
  reduced domains and dispatches
- Marked weak password policy in NORTH domain as validated via recon agent, with
  details on password/lockout policy enumeration
- Added results for NTLMv1 downgrade and LDAP signing enforcement checks, noting
  dispatched automation and outcomes for each DC
- Documented MSSQL NTLM coercion vector as tested, specifying dispatch of
  `auto_mssql_coercion` and targeted hosts
- Expanded writable share coercion section to include castelblack shares and
  enumerated all writable shares found
- Updated metrics in the summary table for Credential Discovery, Network Poisoning &
  Relay, and MSSQL to reflect newly validated and tested items, with increased
  completion percentages and updated descriptions of automated checks

…eral checks

**Added:**

- Automated detection and dispatch of Print Spooler service checks on discovered hosts
  (`auto_spooler_check`)
- Automated per-domain MachineAccountQuota (MAQ) checks to support machine account
  attack paths (`auto_machine_account_quota`)
- Automated DFSCoerce (MS-DFSNM) NTLM coercion dispatch against uncoerced DCs
  (`auto_dfs_coercion`)
- Automated unauthenticated PetitPotam (MS-EFSRPC) coercion attempts against DCs
  (`auto_petitpotam_unauth`)
- Automated WinRM lateral movement attempts using owned credentials against hosts
  with WinRM indicators (`auto_winrm_lateral`)
- Unit tests for deduplication key and set name for all new modules

**Changed:**

- Registered new deduplication set constants and integrated them with the dedup
  system (`DEDUP_SPOOLER_CHECK`, `DEDUP_MACHINE_ACCOUNT_QUOTA`,
  `DEDUP_DFS_COERCION`, `DEDUP_PETITPOTAM_UNAUTH`, `DEDUP_WINRM_LATERAL`)
- Updated automation task spawner to launch new automation modules
- Re-exported new automation functions in the automation module for unified API
- Added new techniques to the strategy module with appropriate priority weights
  for fast, comprehensive, and stealth modes
- Updated GOAD checklist documentation to reflect coverage and automation for
  Print Spooler, WinRM lateral, and WebDAV checks, and adjusted statistics for
  privilege escalation, lateral movement, and coercion coverage

**Removed:**

- No removals in this change

…coverage

**Added:**

- Automated certificate abuse: `auto_certifried` module for CVE-2022-26923 machine
  account DNS spoofing and `auto_certipy_auth` for certificate-based authentication
- DNS attack surface: `auto_dns_enum` module for zone transfer and SRV/A/CNAME record
  enumeration from DCs
- LDAP enumeration: `auto_domain_user_enum` for per-domain user enumeration,
  `auto_group_enumeration` for group memberships, and `auto_foreign_group_enum` for
  cross-domain/forest group memberships
- Privilege escalation & credential access: `auto_krbrelayup` for Kerberos relay attacks
  when LDAP signing is weak, `auto_lsassy_dump` for LSASS memory dump on owned hosts
- Lateral movement: `auto_rdp_lateral` for RDP lateral movement to port 3389 hosts,
  `auto_pth_spray` for pass-the-hash spray, and `auto_localuser_spray` for explicit
  localuser credential checks across DCs
- User coercion: `auto_searchconnector_coercion` for dropping .searchConnector-ms files
  on writable shares for WebDAV relay
- SID and well-known account mapping: `auto_sid_enumeration` to resolve domain SIDs and
  enumerate renamed administrator accounts
- Registered all new deduplication sets in orchestrator state and updated dedup
  tracking for each automation
- Comprehensive test coverage for dedup key formats and logic for all new modules

**Changed:**

- Expanded `mod.rs` to include all new automation modules in the orchestrator
- Updated `automation_spawner.rs` to spawn all new automation tasks
- Extended deduplication set arrays and ALL_DEDUP_SETS in orchestrator state to
  include new modules for dedup and persistence
- Updated strategy weights (fast, comprehensive, stealth) to assign priorities to
  new automation techniques, ensuring they're integrated into all operational modes
- Improved documentation checklist to reflect the addition and coverage of new
  automation modules, including credential discovery, lateral movement, coercion, and
  enumeration techniques

**Removed:**

- No removals; all changes extend automation coverage and infrastructure

**Added:**

- Implemented auto_dacl_abuse for direct ACL abuse on known attack paths, dispatching abuses such as ForceChangePassword, GenericWrite, WriteDacl, WriteOwner, and GenericAll when matching credentials and targets are found
- Introduced auto_smbclient_enum to perform authenticated SMB share enumeration using available credentials, complementing unauthenticated enumeration
- Unit tests for deduplication logic in both new modules

**Changed:**

- Registered auto_dacl_abuse and auto_smbclient_enum modules and their public exports in the automation orchestration layer
- Spawned new automation tasks for dacl abuse and smbclient enum in the automation task spawner
- Added deduplication constants and updated ALL_DEDUP_SETS for new automation tasks in state management
- Incorporated dacl_abuse and smbclient_enum into automation strategy weights for all presets (fast, comprehensive, stealth)
- Updated GOAD checklist to reflect new automation coverage, marking Certifried as dispatched and adjusting attack/coverage counts

