The attack-surface audit

Twelve controls, each one a condition Mimikatz depends on, each carrying a stable ID, a severity, the evidence behind the verdict, a remediation and the exact module it corresponds to. This is the part that runs without any flag — it is read-only and it is the reason the tool exists.

obliteratus.exe --audit          # human-readable, exit 1 when a CRITICAL/HIGH control fails
obliteratus.exe --audit --json   # machine-readable
obliteratus.exe --audit --csv    # spreadsheet

Checks degrade to unknown, never to a false pass. If a privilege or an asset is missing, the control reports that it could not see, because an audit that guesses is worse than one that admits a gap.

The twelve controls

Verified against a live report on a fully patched Windows 11 host (elevated context).
ID	Control	Mimikatz	Technique	Severity
MK-WDIGEST	WDigest does not cache plaintext credentials	sekurlsa::wdigest	T1003.001	CRITICAL
MK-AUTOLOGON-PASS	No cleartext password stored in Winlogon	winlogon\DefaultPassword	T1552.001	CRITICAL
MK-LSASS-PPL	LSASS runs as a protected process (PPL)	sekurlsa::logonpasswords	T1003.001	HIGH
MK-CREDGUARD	Credential Guard / virtualization-based security enabled	sekurlsa::logonpasswords	T1003.001	HIGH
MK-SEDEBUG	`SeDebugPrivilege` not enabled in the current token	privilege::debug	T1134.001	HIGH
MK-AV	Endpoint protection installed and enabled	—	T1562.001	HIGH
MK-PSLOG	PowerShell Script Block Logging enabled	—	T1059.001	MEDIUM
MK-LAPS	Managed local admin password (LAPS) in use	—	T1078.002	MEDIUM
MK-AUTOLOGON	Automatic logon disabled	lsadump::secrets	T1003.004	MEDIUM
MK-SYSMON	Sysmon or equivalent EDR telemetry installed	—	—	LOW
MK-CACHEDLOGONS	Cached domain logon count reviewed	lsadump::cache	T1003.005	INFO
MK-CONTEXT	Audit execution context — elevated or not	—	—	INFO

Exit-code contract

Worst severity found	Exit code	Meaning for a pipeline
CRITICAL or HIGH failing	1	Gate the merge / fail the hardening review
MEDIUM, LOW, INFO only	0	Report, do not fail

Expect exit 1 on a healthy workstation, and read the report before you call it a false alarm. On a fully patched, fully elevated Windows 11 host the live report shows MK-SEDEBUG failing as HIGH: the token carries SeDebugPrivilege but has not enabled it, and a high-integrity admin token can enable it whenever it wants — which is precisely the point the control is making. The contract is about the worst severity, so that one HIGH is what makes a scripted run exit non-zero.

Report shape

Findings carry id, title, severity, status, evidence, remediation, technique and module, alongside tool, version, hostname, generated_at, elevated, modules and a summary count per severity. Stable IDs mean you can diff two runs across a remediation window and see exactly which control moved.

Adding a check is one function plus one line in RunChecks — see CONTRIBUTING.md. The audit package never imports server; progress is reported through an Emitter callback so the checks stay unit-testable.