Lightweight Zero Trust Layer for Active Directory (Proof-of-Concept)

This project is a proof-of-concept (PoC) for implementing a lightweight, real-time Zero Trust security layer for a Microsoft Active Directory domain. It ingests authentication logs, scores them based on risk, and triggers automated responses to mitigate potential threats.

---

## 🏛️ Architecture

The system operates on a continuous feedback loop, applying the NIST Cybersecurity Framework functions (Identify, Detect, Respond) in real-time.

1. Log Forwarder (forward_logs.ps1): A PowerShell script on a Domain Controller captures security events (ID 4624, 4625) and sends them to the backend.
2. Backend Engine (app.py): A Python Flask application receives the logs. For each event, it:
   • Identifies the user and their context by querying AD via LDAP.
   • Detects anomalies and calculates a risk score based on predefined rules.
   • Responds by triggering a PowerShell script if the risk score exceeds a set threshold.
3. Responder (response.ps1): This PowerShell script performs actions in Active Directory, such as disabling a user or adding them to an MFA group.
4. Dashboard (dashboard.html): A simple web interface provides a real-time view of events, risk scores, and actions taken.

---

## ✨ Features

• Real-time Event Processing: Ingests and analyzes AD logon events as they happen.
• Context-Aware Risk Scoring: Enriches log data with AD group memberships to make smarter decisions.
• Automated Response: Can automatically disable high-risk accounts or enforce MFA.
• Simple Visualization: Includes a lightweight dashboard for monitoring security events.
• Lightweight Stack: Built with common tools like Python (Flask), PowerShell, and LDAP.

---

## 🛠️ Tech Stack

• Backend: Python 3, Flask, ldap3
• Scripts: PowerShell 7+
• Directory Service: Microsoft Active Directory
• Frontend: HTML, CSS, JavaScript

---

## 🚀 Getting Started

Prerequisites

• An Active Directory test environment.
• A Windows machine with the AD PowerShell Module (RSAT-AD-PowerShell).
• Python 3.9+
• An AD service account with permissions to read user objects and modify them (for response actions).

Installation & Configuration

1. Clone the repository:

   git clone [https://github.com/Raafay892/zero-trust-ad-poc.git](https://github.com/Raafay892/zero-trust-ad-poc.git)
   cd zero-trust-ad-poc

2. Install Python dependencies:

   pip install Flask ldap3

3. Configure the backend (app.py): Update the AD connection details with your environment's information:

   • AD_SERVER
   • AD_USER
   • AD_PASSWORD
   • AD_SEARCH_BASE

4. Configure the forwarder (forward_logs.ps1):

   • Set the $backendUrl to the IP address of the machine running the Flask app.

5. Prepare Active Directory:

   • Create a security group named MFA-Required-Users.

Running the Application

1. Start the Flask backend:

   python app.py

2. Open the dashboard in your browser at http://127.0.0.1:5000.

3. Run the log forwarder on your Domain Controller to send events:

   # Open a pwsh.exe terminal
   Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process
   .\forward_logs.ps1

---

## ⚠️ Disclaimer

This is a proof-of-concept and is NOT suitable for production environments. It lacks critical security features, error handling, and scalability. The primary goal is to demonstrate the architectural concept.

---

## 📄 License

This project is licensed under the MIT License. See the LICENSE file for details.