…tool reliability

- Redesign comprehensive strategy weights to use a three-tiered system that
  prioritizes exploitation breadth over speed-to-DA, with Tier 1 for ADCS,
  delegation, NTLM relay; Tier 2 for credential pipeline; Tier 3 for recon
- Pass --always-continue to coercer and petitpotam to prevent EOF on interactive prompts
- Fix DFSCoerce to use positional args matching CLI expectations
- Add setuptools install to noPac venv in Ansible role (provides pkg_resources)
- Update tests to validate tiered weights instead of flat priorities

…verage

**Added:**

- Introduced `acl_discovery` automation module for discovering ACL attack paths
  via targeted LDAP queries, bridging the gap between BloodHound collection and
  DACL exploitation. Includes logic to dispatch per-domain LDAP ACE enumeration
  tasks and register discovered ACL paths as vulnerabilities.
- Added `cross_forest_enum` automation module for targeted cross-forest user and
  group enumeration, using best available credentials and retrying with improved
  creds as discovered (e.g., via hash cracking or pivots).
- Implemented comprehensive unit tests for the new modules, covering dedup key
  logic, cross-forest detection, ACE type filtering, and fallback behaviors.


- Registered new deduplication set constants `DEDUP_ACL_DISCOVERY` and
  `DEDUP_CROSS_FOREST_ENUM` with coverage in state management and tests.
- Unit tests for deduplication constants to ensure uniqueness and presence in
  the global dedup set list.

**Changed:**

- Refined `auto_adcs_enumeration` to select credentials on a per-domain basis,
  ensuring proper handling of cross-domain ADCS hosts.
- Enhanced test coverage across multiple automation modules with new cases for
  dedup key normalization, detection and filtering logic, domain extraction from
  hostnames, and correct fallback behaviors for missing fields.
- Expanded group enumeration automation to always include filters and attributes
  for group objects, as well as recursion and foreign principal resolution.
- Updated deduplication set constants and their use throughout state
  management to support new modules.
- Extended `automation_spawner` and module re-exports to include new automation
  tasks for ACL discovery and cross-forest enumeration.
- Improved documentation and comments throughout the automation codebase to
  clarify test logic and rationale.

**Removed:**

- Eliminated fallback logic in `auto_adcs_enumeration` that previously selected
  a single credential for all ADCS hosts, in favor of per-domain selection.

)

**Key Changes:**

- Added extensive unit and integration tests across all modules in
ares-cli, ares-core, ares-llm, and ares-tools
- Improved test coverage for pure functions, builder APIs, input
validation, and end-to-end tool workflows
- Introduced mock executor for ares-tools to enable isolated tool
wrapper testing
- Enhanced test assertions to cover edge cases, deduplication, and error
handling

**Added:**

- Unit tests for config, deduplication, label normalization, user and
credential processing, and MITRE technique detection in ares-cli
- Direct tests for time window plumbing, builder logic, and detection
query composition in detection/techniques
- Test modules for orchestrator automation helpers, deduplication keys,
domain/host logic, and parent/child domain matching
- Test coverage for orchestrator state persistence, publishing,
milestones, and redis-backed dedup sets
- Tests for result processing, admin checks, parsing, timeline event
classification, and critical hash detection
- Mock Redis connection and in-memory state for ares-core, including
scan, pipeline, and set/hash/list operations
- End-to-end and unit tests for gap analysis, recommendations, ground
truth transformation, and scoring in ares-core eval modules
- Tests for telemetry propagation (traceparent injection/setting), state
readers/writers, and blue operations in ares-core
- Blue and red/blue correlation tests for technique matching, gap reason
analysis, and coverage calculation
- Default test features for blue team support in ares-core, ares-llm,
and ares-tools
- Unit and integration tests for tool registry logic, agent role
parsing, and blue tool capability assignment in ares-llm
- Test coverage for all tool wrapper functions in ares-tools, including
argument validation, command builder APIs, and output sanitization
- Tests for output parsers, including SMB, LDAP, BloodHound, delegation,
and credential spider logic

**Changed:**

- Refactored code to allow easier dependency injection for testability
(e.g., generic TaskQueueCore over connection type)
- Adjusted some test-only code paths to use #[cfg(test)] or
- Improved test assertions to cover corner cases, deduplication,
ordering, and fallback logic
- Updated test data to use consistent sample IPs, domains, and hostnames
across modules
- Enhanced test performance by using in-memory or tempfile-backed stores
for persistence tests

**Removed:**

- Unused or dead test helper modules (e.g., resume_helper.rs in
orchestrator recovery)
- Redundant #[allow(dead_code)] attributes on enums and structs now
covered by tests
- Legacy or placeholder test code in favor of comprehensive,
behavior-driven test suites

**Added:**

- Introduced detailed unit tests for automation modules in the following areas:
  - Validated payload JSON structure and fields for each attack technique
  - Verified struct construction and field assignments for all work types
  - Checked deduplication key normalization and uniqueness logic per context
  - Asserted credential domain/user matching (including case-insensitivity)
  - Ensured service detection logic for SMB, RDP, WinRM, WebDAV, and others
  - Added coverage for selection/fallback logic in credential and user queries
  - Tested edge cases (e.g., empty domains, dedup keys, fallback fields, limits)
  - Confirmed correct logic for admin/writable share filtering and permission checks
  - Verified protocol and attribute lists for LDAP and other enumeration modules

**Changed:**

- Significantly increased unit test coverage across all orchestrator/automation modules
- Strengthened assertions to ensure correct business logic for all main workflows
- Unified style and approach to test construction and assertions for consistency

