performing-service-account-audit

name	performing-service-account-audit
description	Audit service accounts across enterprise infrastructure to identify orphaned, over-privileged, and non-compliant accounts. This skill covers discovery of service accounts in Active Directory, cloud pl
domain	cybersecurity
subdomain	identity-access-management
tags	["iam","identity","access-control","service-accounts","audit","governance"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"]
mitre_attack	["T1078","T1110","T1556","T1098","T1069"]

Performing Service Account Audit

Overview

Audit service accounts across enterprise infrastructure to identify orphaned, over-privileged, and non-compliant accounts. This skill covers discovery of service accounts in Active Directory, cloud platforms, databases, and applications, assessing privilege levels, identifying missing owners, and enforcing lifecycle policies.

When to Use

• When conducting security assessments that involve performing service account audit
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• Familiarity with identity access management concepts and tools
• Access to a test or lab environment for safe execution
• Python 3.8+ with required dependencies installed
• Appropriate authorization for any testing activities

Objectives

• Discover all service accounts across AD, cloud, databases, and applications
• Identify orphaned accounts with no valid owner or associated application
• Assess privilege levels and flag over-privileged service accounts
• Check for non-rotating passwords and weak authentication
• Map service account dependencies for safe remediation
• Generate compliance reports for SOX, PCI DSS, and HIPAA audits

Key Concepts

Service Account Types

1. AD Service Accounts: Windows services, scheduled tasks, IIS app pools
2. Managed Service Accounts (gMSA): AD-managed automatic password rotation
3. Cloud IAM Service Accounts: AWS IAM roles/users, Azure service principals, GCP service accounts
4. Database Service Accounts: Application connection accounts, replication accounts
5. Application Service Accounts: API keys, bot accounts, integration accounts

Audit Dimensions

• Ownership: Who is responsible for this account?
• Purpose: What application/service uses this account?
• Privileges: What permissions does this account have?
• Authentication: How does this account authenticate (password, key, certificate)?
• Rotation: When was the credential last changed?
• Activity: When was this account last used?

Workflow