Network Audit
Overview
Full-spectrum Windows security audit. Runs 6 domain modules, scores every finding with CVSS v3.1, presents a report sorted by severity, then offers interactive remediation with per-command confirmation. Local machine only — for remote machines, run Claude Code directly on that machine.
Audit Sequence
For each module below, in order:
- Read the module file listed
- Run ALL its data collection commands in parallel
- Analyze output against the risk indicators defined in that module
- Assign a CVSS score to each finding using the rubric below
- Add findings to a running list
After all 6 modules: sort findings by CVSS score descending, present the full report, then enter the remediation loop.
| # |
Module file |
Domain |
Remediation file |
| 1 |
modules/network.md |
Interfaces, ports, connections, protocols, Wi-Fi |
remediation/network-fixes.md |
| 2 |
modules/authentication.md |
NTLM, accounts, password policy, credential guard |
remediation/auth-fixes.md |
| 3 |
modules/services.md |
Running services, unquoted paths, weak ACLs |
remediation/services-fixes.md |
| 4 |
modules/remote-access.md |
RDP, WinRM, SSH, WMI |
remediation/remote-access-fixes.md |
| 5 |
modules/persistence.md |
Scheduled tasks, autoruns, WMI subscriptions |
remediation/persistence-fixes.md |
| 6 |
modules/patching.md |
Windows Update, Defender, runtime versions |
remediation/patching-fixes.md |
CVSS v3.1 Scoring Rubric
| Factor |
Value |
Weight |
| Attack Vector |
Network / Adjacent / Local / Physical |
0.85 / 0.62 / 0.55 / 0.20 |
| Attack Complexity |
Low / High |
0.77 / 0.44 |
| Privileges Required |
None / Low / High |
0.85 / 0.62 / 0.27 |
| User Interaction |
None / Required |
0.85 / 0.62 |
| Confidentiality |
High / Low / None |
0.56 / 0.22 / 0.00 |
| Integrity |
High / Low / None |
0.56 / 0.22 / 0.00 |
| Availability |
High / Low / None |
0.56 / 0.22 / 0.00 |
Score bands: 9.0–10.0 Critical · 7.0–8.9 High · 4.0–6.9 Medium · 0.1–3.9 Low · 0.0 Info
Report Format
═══════════════════════════════════════════════════
NETWORK SECURITY AUDIT — <hostname>
<date> | Modules: 6 | Findings: <n>
═══════════════════════════════════════════════════
EXECUTIVE SUMMARY
Critical : <n> High : <n> Medium : <n> Low : <n>
Total exposure score: <sum>
─── CRITICAL ────────────────────────────────────────
[9.8] SMBv1 Enabled (network)
SMBv1 is vulnerable to EternalBlue/WannaCry.
Vector: AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H
Fix available: yes
List all findings grouped by severity band, ordered by score descending within each band.
Remediation Loop
After the full report, work through findings Critical → High → Medium → Low.
For each finding:
- Display: title, score, and exact fix command from the remediation file listed in the Audit Sequence table above for that module
- Prompt:
Apply this fix? [yes / no / skip-severity / stop]
yes → run command, report success/error, continueno → skip, continueskip-severity → skip all remaining at this severity levelstop → exit, show summary
- For any finding tagged ⚠ DESTRUCTIVE in the remediation file, add:
⚠ This will affect running services/auth. Confirm? [yes / no]
- Never retry a failed command — report error and move on
End with:
Remediation complete.
Fixed : <n> (CVSS reduced by <x> pts)
Skipped : <n> (scores: <list> — still open)
Failed : <n> (see errors above)
Remaining exposure score: <sum>
1---2name: network-audit3description: Use when asked to run, perform, or conduct a network audit, network assessment, network scan, network security review, or security posture check on the current machine4---56# Network Audit78## Overview9Full-spectrum Windows security audit. Runs 6 domain modules, scores every finding with CVSS v3.1, presents a report sorted by severity, then offers interactive remediation with per-command confirmation. Local machine only — for remote machines, run Claude Code directly on that machine.1011## Audit Sequence1213For each module below, in order:141. Read the module file listed152. Run ALL its data collection commands **in parallel**163. Analyze output against the risk indicators defined in that module174. Assign a CVSS score to each finding using the rubric below185. Add findings to a running list1920After all 6 modules: sort findings by CVSS score descending, present the full report, then enter the remediation loop.2122| # | Module file | Domain | Remediation file |23|---|---|---|---|24| 1 | `modules/network.md` | Interfaces, ports, connections, protocols, Wi-Fi | `remediation/network-fixes.md` |25| 2 | `modules/authentication.md` | NTLM, accounts, password policy, credential guard | `remediation/auth-fixes.md` |26| 3 | `modules/services.md` | Running services, unquoted paths, weak ACLs | `remediation/services-fixes.md` |27| 4 | `modules/remote-access.md` | RDP, WinRM, SSH, WMI | `remediation/remote-access-fixes.md` |28| 5 | `modules/persistence.md` | Scheduled tasks, autoruns, WMI subscriptions | `remediation/persistence-fixes.md` |29| 6 | `modules/patching.md` | Windows Update, Defender, runtime versions | `remediation/patching-fixes.md` |3031## CVSS v3.1 Scoring Rubric3233| Factor | Value | Weight |34|---|---|---|35| **Attack Vector** | Network / Adjacent / Local / Physical | 0.85 / 0.62 / 0.55 / 0.20 |36| **Attack Complexity** | Low / High | 0.77 / 0.44 |37| **Privileges Required** | None / Low / High | 0.85 / 0.62 / 0.27 |38| **User Interaction** | None / Required | 0.85 / 0.62 |39| **Confidentiality** | High / Low / None | 0.56 / 0.22 / 0.00 |40| **Integrity** | High / Low / None | 0.56 / 0.22 / 0.00 |41| **Availability** | High / Low / None | 0.56 / 0.22 / 0.00 |4243Score bands: 9.0–10.0 Critical · 7.0–8.9 High · 4.0–6.9 Medium · 0.1–3.9 Low · 0.0 Info4445## Report Format4647```48═══════════════════════════════════════════════════49 NETWORK SECURITY AUDIT — <hostname>50 <date> | Modules: 6 | Findings: <n>51═══════════════════════════════════════════════════52EXECUTIVE SUMMARY53 Critical : <n> High : <n> Medium : <n> Low : <n>54 Total exposure score: <sum>5556─── CRITICAL ────────────────────────────────────────57[9.8] SMBv1 Enabled (network)58 SMBv1 is vulnerable to EternalBlue/WannaCry.59 Vector: AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H60 Fix available: yes61```6263List all findings grouped by severity band, ordered by score descending within each band.6465## Remediation Loop6667After the full report, work through findings Critical → High → Medium → Low.6869For each finding:701. Display: title, score, and exact fix command from the remediation file listed in the Audit Sequence table above for that module712. Prompt: `Apply this fix? [yes / no / skip-severity / stop]`72 - `yes` → run command, report success/error, continue73 - `no` → skip, continue74 - `skip-severity` → skip all remaining at this severity level75 - `stop` → exit, show summary763. For any finding tagged **⚠ DESTRUCTIVE** in the remediation file, add: `⚠ This will affect running services/auth. Confirm? [yes / no]`774. Never retry a failed command — report error and move on7879End with:80```81Remediation complete.82 Fixed : <n> (CVSS reduced by <x> pts)83 Skipped : <n> (scores: <list> — still open)84 Failed : <n> (see errors above)85 Remaining exposure score: <sum>86```
SamElhagDev