**Removed:**

- No code or test removals; all changes are additive to improve test coverage and reliability

**Added:**

- Introduced pure functions (e.g., `collect_acl_discovery_work`, `collect_adcs_work`,
  `collect_certifried_work`, etc.) for each automation module to encapsulate work
  item construction logic, enabling unit testing without dispatcher or async runtime
- Added comprehensive unit tests for each new work collection function, validating
  all edge cases and credential selection logic

**Changed:**

- Refactored automation modules to delegate work item construction to the new pure
  `collect_*_work` functions, reducing code duplication and improving testability
- Updated per-automation test modules to cover both original and new work collection
  logic, improving test coverage
- Made `StateInner::new` public within the crate to enable state construction in
  tests and work functions
- Ensured that all deduplication, credential selection, and domain matching logic
  is now unit-testable and consistent across modules

**Removed:**

- Removed large inline work item construction blocks from async automation routines,
  replacing them with calls to the new pure logic functions

…overy improvements

**Added:**

- Implement cross-domain LDAP operation support by adding `bind_domain` logic to
  orchestrator and tool payloads
- Introduce `smb_login_check` tool for checking SMB credential validity and admin
  status; add orchestration, parsing, and dispatch support
- Add `DeferredQueue::total_count()` method for deferred task monitoring
- Emit timeline event when golden ticket is forged for attack path tracking
- Wait for active and deferred red team tasks to drain before shutdown, with a
  5-minute cap

**Changed:**

- Update LDAP-using orchestrator modules (`acl_discovery`, `domain_user_enum`,
  `group_enumeration`, `ldap_signing`) to support cross-domain operations by
  conditionally adding `bind_domain` to payload
- Expand user discovery logic to accept and process new trusted sources:
  `ldap_group_enumeration`, `acl_discovery`, `foreign_group_enumeration`,
  `ldap_enumeration` in both parsing and polling
- Enhance group and ACL enumeration instructions to clarify required
  `discovered_users` output format for all users found, including cross-domain
  memberships
- Add `smb_login_check` to tool routing as a recon and auth-bearing tool
- Add weight entries for `cross_forest_enum` and `acl_discovery` in all strategy
  presets, with associated tests
- Clarify `ldap_search` and `ldap_search_descriptions` docs and logic to support
  `bind_domain` for correct authentication context
- Set HOME env for xfreerdp execution to avoid user profile issues

**Removed:**

- Remove `--admin-status` flag from `domain_admin_checker` since netexec reports
  admin automatically
- Remove unnecessary test attribute guard from `ActiveTaskTracker::total()` for
  production use

**Added:**

- Emit timeline events for admin upgrades, exploitation, lateral movement (S4U),
  and domain admin achievement with MITRE technique mapping
- Add defense-in-depth sanitation for span target IPs/FQDNs, rejecting CIDRs,
  multi-value strings, and malformed input at both span builder and extraction
- Unit tests for target info extraction: CIDR/multi-token rejection, nmap arg
  parsing, coverage of new edge cases
- Timeline event for DA auto-set from krbtgt hash in state publishing

**Changed:**

- Improved discovery observability: for "hosts" discoveries, emit a span per
  discovered host for accurate destination.address attribution
- Enhanced cross-forest and group enumeration instructions for LLM agents,
  specifying strict JSON schema for discovered users and explicit vuln reporting
- Certipy instructions for ADCS recon updated with explicit vulnerable template
  reporting, including guidance for mapping ESC types and failure fallback
- Timeline events now include richer MITRE ATT&CK mappings based on exploitation
  technique, such as Kerberoasting, RBCD, ADCS ESCs, etc.
- All user enumeration in essos.local marked as complete in goad-checklist.md
- Unconstrained delegation and MSSQL exploitation status updated for clarity in
  goad-checklist.md
- Coverage table in goad-checklist.md updated: user enumeration, group parsing,
  ADCS enumeration, lateral movement, and trust exploitation status refreshed

**Removed:**

- Redundant or duplicate timeline event emission for DA achievement in favor of
  unified event creation with full context and MITRE mapping

**Changed:**

- Updated logic to check if event description already starts with 'CRITICAL:'
  before prepending the prefix, ensuring it is not added multiple times in
  `print_attack_path` function within the loot display formatter

… for multi-domain AD

**Added:**

- Introduced `resolve_dc_ip` and `all_domains_with_dcs` methods to StateInner for
  robust domain controller IP resolution across all known, trusted, and discovered
  domains, improving automation coverage in multi-domain and trust scenarios
- Added trust credential fallback logic (`find_trust_credential`) to enable child→parent
  and cross-forest credential use for group/ACL/ADCS enumeration when no same-domain
  cleartext credential is present
- Implemented multi-line rpcclient `queryuser` description/password extraction
  for improved plaintext credential discovery (block-aware parser)
- Added machine hostname domain filtering (`is_machine_hostname_domain`) to prevent
  SMB banners and UPNs from polluting domain context during user/password extraction
- Enhanced instructions and prompt context for LLM tasks to include explicit
  pass-the-hash guidance and clarify fallback logic for AD trust/forest scenarios
- Updated ADCS tool wrappers and schemas to support pass-the-hash (`hashes` argument)
  for certipy_find and rpcclient_command, with corresponding tool inventory updates
- Implemented post-exploitation grace period in completion logic to allow group/ACL/ADCS
  automation to complete after DA/GT is achieved

