Inspiration
The UMBC Cyber Defense Exercise is approaching. I aimed to create a project that would help myself, my team, and others interested in CDE's participate and learn about active directory through practice.
What it does
We built CDEWatchdog to act as an automated, continuous sanity check for Active Directory.
Instead of digging through endless event logs, you get an immediate visual health score. If your Domain Controller matches our pristine "Golden State" baseline, you sit at 100%. The second a rogue admin is created or a security policy is disabled, the score tanks (e.g., down to 30%) and flags the exact MITRE ATT&CK technique being used.
We specifically targeted persistence mechanisms that defenders tend to overlook during opening triage: Winlogon Userinit and Shell hijacks (T1547.004) Rogue logon scripts via UserInitMprLogonScript (T1037) Run / RunOnce registry keys (T1547.001) Disabled Windows Firewall profiles & disabled LSA Credential Guard (RunAsPPL)
The "Panic Purge" Button Finding a breach is only half the battle. We added an emergency remediation routine that surgically kicks rogue accounts out of Domain Admins, disables backdoor users, wipes malicious Run keys, and turns the firewall back on—all while strictly protecting your legitimate baseline admins so you don't lock yourself out of your own domain. Twin Process Resurrection Malware authors love mutual persistence, so we borrowed their playbook for defense. The agent runs as two twin processes (Alpha and Bravo). If an attacker gets on the box and tries to kill one with taskkill, the surviving twin notices within seconds and silently revives its partner in the background.
How we built it
Compiles on bare, air-gapped Windows Servers (2012–2022) using the pre-installed native .NET Framework compiler in under 2 seconds.
Native Win32 P/Invoke: Directly invokes Netapi32.dll (NetUserEnum, NetLocalGroupGetMembers) and ADSI LDAP without spawning a single PowerShell process.
Embedded Micro-Server: Runs an in-memory HttpListener daemon hosting the responsive cyber dashboard, REST endpoints (/api/state, /api/panic, /api/whitelist), and dynamic operator controls.
Challenges we ran into
Domain Knowledge. Building this project was in part an attempt to learn more about Active Directory. Since the problem definition required in depth knowledge of AD and AD access libraries in C#, I quickly realized that defining and scoping the problem required a significant amount of research. In order to overcome this, I spent a large chunk of the Hackathon learning about Active Directory. Once I could sufficiently describe the problem and could articulate what needed to be accessed, and what additional problems to avoid, I spent time curating a markdown for an LLM prompt. Once I had the markdown completed, I was able to pass the markdown to AntiGravity IDE to write the core functionality.
Accomplishments that we're proud of
Discovering the native windows .NET compiler enabled the solution to be deployed in seconds! Implementing considerations for persistence, and bypassing Powershell commands!
What we learned
I learned a TON about Active Directory, common attack vectors, baselining, and libraries that could be used o access and modify system files.
What's next for Active Directory Integrity Auditor
In addition to needing polish, the dashboard still presents a vulnerability in a CDE. By listening on a port, even locally, this creates a new exploitable path for adversaries to gain access. In order to customize the authorized users and domain admins, The program currently requires modification to the code to change the "golden state" parameters. A more user friendly way to do this would improve the usability of the tool. My hope is to create a reliable tool that can help the UMBC cyber team win competitions!
Log in or sign up for Devpost to join the conversation.