2025.9.8 - Reduced False Positives!

[jakehildreth]

This PR solves one issue:

• False positives in ESC1 as identified by @vilacham in two articles: The Schrödinger’s ESC1 Vulnerability & The Schrödinger’s ESC1 Vulnerability: Benchmark Update. The new detection logic has been applied to all template-based ESCs.

Additionally, the PR improves the following functionality:

• Previously, when template-based ESCs were identified along with 1+ ESC5 issues on the Certification Authority object itself, Locksmith would only raise the risk score by one point, regardless of how many principals could abuse this configuration. This release adds some granularity to this additional risk.

[Copilot]

Pull Request Overview

This PR addresses false positives in ESC vulnerability detection by refining the logic to check specific object types for Extended Rights permissions, as identified in research by @vilacham. The updated detection logic requires that Extended Rights permissions must be accompanied by specific object type GUIDs (Enroll or All) to qualify as vulnerabilities, reducing false positives across all template-based ESC checks.

• Updated ESC detection logic to validate Extended Rights permissions against specific object type GUIDs
• Enhanced ESC5 risk scoring to add granularity for individual principals beyond groups
• Updated timeout values and improved code formatting consistency

Reviewed Changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
Public/Invoke-Locksmith.ps1	Updates version number, dangerous rights pattern, timeout message formatting, and GitHub link
Private/Set-RiskRating.ps1	Adds risk scoring for individual principals in ESC5 scenarios
Private/Set-AdditionalCAProperty.ps1	Reduces timeout values and removes commented code
Private/Find-ESC*.ps1 files	Implements refined Extended Rights detection logic with object type validation
Locksmith.psm1	Minor code style improvements with consistent casing
Locksmith.psd1	Updates module version to 2025.9.8
Invoke-Locksmith.ps1	Applies same detection logic updates and formatting improvements as module files

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

The regex pattern 'Write' is overly broad and will match unintended permissions like 'WriteExtendedAttributes' or 'WriteValidatedWrite'. Consider using more specific patterns like 'WriteDacl|WriteOwner|WriteProperty' to avoid false positives.

Suggested change

	$DangerousRights = 'GenericAll|Write'
	$DangerousRights = 'GenericAll|WriteDacl|WriteOwner|WriteProperty'