Essential Detection Starter Package

Analysis includes:

Detect Domain Controllers
FSMO Role Analysis
Enumerate Organisation Units and Security Groups
User Analysis
Detect Local Mail Servers
Detect Time Servers

Discover Network Shares
Detect Major Applications
Detailed Domain Controller
SQL Server Analysis
Internet Domain Analysis
Password Strength
Missing Security Updates

System by System Event Log
External Security Vulnerabilities
Detect System Protocol Leakage
Detect Unrestricted Protocols
Detect User Controls

Detect Wireless Access
External Security Vulnerabilities
Network Share Permissions
Domain Security Policy
Plus top 5 domains listed on dark web

The ACSC Essential 8 is a series of strategies recommended by the Australian Government to support Australian businesses prevent cyber-attacks, limit damage caused by cyber-attacks and, if all else fails, recover data lost from attacks or human errors.

How many of the Essential 8 have you completed?

How the ‘Essential Detection Package’ covers each element of the ASD Essential 8

ASD 8 Control	Discovery Phase
#1 Application control	Identify applications deployed, and systems servers and workstations) they are deployed to Identify policy settings applied to workstations / users to achieve application control and GPO consistency
#2. Patch applications	Identify application versions deployed, and systems servers and workstations) they are deployed to
#3. Configure Microsoft Office macro settings	N/A
#4. User application hardening	Identify policy settings applied to workstations and users to achieve application hardening Identify policy settings applied to secure applications
#5. Restrict administrative privileges	Identify administrator accounts, admin security groups and users with access. Identify Service Accounts
#6. Patch operating systems	Identify server and workstations OS version Identify missing patches for detected servers & workstations Identify unsupported OS's
#7. Multi-factor authentication	N/A
#8. Daily backups	Detects backup software agent and last known backup

ASD 8 Control	Discovery Phase
#1 Application control	Identify applications deployed, and systems servers and workstations) they are deployed to Identify policy settings applied to workstations / users to achieve application control and GPO consistency
#2. Patch applications	Identify application versions deployed, and systems servers and workstations) they are deployed to
#3. Configure Microsoft Office macro settings	N/A
#4. User application hardening	Identify policy settings applied to workstations and users to achieve application hardening Identify policy settings applied to secure applications
#5. Restrict administrative privileges	Identify administrator accounts, admin security groups and users with access. Identify Service Accounts
#6. Patch operating systems	Identify server and workstations OS version Identify missing patches for detected servers & workstations Identify unsupported OS's
#7. Multi-factor authentication	N/A
#8. Daily backups	Detects backup software agent and last known backup

Discovery Phase
Identify applications deployed, and systems servers and workstations) they are deployed to Identify policy settings applied to workstations / users to achieve application control and GPO consistency
Identify application versions deployed, and systems servers and workstations) they are deployed to
N/A
Identify policy settings applied to workstations and users to achieve application hardening Identify policy settings applied to secure applications
Identify administrator accounts, admin security groups and users with access. Identify Service Accounts
Identify server and workstations OS version Identify missing patches for detected servers & workstations Identify unsupported OS's
N/A
Detects backup software agent and last known backup

How long does the scan take to run?

Allow for about 3-6 hours for the scans to be run. Some scans may vary due to the number of subnets or devices being scanned.

What is the ASD Essential 8?

The Essential Eight is a series of baseline mitigation strategies taken from the Strategies to Mitigate Cyber Security Incidents recommended for organisations. Implementing these strategies as a minimum makes it much harder for adversaries to compromise systems.

What does ASD stand for?

ASD is an acronym for Australian Signals Directorate and is the parent organisation for the Australian Cyber Security Centre (ACSC).

Security Scan – Scope Limits:

Maximum of 5 external domains to be scanned
Maximum of 8 external IP addresses to be scanned
Report provides first 5 usernames (per domain) detected on Dark Web
Excludes data scan for personally identifiable information (PII)

Network Scan – Scope Limits:

A maximum of 3x /24 subnets
A maximum of 3x AD Domains