configuring-active-directory-tiered-model
Warn
Audited by Socket on Sep 14, 2026
1 alert found:
AnomalyAnomalyscripts/agent.py
LOWAnomalyLOW
scripts/agent.py
The code is a straightforward Active Directory auditing utility with no clear malicious behavior, data exfiltration, persistence, or destructive activity. It does handle highly sensitive directory information and credentials. Use LDAPS or StartTLS with certificate validation, avoid passing passwords on the command line, restrict report output paths, and correct the incomplete `main(` call. The malware likelihood is very low, while the security risk is moderate due to plaintext NTLM transport and credential exposure risks.
Confidence: 99%Severity: 52%
Audit Metadata