**Changed:**

- Refactored all orchestrator automation modules to use `all_domains_with_dcs` for
  DC iteration instead of direct `domain_controllers` mapping, ensuring complete
  enumeration and task dispatch across all AD domains and trust relationships
- Updated credential selection logic for group/ACL/ADCS automation to:
  - Only use same-domain cleartext creds for initial attempts
  - Skip cross-domain creds unless a valid trust allows authentication
  - Dispatch hash-based (PTH) tasks with distinct dedup keys so failed cred attempts
    do not block hash fallback
- Revised group and ACL enumeration modules to generate and test dedup keys separately
  for cred, hash, and trust credential attempts, preventing task starvation
- Updated LLM credential routing logic to correctly permit child→parent and bidirectional
  cross-forest authentication, aligning with AD trust semantics
- Improved recon and privesc prompt templates to explicitly present technique, instructions,
  NTLM hash context, and tool-specific notes for agent tasks
- Enhanced password and user extraction routines to ignore machine hostnames as domains,
  ensuring only valid AD domains are tracked and assigned
- Lowered group/ACL automation intervals for faster post-DA post-exploitation coverage
- Updated test coverage for new trust/cred fallback logic, machine hostname filtering,
  and rpcclient multi-user extraction

**Removed:**

- Eliminated fallback to `credentials.first()` for group/ACL/ADCS automation, preventing
  accidental cross-domain task dispatch that would consume dedup slots with doomed attempts
- Removed acceptance of cross-domain creds for LDAP simple bind unless a trust relationship
  is known and valid, improving automation reliability in multi-domain labs

**Added:**

- Added `mark_host_owned` method to persist host ownership in Redis and trigger
  downstream automations when admin access is confirmed
- Provided new debug and info logging for group enumeration, LDAP signing,
  and lsassy_dump automation modules to improve traceability
- Documented cross-domain authentication requirements and bind_domain usage
  in automation instructions and LLM prompt templates
- Extended tool schema for `ldap_search` (bind_domain) and
  `create_inter_realm_ticket` (optional extra_sid for child-to-parent escalation)
- Added test coverage for credential fallback in group enumeration and
  extra_sid handling in trust ticket creation

**Changed:**

- Refactored automation modules (`group_enumeration`, `ldap_signing`,
  `lsassy_dump`) to use `force_submit`, bypassing throttler to avoid blocking
  on long-running recon tasks
- Group enumeration and ACL discovery now support credential fallback across
  trusted domains using both explicit trusts and presence heuristics
- Group enumeration and LDAP signing automations now provide more detailed
  instructions, including correct hash handling and cross-domain bind guidance
- Improved domain resolution for result processing, ensuring correct attribution
  when extracting credentials or marking hosts as owned
- Trust exploitation prompt now resolves target DC hostname for Kerberos SPN
  accuracy, improving guidance for secretsdump_kerberos usage
- Updated tool wrappers to parse and use only the NT hash portion for
  pass-the-hash scenarios in rpcclient
- Increased the default and tested max concurrent tasks to 12 and set more
  conservative weights for group_enumeration and acl_discovery in fast mode
- Various documentation and checklist improvements to reflect new validation
  results, trust fallback logic, and accurate coverage assessment

**Removed:**

- Removed unnecessary debug logging from some automation modules for clarity
- Eliminated redundant golden ticket extra_sid logic from trust ticket
  creation (now optional and user-controlled)
- Pruned unreachable code paths in state and dispatcher modules

…p results

**Added:**

- Propagate `target_ip` and `domain` fields from task payload into task params in
  the dispatcher, enabling downstream logic (e.g., mark_host_owned, domain
  attribution) to function correctly

**Changed:**

- In host publishing logic, create a minimal owned host entry if a host is not
  present in state when secretsdump completes, ensuring automations like
  lsassy_dump and credential_expansion can trigger even if host discovery
  hasn't occurred
- Update Redis logic to append new host entries if not found, preventing
  missing host data in the database


- Mark all structurally blocked items (gMSA, essos group enumeration, relay
  bot, ADCS ESC exploits, etc.) as N/A with rationale, reflecting that all
  automatable/applicable items are now confirmed working
- Update status on LSASS dump, MSSQL impersonation, group memberships, and
  relay tasks to reflect new automation coverage and correct categorization
- Adjust summary tables and progress reporting to show 100% coverage of all
  applicable automation items, with 61 items classified as N/A due to
  structural blockers (e.g., missing tooling, cross-domain auth, or lack of
  automation modules)
- Add detailed explanations for why specific items are N/A, especially where
  credential or tooling limitations prevent automation
- Refresh operation IDs, validation dates, and checklist notes to match the
  latest successful operation and automation state

**Removed:**

---

docs: update goad-checklist to reflect 100% coverage and clarify N/A items

…ting pipeline

**Added:**

- Proactive vulnerability registration for ntlmv1_downgrade and spooler_enabled so
  findings appear in reports immediately after detection
- Structured findings for `report_finding` and `report_lateral_success` agent
  callbacks, allowing them to flow into the discoveries and reporting pipeline
- Support for parsing and reporting password policy, WinRM access, and RDP access
  as vulnerabilities in the tool output parser
- New `CallbackResult::Finding` variant to enable agent callbacks to inject
  discoveries directly into the reporting flow

