368 testcases - Linux LIN-* (165), Windows WIN-* (153), and shared GEN-* (50). Checks are applicability-gated, not duplicated: a Linux host runs ~215, a Windows host ~200; the union is 368.
| Family | Count | Coverage |
|---|---|---|
LIN-FS | 15 | Partitions (/tmp, /var, /home, …), mount options, bootloader perms, core dumps |
LIN-SV | 10 | Legacy/inetd services, telnet/rsh/tftp clients absent, MTA posture |
LIN-NET | 20 | IP forwarding, ICMP, rp_filter, redirects, syncookies, IPv6 |
LIN-FW | 5 | firewalld/ufw/nftables/iptables default-deny |
LIN-LOG | 14 | rsyslog/journald config, permissions, rotation, remote forwarding |
LIN-AU | 12 | auditd rules, immutability, retention |
LIN-SSH | 15 | sshd: root login, ciphers/MACs/KEX, auth limits, forwarding |
LIN-PAM | 14 | pwquality, faillock, pwhistory, password ageing, sudo policy |
LIN-USER | 20 | passwd/shadow/group perms, UID 0 uniqueness, umask, home perms |
LIN-TH | 40 | Kernel attack surface (eBPF, userns, io_uring, kptr/dmesg, lockdown), persistence hunting, containers/EOL/currency |
WIN-ACC | 14 | Account policy (length/age/history/lockout, LSA restrictions, admins) |
WIN-AU | 10 | Audit subcategories via auditpol /get (never secedit /export) |
WIN-SEC | 22 | UAC, LM/NTLM, SMB signing, screen lock, legal notice, SMBv1 |
WIN-UR | 16 | User rights via read-only LSA policy APIs |
WIN-EVT | 6 | Event log sizes/retention/permissions |
WIN-DEF | 10 | Defender AV + ASR + update posture |
WIN-SVC | 20 | Legacy/unnecessary services (Telnet, TFTP, RemoteRegistry, Spooler, …) |
WIN-REG | 10 | Registry/filesystem ACLs, Run keys, unquoted service paths |
WIN-NET | 18 | Firewall profiles, LLMNR/mDNS, RDP, WinRM, LDAP signing, NTLM |
WIN-TH | 27 | Credential protection (LSA PPL, Credential Guard, HVCI, WDigest), ASR, persistence (IFEO, WMI, tasks, netsh), EOL/LAPS |
GEN-INV | 25 | Inventory: ports, packages, users, tasks, shares, patch, TPM/Secure Boot, EDR/backup, identity |
GEN-SRV | 24 | Server config review: time sync, DNS redundancy, updates, backup, log forwarding, pending reboot, certs, firewall, sudo/UAC, free space, swap, LDAP/Kerberos |
Info
There is also one internal self-test (GEN-TOY-001), which is why the GEN family totals 50 (25 + 24 + 1). --list-checks prints the full set; every check degrades (never false-passes) when evidence is unavailable.