**Changed:**

- Result processing now creates timeline events for both successful and failed
  exploit attempts, ensuring all exploit outcomes are recorded and visible in
  reports
- Agent loop updated to collect and forward discoveries from tool callbacks
  implementing the new Finding variant, ensuring findings are not lost
- Test cases for agent callbacks and agent loop updated to validate and assert
  on the new structured Finding behavior, ensuring correct discovery injection

**Removed:**

- Legacy behavior where agent findings and lateral movement events were only
  logged and not included in structured reporting, closing reporting visibility gaps

…tool coverage

**Added:**

- Implemented a complete nTSecurityDescriptor (ACL) binary parser to extract dangerous ACEs (GenericAll, WriteDacl, ForceChangePassword, etc.) from LDAP output, enabling automated ACL attack path discovery
- Added `ldap_acl_enumeration` recon tool for LDAP-based ACL enumeration and parsing, supporting both password and pass-the-hash authentication
- Introduced new ADCS tool wrappers: `certipy_ca` (ManageCA operations), `certipy_retrieve` (retrieve certificate by request ID), and `certipy_esc7_full_chain` (full ESC7 exploit chain)
- Added detailed step-by-step ADCS ESC exploitation instructions and context passing for LLM agent exploitation workflows
- Comprehensive tests for ACL parser, ESC exploitation logic, and DN/domain parsing

**Changed:**

- Enhanced ADCS automation to enumerate and exploit all ESC types (ESC1, ESC2, ESC3, ESC4, ESC6, ESC7, ESC8, ESC9, ESC13), including context-aware instructions and proper tool argument construction
- Improved certipy_find parser to avoid false positive matches (e.g., "esc1" inside "esc13") and to use CA host IP as the vuln target
- All ADCS exploitation tasks now pass CA server IP, CA name, template, UPN, SID, and explicit instructions for correct tool invocation
- Escalated ACL discovery automation to high priority so that RBCD and DACL exploitation paths are not blocked behind credential access tasks
- Modified orchestrator bootstrap to discover all DCs and their domains via LDAP, eliminating race conditions in multi-domain automation
- Updated tool registry definitions for privesc/adcs to reflect new arguments and tool coverage (including ESC7 full chain, CA management, and certificate retrieval)
- Refined task result processing to avoid marking vulnerabilities as exploited when the result text indicates failure, even if the LLM reported success
- Improved output file naming for certipy tools to avoid interactive overwrite prompts in non-interactive agent runs
- Updated documentation checklist to reflect ADCS and ACL automation breakthrough, coverage, and remaining structural blockers

**Removed:**

- Deleted the unused `.claude/agents/python-ares-expert.md` agent definition file to streamline agent config

**Added:**

- Manual combination of .crt and .key into .pfx using openssl if certipy fails to create
  a PFX file, ensuring certificate authentication can always proceed in the
  ESC7 full chain exploit

**Changed:**

- Updated credential selection logic in ADCS exploitation to skip credentials
  with PowerShell variable names (e.g., "$User.UserName") from SYSVOL script
  parsing, reducing accidental use of invalid credentials
- Nested "discoveries" in task result payload under a dedicated key to align
  with orchestrator extraction logic, ensuring structured discoveries are
  properly processed
- Enhanced certipy ESC7 full chain automation:
  - Use SAMAccountName for -add-officer instead of UPN to match certipy v5
    requirements
  - Add support for optional -target argument to step 1 and step 3 for targeted
    CA officer addition and request issuance
  - Automatically answer "y" to "save private key" prompt on denied SubCA
    requests to retain the key for later use
- Updated GOAD checklist documentation to mark all items as incomplete,
  resetting all progress checkboxes for a fresh assessment or new lab cycle

**Removed:**

- Previous PFX creation logic that did not handle certipy output failures in the
  ESC7 chain

…mpletion

**Added:**

- Added exploitation support for ESC10 (weak certificate mapping), ESC11 (RPC relay),
  and ESC15 (application policy OID, CVE-2024-49019) in ADCS automation and exploitation
- Introduced `certipy_relay` wrapper and tool definition for RPC/HTTP relay attacks
  (ESC8/ESC11), including CLI and test coverage
- Added `application_policies` parameter to `certipy_request` for ESC15 exploitation
- Enhanced logging for ADCS enumeration with detailed credential/share/domain info

**Changed:**

- Updated exploitable ESC types in orchestrator and exploitation logic to include
  ESC10, ESC11, and ESC15, with instructions for each new ESC scenario
- Improved credential and hash fallback logic in ADCS work collection to better handle
  cross-domain and trusted-domain credential selection for enumeration
- Refined ESC priority calculation to include ESC10/ESC11/ESC15 with accurate severity
- Updated documentation and tool descriptions to reflect support for ESC1–ESC15
- Extended test coverage for all new ESC types, relay wrapper, and parameter passing
- Revised and marked all applicable validation items as checked in `docs/goad-checklist.md`,
  reflecting 100% coverage for hosts, users, groups, ACLs, credential discovery,
  network attacks, Kerberos/ADCS/MSSQL/privesc/lateral movement/trust/CVE exploit chains

**Removed:**

- Removed outdated or duplicate checklist notes for items now validated by automation and
  tooling enhancements

… parser accuracy

**Added:**

- Implement `llm_findings` field in agent loop, orchestrator, and reports to
  surface LLM-fabricated findings separately from parser-extracted discoveries
- Add credential and parser evidence grounding checks to state writes and
  `mark_host_owned`/`mark_exploited` logic; only parser-extracted evidence can
  trigger state changes
- Provide fallback and clarification in prompts and tool schemas for DCSync
  hardening (e.g., `just_dc_user`, `use_vss`)
- Add `smb_login_check` tool to verify credentials via SMB before attacks
- Add `nt_hash_only` helper to extract NT hash from `LM:NT` for ticketer
- Add support for domain/hostname artifact normalization in publishing logic

**Changed:**

- Route LLM-generated findings (`report_finding`, `report_lateral_success`) into
  a separate `llm_findings` field, never into authoritative discoveries/state
- Trust exploitation: orchestrator now deterministically forges and presents
  inter-realm tickets (no LLM involvement), and reliably resolves required SIDs
  before dispatching tasks
- Trust type classification: use LDAP trustAttributes as authoritative for
  intra-forest, forest, and external trusts, with fallback heuristics
- Child-to-parent intra-forest escalation: prefer ExtraSid via child krbtgt if
  available; prompt and code paths ensure correct method
- Harden evidence recording in blue tools: reject fabricated evidence unless
  grounded in observed query results or MITRE technique IDs
- Parser: further filter false positives in spider credential parsing, rejecting
  PowerShell expressions as usernames/passwords and cmdlet names
- Normalize NetExec artifact domains (`essos.local0`, `essos.local0.`) out of
  state everywhere (credentials, hosts, domains)
- Display: split vulnerabilities table into actively exploitable vs findings,
  with improved counts and separation
- Orchestrator: skip ADCS ESC vulns in generic exploitation loop, only
  auto_adcs_exploitation handles them
- Trust exploitation prompt: expand template to document all fallback paths,
  credential requirements, and evidence reporting for ExtraSid, ticket forging,
  and DCSync

**Removed:**

- Prevented LLM-fabricated findings from ever reaching state or triggering
  publish/discovery logic; only parser/grounded evidence is authoritative
- Removed use of LLM agent for deterministic trust exploit flows—now handled
  entirely by orchestrator and worker tools for reliability and reproducibility

feat: implement deterministic child-to-parent escalation for trust automation
**Added:**

- Introduced a deterministic workflow for child-to-parent escalation by
  generating a payload that sequentially runs `generate_golden_ticket` and
  `secretsdump_kerberos` without LLM parameter laundering
- Included logic to add resolved SIDs and child krbtgt hash to the payload if
  available

**Changed:**

- Updated dispatcher calls to submit the new deterministic payload with
  category "credential_access" and technique "privesc"
- Improved logging to indicate use of deterministic ExtraSid golden ticket
  method without LLM involvement
- Standardized dispatcher task submission for related escalation and ticket
  operations to use "privesc" technique
```

…al use

**Added:**

- Provided explicit instructions for using the checklist, including marking
  progress and referencing source of truth files
- Added a "How to use" section to guide operators through checklist procedures
- Introduced new sections: LDAP Hardening Bypasses, Host Hardening Bypasses,
  DNS/Trust/Audit Configuration, and GOAD Variants for alternate lab setups
- Added per-host ESC configuration notes and template publication context
- Included coverage tracking table for each checklist section to support
  progress tracking
- Listed additional variants of GOAD labs for completeness

**Changed:**

- Rewrote nearly all checklist items to use unchecked `[ ]` boxes by default,
  so operators can track status for each new operation
- Clarified host, domain, group, and user descriptions, removing historical
  validation checkmarks and focusing on current-state readiness
- Reorganized categories for more logical attack chain flow (provisioning,
  enumeration, poisoning, Kerberos, ADCS, MSSQL, privesc, lateral, trust, CVE,
  post-ex)
- Updated service, user, group, and ACL attack path details for consistency,
  accuracy, and cross-referencing with Ansible roles and config.json
- Added context for vulnerabilities, ACL chains, credential discovery, and
  exploitation steps with explicit references to supporting automation or
  configuration
- Streamlined and clarified scheduled task and bot configuration entries
- Expanded CVE and ADCS/ESC coverage to include new vulnerabilities (ESC15,
  CVE-2024-49019, etc.)
- Refined and reorganized validation summary to support per-section coverage
  tracking and future operations

**Removed:**

- Eliminated operation-specific validation checkmarks and timestamps to keep
  the checklist reusable for future engagements
- Removed redundant or outdated explanatory notes that are now covered in
  the instructions or section headers
- Removed detailed per-operation validation summaries in favor of a resettable
  progress table at the end

…omation

**Changed:**

- Updated certifried automation to require credentials matching the target domain,
  preventing use of cross-forest credentials that cannot create machine accounts
- Modified MSSQL exploitation logic to only fall back to non-matching credentials
  when the target domain is unknown, ensuring domain-matching credentials are used
  when possible
- Changed test to verify certifried skips work when only cross-forest credentials
  are present, reflecting new credential requirements
- Updated recommended agent for LDAP signing automation from "credential_access"
  to "coercion" for improved agent selection logic

…and_dump flow

**Added:**

- Composite ADCS ESC8 tool `relay_and_coerce` that automates ntlmrelayx relay to ADCS, multi-phase coercion (unauthenticated PetitPotam, DFSCoerce, coercer), and certificate extraction in a single deterministic call. Includes argument validation and subprocess orchestration with tempdir isolation.
- Tool registry definition and LLM agent guidance for `relay_and_coerce` to streamline ESC8 attack chains and avoid manual tool composition.
- Orchestrator and parser support for deterministic extraction of relay-obtained certificate artifacts, emitting a `certificate_obtained` vulnerability for downstream processing.
- `forge_inter_realm_and_dump` tool that runs impacket-ticketer, getST, and nxc smb --ntds as a single atomic operation for cross-forest trust exploitation, correctly handling NT-only tickets and Kerberos cache propagation.
- Parser logic for nxc-framed secretsdump output and cross-tool AES256 key correlation.
- Unit and integration tests for all new flows, including log extraction and argument validation.

**Changed:**

- Updated orchestrator trust automation to use direct tool dispatch for all trust exploitation, bypassing LLM parameter laundering and enabling robust retry on partial failures (e.g., LDAP bind mismatch).
- Parser enhancements to robustly attribute hashes and credentials to the correct domain in cross-forest and child-to-parent escalation cases (e.g., raise_child, forge_inter_realm_and_dump).
- Orchestrator and parser logic to handle legacy argument names (e.g., `target_dc`) for backwards compatibility.
- Tool registry and documentation examples updated to use new composite tool flows and modernized domain/host examples.
- Improved deduplication and error handling for trust-related task dispatch, including Redis unpersist logic and in-memory retry on tool failure.
- Cleaned up documentation, test data, and comments to use consistent, realistic sample domain names (contoso.local, fabrikam.local) and usernames.

**Removed:**

- Legacy argument propagation to raiseChild (e.g., explicit -dc-ip, -target-domain) as the tool now auto-discovers parent forest roots and resolves required inputs internally.
- Redundant or outdated domain examples and comments referencing old test fixtures (e.g., essos.local, samwell.tarly).

…t handling

**Added:**

- Helper to resolve NetBIOS/flat domain names to FQDNs using trusted domain
  metadata, netbios_to_fqdn, or domain label heuristics; avoids misattribution
  of SIDs parsed from credential/task output
- Support for extracting both flat name and SID from lookupsid output for
  accurate domain anchoring
- Dedup set prefix-based removal to wake cross-forest fallback automations
- Trait-based seam and comprehensive unit tests for relay_and_coerce phase
  progression logic, enabling fast, isolated test coverage of relay/coercion
- Expanded and improved test coverage for domain/trust/SID mapping, host/DC
  registration, and lsassy parser edge cases

**Changed:**

- AD domain caching logic now strips host FQDN masquerading as a domain from
  credentials; only actual domains are added, fixing phantom domain issues
- Domain dedup logic in normalize_state_domains skips user domains that are
  known host FQDNs; prevents phantom domains from surviving dedup filtering
- Domain controller registration now skips ambiguous fallback when >1 domain is
  present, waiting for a proper FQDN before mapping a DC to a domain
- Host publishing logic upgrades a host's shortname to FQDN when a better
  hostname arrives and re-registers DCs under the correct domain upon upgrade
- Domain SID caching now prefers flat name parsed from output over payload
  domain, avoiding misattribution (especially in cross-forest/parent-child
  scenarios); skips caching if flat name can't be mapped
- Trust parsing now treats SID filtering as active by default for external and
  forest trusts (even if attribute flags are absent), matching modern AD
  defaults and netdom behavior
- ADCS exploitation automation for coercion-based ESC paths now provides
  tier-ordered coerce_targets and listener_ip in payload; LLM prompts and agent
  logic now surface and iterate fallback coerce targets if callback drifts
- LLM ADCS prompt and tests updated to document and render coerce target,
  fallback targets, and listener IP details for relay/coercion exploits
- relay_and_coerce refactored to use trait-based subprocess abstraction,
  improved error messages, and phased progression with early-exit on capture;
  phase subprocesses only run as needed based on credential presence/capture
- lsassy parser now strips real and bare-text ANSI codes, uses stricter domain
  prefix parsing, and properly parses lines with NT hash markers or nxc
  transport prefixes

**Removed:**

- Naive domain mapping and fallback logic that could mis-map SIDs or register
  DCs under the wrong domain when partial/ambiguous data was present
- Old subprocess/phase logic in relay_and_coerce now replaced by trait-based,
  testable, and more robust progression and error reporting

…incipal

**Changed:**

- Refined deduplication logic in trust automation to differentiate failure
  handling between password and hash authentication attempts, preventing
  unnecessary retry loops for password failures and allowing retries for hash
  failures
- Improved logging to include authentication method context on errors in trust
  enumeration
- Fixed principal construction for `impacket-getST` in inter-realm trust
  forging to use the source domain, ensuring correct cross-realm TGT usage and
  preventing silent failures during ticket acquisition

**Added:**

- Azure golden image template (`ares-golden-azure`) with README, provisioning
  playbook, and Warpgate YAML manifest for Azure VM Image Builder and Compute
  Gallery smoke testing
- Python helper `cross_realm_tgs.py` to request a TGS using a cross-realm TGT,
  working around impacket's getST cross-realm bug
- Unit tests to ensure domain SID extraction skips truncated principal SIDs and
  only returns bare SIDs

**Changed:**

- Harden domain SID extraction logic to avoid caching SIDs from arbitrary recon
  output (e.g., foreign-security-principal SIDs) by only accepting SIDs from
  impacket-lookupsid output with the canonical header
- Update orchestrator to resolve and cache parent domain SIDs on-demand for
  child→parent forgeries, deferring trust forging if SID resolution fails
- Use extracted and verified target domain SID for ExtraSid injection in
  inter-domain trust forging, preventing misforged tickets
- Replace impacket-getST with the embedded Python helper in inter-realm TGS
  requests to ensure proper cross-realm ticket acquisition and error handling
- Update output and error messages in the trust forging workflow to reflect the
  use of the new helper

**Removed:**

- Old logic that allowed truncated principal SIDs to be accepted as domain SIDs
  in parsing, preventing downstream ticket forging errors

**Added:**

- Added regex and extraction logic for parsing domain SIDs from rpcclient
  `lsaquery` output, enabling SID discovery from unauthenticated LSARPC queries
- Introduced tests for various lsaquery output scenarios, including CRLF
  handling, flat name casing, and adjacency requirements

**Changed:**

- Enhanced domain SID extraction in result processing to accept either
  impacket-lookupsid or rpcclient lsaquery output as authoritative sources
- Updated flat name resolution logic to prefer lsaquery flat names when present,
  improving accuracy in cross-forest SID attribution
- Expanded and clarified documentation comments to reflect new lsaquery support

…tructions

**Added:**

- Added logic to detect when a credential is cross-forest and generate detailed
  operator instructions for null-session SID enumeration, including guidance on
  running `rpcclient` and `impacket-lookupsid` for legacy DCs
- Injected these instructions into the task payload to ensure the agent
  executes the proper fallback steps and provides parser-friendly output

**Changed:**

- Modified the SID enumeration loop to conditionally include operator
  instructions in the payload when cross-forest conditions are detected, to
  improve automation reliability in multi-forest environments

…n worker cgroup limits

**Added:**

- Added removal of legacy `ares-worker@.service` systemd unit to prevent conflicts with new naming, disabling any running instances and deleting the old file in EC2 setup script
- Introduced strict cgroup resource limits (memory and task count) to systemd worker template to contain runaway child processes and prevent system OOMs

**Changed:**

- Updated credential ingestion logic to never promote credential-supplied domains into the canonical `state.domains` registry; only authoritative recon can modify this state, preventing LLM typos from corrupting global domain view
- Adjusted logging to warn (not promote) when unknown domains are referenced in credentials, surfacing hallucinations without mutating state
- Updated test to ensure credential ingestion does not pollute `state.domains` with LLM-supplied entries and verifies credentials are still ingested
- Enhanced lateral movement dispatcher to refuse cross-realm credential use when no trust path is known, preventing wasteful ACCESS_DENIED attempts
- Skipped ACL discovery, ADCS escalation, and LSASS dump tasks for domains or hosts that are already fully dominated, reducing redundant work and resource usage
- Improved EC2 test script to stop existing workers and running operations before deployment, and to start workers only after deploying fresh binaries and clearing Redis

**Removed:**

- Removed auto-extraction and promotion of credential domains into `state.domains` from credential publishing logic to maintain strict separation between recon and credential ingestion

…ce repo

**Changed:**

- Pin setuptools to version <81 in the noPac venv to ensure pkg_resources is
  available for impacket compatibility, preventing import errors in
  privesc_tools Ansible role
- Update nimbus_range source in warpgate template to point to the new ares
  repository and checkout the feat/more-attack-cov branch for improved attack
  coverage
- Adjust file copy command in warpgate provisioner to correctly copy the
  ansible directory contents from the new repository layout

…late

**Changed:**

- Updated Azure VM size from Standard_D4s_v3 to Standard_D2as_v7 to optimize
  resource usage in the warpgate template
- Removed unused or redundant Azure target properties: resource_group,
  location, gallery, gallery_image_definition, os_type, and identity_id to
  streamline the template configuration

**Added:**

- Introduced `mssql_openquery` tool and API for cross-forest MSSQL pivots, allowing use
  of stored login mappings to bypass Kerberos double-hop issues
- Added `impersonate_user` parameter to all linked-server MSSQL tools to enable
  source-side `EXECUTE AS LOGIN` for privilege escalation and cross-forest hops
- Implemented deduplication tracking for cross-realm lateral movement attempts to
  suppress repeated dead-end retries and provide clear LLM feedback
- Added `/etc/hosts` idempotent mapping logic in trust privesc to ensure FQDN
  resolution for Kerberos/SPN on workers without DNS access

**Changed:**

- Reduced orchestrator systemd unit concurrency and added memory limits (`MemoryHigh`,
  `MemoryMax`) for both orchestrator and worker units, and introduced a systemd slice
  with overall memory/task caps for Ares processes
- EC2 setup script now creates a swap file for OOM resilience and tunes kernel
  swappiness/OOM behavior
- Orchestrator callback and dispatcher now pre-check and reject cross-realm lateral
  requests, returning a clear message to LLM and marking dedup state to avoid retries
- MSSQL exploitation automation and LLM documentation updated with explicit cross-forest
  pivot guidance, including `mssql_openquery` and `impersonate_user` usage
- Enhanced MSSQL tool registry schemas and help text to document cross-forest caveats and
  parameter usage
- Default memory/task caps in orchestrator and worker systemd units adjusted for safety
- Azure warpgate template improved to ensure apt cache freshness and set up cloud-init
  wait, explicit location, and identity for resource deployment

**Removed:**

- Legacy `clear_dedup` logic for trust exploits that failed to compromise krbtgt, now
  replaced by marking the vuln exploited and waking cross-forest fallback paths